FEMA finds a better approach to systems security
Connecting state and local government leaders
An aggressive push for improved authentication has resulted in savings, standardization and safer data.
The Federal Emergency Management Agency is expected to jump into action during the nation’s worst crises and natural disasters -- even those in its own online backyard.
So when federal agencies were shaken by the massive breach of Office of Personnel Management records, FEMA officials moved quickly to safeguard their information with much-improved authentication.
“The outcome we are creating is interoperability across federal, state, local, territorial and tribal governments [to] transform the way the agency responds and recovers from natural and man-made disasters,” FEMA CIO Adrian Gardner told GCN.
Last October, Gardner’s team began working with IBM Global Business Services to enable 76 of the agency’s high-priority systems to use personal identity verification cards and single sign-on capabilities to authenticate those accessing information on its systems. Over the course of the six-month project, the group oversaw more than 70 development teams, multiple vendors, eight FEMA program offices, 10 regional offices, and a wide and far-flung variety of deployments at various FEMA and non-FEMA hosting facilities and cloud providers.
Even for an agency primarily tasked with handling major catastrophes, the tight turnaround, widespread geographic coverage and involvement of so many stakeholders made the project especially challenging. And there are restrictions on changing FEMA systems during active disaster declarations, which added another degree of complexity.
“One of the many surprises was the amount of internal and external coordination required to successfully implement the program in just one year,” Gardner said.
Indeed, reaching agreement on a set of requirements for a fixed-price contract, working through cultural differences and sustaining top-level support throughout the project were major obstacles, he added.
The results, though, have been substantial. High-value systems are now at Level of Assurance 4, and employees have a standardized solution across the agency. The deployment was a major step forward in protecting data for FEMA, its partners and the disaster survivors it helps.