Why ATOs Suck

From the archives: this conversation was recorded in May 2024, so a few incidents mentioned, like the Ascension hospital attack and the BIG-IP issues, were current events at the time. The practices still hold up.Most vendor risk programs can tell you whether a supplier is financially stable. Far fewer can tell you what's inside the software that supplier ships. Matt Triner talks software supply chain security with Jessica Sweet and Dan Beller: where the common risks come from, why vendor self-attestations miss third-party libraries and dependencies, and what development teams can build in from day one.They cover "sprint zero" and adding SAST, software composition analysis, and quality gates before the first feature ships; proxying open-source packages through a local repository (and what the npm left-pad deletion taught everyone); attacks on edge devices; how cloud shifts responsibility onto dev teams through the shared responsibility model; and two unglamorous fixes that still get skipped: machine-readable SBOMs and multi-factor authentication.Hosted by Matt Triner, CEO & Founder, Hunter StrategyFeaturing:Jessica Sweet, VP, Cyber Risk, Hunter StrategyDan Beller, Director of Cloud Solutions, Hunter StrategyEpisode Chapters: 00:00 Intro00:38 Welcome and guest introductions02:03 Common software supply chain risks05:32 Sprint zero and overlooked best practices07:14 Local repositories and the left-pad lesson09:29 Vendor management vs. software security13:07 Supply chain compromise stories16:01 Attacks at the edge19:06 Cloud: help or added complexity?22:19 Best practices as everything moves to cloud24:34 SBOMs and MFA25:28 Outro

Most small and mid-size businesses will never have someone whose full-time job is insider risk. That doesn’t leave them defenseless.Host Matt Triner talks with AJ King, Chief Information Security Officer at Hunter Strategy, and Joel Cabrera, Security Operations Lead at Hunter Strategy, about what a resource-constrained business can do about insider threat once the basics like MFA and logging are in place. They cover hardening Microsoft 365 and Google Workspace, data labels that keep protecting files after they leave the organization, canary files, deny-by-default app controls, and regular access audits. Matt also argues that a healthy culture doesn’t prevent insider threats. It makes the warning signs visible to the people around them.The goal isn’t to make insider theft impossible. It’s to make it harder, less lucrative, and faster to catch.Chapters:00:00 Intro00:34 Matt sets up the episode and introduces AJ King and Joel Cabrera01:54 Insider threat comes after MFA and telemetry02:28 Separation of duties and the keys to the kingdom03:27 Being a potential insider threat to your customers04:08 Third-party targeting, hospitality, and a paid SIM swap scheme06:54 Hardening Google Workspace and Microsoft 36510:39 Microsoft Secure Score vs. Google’s hardening checklists12:04 Defender, Intune, and Autopilot as one stack13:56 Data labeling and classification14:49 Raising the bar: more friction, smaller payoff, faster detection15:41 Culture and stacking threat indicators19:33 Login-hour controls and the capacity problem in SMBs20:43 Role-based access and regular access audits21:39 Deny-by-default for cloud apps22:15 Purview labels that follow files outside the organization24:07 Network segmentation and bastion hosts25:08 What counts as an SMB, a startup, or mid-market28:49 Who owns insider risk when nobody does it full-time30:34 License costs don’t scale down31:43 Joiner, mover, and leaver processes32:37 Wrap-up32:41 OutroThis Is Fine is the cybersecurity podcast by Hunter Strategy. Where we take the chaos seriously, just not ourselves.New episodes drop Thursdays.

Why would a federal agency choose a small business for technology work when it isn’t required to? Host Matt Triner sits down with Kevin Belanga, Chief Growth Officer, and Roman Zhelenko, Director of Federal Capture, both of Hunter Strategy, to make that case from inside a small contractor.They talk through how a smaller company hires faster and adapts benefits to keep good people. They also cover why fixed-price contracts with loosely written requirements can turn small changes into contract modifications, and how a small firm’s reputation shapes the way it treats customers. Kevin and Matt each share an example of Hunter adjusting course when a program’s plans changed partway through. The conversation then turns to how cloud lowered the cost of entry for small firms, what agencies could change in their solicitations, and why HUBZone sole-source authority goes almost unused.Chapters00:00 Intro02:16 Matt sets up the episode and introduces Kevin and Roman04:03 Why small businesses move faster on hiring and decisions06:11 Flexible benefits: the co-working space example09:21 Customer service and the spirit of the contract12:35 Fixed-price contracts and the “that needs a mod” problem14:29 Why reputation shapes how small firms treat customers17:12 Adapting a program through the JEDI-to-JWCC transition20:03 Redirecting obligated funds after a product acquisition derailed a program23:54 How cloud changed the economics for small businesses28:47 Leveling the field: key personnel requirements and coding challenges33:17 Advisory down-selects and HUBZone sole-source authority36:03 Why acquisition staff overlook HUBZone firms41:15 Getting more from small business events and program office timeWrap-upOutro

This week, host Matt Triner has 2 Senior DevOps engineers unpack the realities of building software in DoD environment - from cloud lock-in, ATOs, and infrastructure as code to the documentation gaps that force teams to reinvent solutions. A candid look at why government modernization is often less about the technology and more about the systems around it.Catch show notes and more for this and previous episodes on the Hunter Strategy blog.Episode Chapters: 00:00 Introduction01:28 The Impact of Outdated Computer Systems07:17 Challenges of Migrating to Cloud10:40 Bureaucratic Hurdles and Cultural Resistance19:21 The Use of Kubernetes in DoD26:03 The Role of DoD Hosting Providers30:40 Recommendations for Improvement30:57 Improving Acquisition and Workforce Training35:34 Explaining Cloud Concepts and Compliance39:27 Sharing Knowledge and Best Practices40:55 Rethinking Legacy Systems43:15 Closing Remarks

The Authority to Operate (ATO) process is meant to show that a federal system is secure enough to run. In practice it’s usually months of checklists, interpretation, and debate with assessors. Matt talks with Chris Sowers, CEO of Watchtower Security Consultants, about why ATOs are so hard: governance lags behind technology, agencies interpret the same rules differently, and vendors get caught between FedRAMP, impact levels, and their customers’ expectations. They also cover how to get through it anyway.Chapters00:00 Intro00:34 Matt sets up the episode and introduces Chris01:18 An ATO explained as a yearly car registration03:09 California vs. Michigan: which agencies have the strictest ATOs05:30 SolarWinds and how public scrutiny shapes security posture06:02 FISMA’s ambiguity and why governance can’t keep pace with cloud07:54 Not applicable vs. non-compliant: the MongoDB Community Edition example11:01 Mitigating controls and alternate implementations12:44 Working with assessors: honesty, education, and trust14:36 Advice for a company facing its first ATO17:14 On-prem software in the stack: NIST 800-161, 800-171, and ITAR19:25 Why impact levels apply to cloud offerings, not software20:27 DocuSign vs. Salesforce: the gap in how agencies use FedRAMP21:55 Customer responsibility matrices and transitive trust26:26 The Jira-on-EC2 workaround29:45 How agency sponsorship speeds up FedRAMP authorization30:43 Wrap-up31:00 Outro

Summary:In this episode, Kevin Long, Jeff Segal, and Kevin Belanga explore the nuances of federal procurement challenges, including code challenges, oral assessments, and alternative procurement methods. They discuss how these approaches impact vendor evaluation, government decision-making, and the importance of aligning evaluation methods with project scope and complexity.Key Topics:Differences between in-room and take-home code challengesThe value and limitations of oral assessmentsThe role of external evaluators and source selection boardsBalancing cost, complexity, and procurement methodsThe importance of aligning evaluation methods with project scopeChallenges of evaluating technical competence remotelyInnovative approaches to vendor vetting, including pair programmingThe impact of procurement methods on small and large businessesEpisode Chapters:00:00 Introduction to Federal Procurement Challenges02:01 Different Types of Code Challenges in RFPs03:55 Evaluating Technical Competence Remotely05:53 The Role of External Evaluators and Source Boards07:56 Balancing Cost and Complexity in Procurement09:48 Innovative Vetting Methods: Pair Programming11:47 The Value of Oral Assessments13:57 The Theater of In-Person and Virtual Challenges16:01 Challenges for Small Businesses in Procurement18:14 Alternative Approaches to Traditional RFPs19:58 Simplifying Vendor Vetting with Pair Programming22:06 The Cost and Time of Code Challenges24:00 The Utility of Oral Presentations26:11 Media and Video in Vendor Evaluation28:13 Guarding Against Bait and Switch30:09 The Future of Federal Procurement Strategies

Matt Triner talks with PMO leaders Monique Williams and Tom Arnold about what separates a project management office that actually helps from one that's just overhead in government IT. They dig into the gap between mission goals and what the systems can really do, how to deal with tech debt, and what happens when siloed stakeholders keep stalling delivery. Later in the episode they get into agility, earning buy-in, and building trust on hybrid teams. Worth a listen if you're standing up a new PMO or trying to fix the one you've got.Episode Chapters:00:00 The Role of PMOs in IT Initiatives01:14 Critical Competencies of Effective PMOs06:09 Understanding Technical Aspects in PMOs10:45 Balancing Stakeholder Needs and Project Goals16:20 Measuring PMO Effectiveness20:58 Evaluating Good vs. Bad PMOs23:45 Agility in Project Management28:11 Engagement in a Hybrid Workforce34:38 Trends in PMO Operations41:06 Key Recommendations for Establishing a PMO

Cloud and code don't sit in separate lanes anymore, and neither do their vulnerabilities. Dan Beller (Director of Cloud Solutions) and Greg Vanore (Director of Software Development) join This Is Fine to dig into what secure software development actually demands once the checklist runs out. They cover the widening blast radius of cloud misconfigurations, the quiet risk of open source dependencies that lose their maintainers, and why "shift left" stays a slogan until contracts actually fund it. A detour through JavaScript's messy history makes the case that unchecked abstraction is its own security problem, tooling included. They also dig into why government agile adoption keeps colliding with government security posture, and what the NIST SSDF gets right about treating security as a mindset rather than a gate. It's a candid, occasionally cursed (RIP JScript) conversation about building software that survives contact with reality.Episode Chapters: 00:00 Introduction and Podcast Production00:44 Exploring Secure Software Development01:43 The Changing Threat Landscape03:05 Impact of Open Source Software04:55 Infrastructure Security and Open Frameworks05:57 Balancing Tooling and Understanding06:53 The Evolution and Challenges of JavaScript10:22 The Stabilization of UI Frameworks12:18 Challenges in Government Cloud Environments15:01 Agility and Security in Government16:40 Reconciling Agile Processes with Security22:35 Embedding Security in the Development Process24:55 The Scope of Secure Software Development

Everyone claims their testing tool does AI now, and Jay Newlin (Director of Quality Assurance) has the flooded inbox to prove it. He and Greg Vanore (Director of Software Engineering) join host Matt Triner to talk about cutting through that noise, why customers still don't believe automation is worth paying for, and the readable, declarative test frameworks that actually change their minds. Then things get personal with the two worst legacy code handoff stories you'll hear this year, one on burned CDs, one on three-ring binders of printed source code, and what disciplined test automation looks like when you inherit either one.Episode Chapters:00:00 Introduction00:07 Automated Quality Assurance Testing in Software Development01:22 Challenges in Assessing Tools for Automation Testing02:42 The Importance of Automation in Testing03:50 Educating Customers on the Value of Automation Testing04:41 Expanding Testing Techniques Beyond Traditional Methods05:48 Customer Perception of Automated Testing07:09 The Future of Automated Testing15:57 Balancing Rapid Deployment and Quality16:58 The Importance of Unit Test Coverage17:56 Maintaining Test Automation During Rapid Deployment20:41 The Role of Tooling in Government Environments22:56 Deliverables and Documentation in Government Contracts25:12 Testing Legacy Systems27:56 Considerations for Legacy Systems in Test Automation34:43 The Future State of Automated Testing

Ask 5 people to define threat intelligence and you'll get 5 different answers, and that's exactly where this episode starts. Will Elchert (Senior CTI Analyst, Hunter Strategy) and Jake Williams (VP of R&D, Hunter Strategy) join host Matt Triner alongside two clients living this from the buyer's side: Keith McCartney, SVP of Security and IT at DNA Nexus, and Billy Martin, CTSO at Vigor. Together, they break down what separates a threat intel program that actually drives decisions from one that's just, as Jake puts it, "cyber story time with the CTI team." The conversation covers where AI genuinely helps in CTI workflows and where it falls flat, how red and blue teams each get value out of the same intelligence, and what metrics actually prove a security program's worth to leadership.Episode Chapters: 00:00 Introduction to Cyber Threat Intelligence02:51 Defining Threat Intelligence05:41 Stakeholder Engagement in Cybersecurity08:34 Risk Management and Cyber Threat Intelligence11:36 Industry-Specific Approaches to Threat Intelligence14:25 The Importance of Context in Threat Intelligence17:07 Integrating Cybersecurity Functions19:51 Actionability of Threat Intelligence25:24 The Evolution of Cyber Threat Intelligence28:58 AI's Role in Cybersecurity32:19 Data Analysis and AI Integration37:14 Challenges and Opportunities with AI41:27 Human Element in Cyber Threat Intelligence49:57 Red Team vs Blue Team Dynamics52:28 Red Team vs Blue Team: Who Leverages CTI Better?55:02 Funding and Capability Development in Cybersecurity58:11 The Importance of Communication and Collaboration01:01:14 Metrics for Measuring Threat Intelligence Effectiveness01:09:45 Building a Cybersecurity Program from Scratch