惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

Cloudbric
Cloudbric
E
Exploit-DB.com RSS Feed
SecWiki News
SecWiki News
Forbes - Security
Forbes - Security
N
News | PayPal Newsroom
S
Security @ Cisco Blogs
Schneier on Security
Schneier on Security
V
V2EX - 技术
S
Secure Thoughts
W
WeLiveSecurity
Google DeepMind News
Google DeepMind News
C
CERT Recently Published Vulnerability Notes
NISL@THU
NISL@THU
S
Securelist
S
Security Archives - TechRepublic
Know Your Adversary
Know Your Adversary
V
Vulnerabilities – Threatpost
Security Latest
Security Latest
Recent Commits to openclaw:main
Recent Commits to openclaw:main
G
GRAHAM CLULEY
H
Hacker News: Front Page
Microsoft Azure Blog
Microsoft Azure Blog
I
Intezer
Google Online Security Blog
Google Online Security Blog
美团技术团队
阮一峰的网络日志
阮一峰的网络日志
T
The Exploit Database - CXSecurity.com
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
Webroot Blog
Webroot Blog
Jina AI
Jina AI
Engineering at Meta
Engineering at Meta
P
Proofpoint News Feed
The Cloudflare Blog
I
InfoQ
L
LangChain Blog
U
Unit 42
P
Proofpoint News Feed
S
Schneier on Security
S
Security Affairs
Y
Y Combinator Blog
T
Tenable Blog
N
News and Events Feed by Topic
MyScale Blog
MyScale Blog
量子位
Google DeepMind News
Google DeepMind News
Cyberwarzone
Cyberwarzone
博客园 - 聂微东
D
Darknet – Hacking Tools, Hacker News & Cyber Security
GbyAI
GbyAI
AWS News Blog
AWS News Blog

RapidFort Blog

RapidFort Test Blog Blog 4 Test Test Blog 3 Test 2 Mythos Vulnerability Assessment: Eliminate Real Risk, Not Just CVEs Securing Modern AI Workloads for National Security RBOM vs SBOM: The Critical Difference Between Software Inventory and Runtime Reality The Remediation Gap: When AI-Powered Discovery Outpaces Human Defense You Only Control 15% of Your Software. Here's How to Secure the Rest. Free ATO Readiness Cohort: Shorten Your Path to Federal Market US Cyber Strategy & Software Supply Chain Security EU CRA for Containers & Kubernetes: Scope, Deadlines & Steps PyPI, npm, and the New Frontline of Software Supply Chain Attacks GitHub Actions Security Audit: CI/CD Risk & Shell Injection What Is RBOM™? Runtime Bill of Materials vs SBOM Explained EU Cyber Resilience Act & Open Source Risk RapidFort Raises $42M Series A for Software Supply Chain Security Fintech Container Security 2026: SASM & RBOM™ RF Analyzer: Precision Container CVE Intelligence Kimia: Secure Kaniko Alternative for Kubernetes Builds AI-Powered Cyberattacks: How Defenders Must Adapt RapidFort Pioneered DoD Container Hardening | Industry Standard Turn Scanner Output into Verified CVE Elimination RapidFort's Giant Washing Machine: Cleaning Open Source at Scale Why SBOMs Fail: RBOM™ & Near-Zero CVE Images Fix the Gap Defeat NPM Supply Chain Worms: Near-Zero CVE Defense Bitnami & Chainguard Alternatives: Free Near-Zero CVE Images Runtime Profiling: Eliminate up to 99.9% of Container CVEs Flow Defending: AI-Speed Container Hardening & Runtime Visibility AI in Software Supply Chain Security: Defense vs Attackers SBOM vs RBOM™: Why Runtime Bill of Materials Wins AI-Powered Container Stack: Built, Hardened & Defended AI-Generated Code Vulnerabilities: Runtime Defense for Containers Container Vulnerability Management Reimagined | RBOM™ 35,000+ Near-Zero CVE Images: FIPS, STIG & AI-Era Standard RBOM™ Runtime Intelligence: Cut CVE Noise & Improve Accuracy EU Vulnerability Database (EUVD): Impact on CVE Management Critical Infrastructure Cyber Resilience: Near-Zero CVE DoD Software Procurement: SWIFT, cATO & Container Security Stop Fixing CVEs One by One: Eliminate up to 99.9% Before Production Break the Patch-and-Pray Cycle: Proactive CVE Management Beyond FedRAMP Checklists: Continuous CVE Elimination Why RapidFort Outperforms the Competition: The Future of Secure Containers FedRAMP Fast-Track: Near-Zero CVE Images & Zero Patching Hidden Costs of Manual CVE Elimination | Automate with RapidFort PCI DSS, SOC 2, FedRAMP & HIPAA Compliance via CVE Elimination Emerging Cyber Threats 2024: Protect Containers with RapidFort Container Supply Chain Security: From Source to Deployment Build a Robust Security Stack with RapidFort's SASM Platform Securing Containerized Environments: Best Practices Identify & Eliminate Common App Vulnerabilities in 3 Steps Near-Zero CVE Blueprint: Securing Your Software Supply Chain Eliminate up to 99.9% of Container CVEs in 3 Steps | No Code Changes Developer Security Training Do's & Don'ts Top 5 Software Security Myths Debunked AI-Generated Code Security Risks: CEO Insights Using AI in Software Development: Security Tips & Considerations RapidFort Wins Intellyx Digital Innovator Award | Runtime Security 3 Tips to Conquer CVE Alert Fatigue Mature DevSecOps Teams: Key Traits & Security Best Practices Top 3 Software Security Trends 2024: AI, Compliance & SASM Software Security Budgeting 2024: Eliminate CVEs by up to 99.9% & Measure ROI RapidFort 2023 Year in Review: Milestones & Container Security Wins OSS Vulnerability Scanning & Container Hardening RapidFort Joins Microsoft Pegasus Program | Container Security Runtime Container Protection: 90% Attack Surface Reduction Black Hat USA 2023: AI, CISO Trends & Cybersecurity Insights SOC 2 Type 2 Compliance for Container Security RapidFort Achieves SOC 2 Type 2 | Enterprise Security Validated Common Container Security Risks & How to Fix Them 6 Steps to Securing Your Software Supply Chain Harden Containers with Coverage Scripts & RBOM™ Profiling Container Vulnerability Management Best Practices Minimize Software Attack Surface | RBOM™-Powered SASM Docker Container Security Best Practices 2023 | Harden & Scan What Is Container Hardening? Reduce CVEs & Meet Compliance | Guide Securing Popular Docker Containers: Up to 80% Attack Surface Cut How RapidFort Secures Its Own Containers | Dogfooding DevSecOps Why Container Security Tools Fail: Scan vs Eliminate Hidden OSS Trade-Offs: Container Bloat, CVEs & Security Debt OSS Patch Management: Eliminate Container Bloat & CVEs OpenSSL Vulnerability: Scan, Harden & Reduce Risk in Containers Harden Hundreds of Containers Today for Free Customs Bridge Automates CVE Elimination with RapidFort SAST vs DAST vs IAST: Limitations for Container OSS Security Delete 78% of Your Redis Container - It Still Works 100% Free Tool: Copy AMIs to AWS GovCloud Fast | Open-Source Script Stop Chasing CVEs: Smarter Container Test Cycles Why CVSS Severity Alone Fails: Use Exploit Probability The Limits of Shift Left: How Software Optimization Fills the Gap Software Supply Chain Security with SCA Scanning What Is Software Supply Chain Risk? Causes & How to Mitigate It Reduce Container Bloat: Remove Unused Components & Cut CVEs What Is Software Optimization? RBOM™ vs SBOM Explained Log4j Response: Harden Containers Now Before the Next Patch
DoD Innovation: SpaceWERX, AFWERX & Defense Tech Firsthand
Russ Andersson · 2024-09-02 · via RapidFort Blog

As our team prepares to attend the AFA conference, I find myself reflecting on our partnerships with the Department of Defense (DoD). These partnerships have been invaluable, and I am deeply grateful for them. The views I share here are my own.

Innovation in the DoD: A Different Perspective

It's become somewhat fashionable to criticize the DoD for their lack of innovation. However, I have been arguing for some time that the DoD is, in fact, highly innovative. There are numerous examples to support this, such as the Nebula project, which has delivered significant value on a relatively modest budget. So, when “critiquing” the DoD, let's be measured. It's important to discuss both the problems and the solutions. As the saying goes, “A fool can ask a question that it will take a wise man a lifetime to answer.” Identifying problems is easy; finding solutions is much harder.

Constructive criticism is, of course, healthy. We all know that a well-structured problem is key to finding a solution. While there are certainly frustrations within the DoD ecosystem, it's essential to recognize that when it matters, the DoD delivers. To claim that the DoD is failing at innovation is not only unfair but also disconnected from reality. Innovation is challenging, regardless of the organization.

Understanding Innovation

Steve Blank, a Stanford University Professor,  co-founder of eight Silicon Valley startups,  and an innovation thought leader, categorizes innovation into three buckets.:

  1. Business Model Innovation: This involves finding new ways to create and capture value using existing assets or capabilities, like when Pepsi expanded from soda to snack foods.
  2. New Product Innovation: This type of innovation happens within existing units or divisions, creating new products beyond mere line extensions.
  3. Disruptive Innovation: These are groundbreaking ideas that don't fit within existing business units and often require a separate corporate function.

The Challenge of Business Model Innovation

The DoD faces structural constraints, particularly with contracting laws that make business model innovation difficult. Many DoD employees are legally restricted in their actions, often for good reasons. Instead of merely complaining, I encourage you to take action - call your congressman, vote, and participate in the process.

Where the DOD Excels 

The DoD excels in both new product innovation (category 2), and delivering advanced, highly effective technologies -Star Trek-grade technology. While they might cost more than expected, they perform exceptionally when needed. US adversaries can certainly attest to the impact of the DOD innovation. These systems are exquisitely designed and highly effective and work when it matters.

There are several disruptive innovation initiatives within the DoD, SpaceWERX, AFWERX, and the DIU, that are making significant strides. Their efforts are rapidly iterating and adding immense value. We should be mindful that these programs are essentially startups themselves, and their trajectory shows that good things are ahead. Over the next 18 months, a lot of amazing technology will mature from these ecosystems, whether or not they become widely known to the general public without security clearances.

A Firsthand Perspective

As someone who works directly with the DoD, I can attest to the high level of engagement and commitment from our DoD partners. We've collaborated with the Air Force Nuclear Weapons Center, USSF, USAF PlatformOne, and others. In every instance, the DoD has matched or exceeded the level of engagement we typically experience with our industry partners. For these professionals, it's not just a job - they are on a mission, and it shows.

The DoD is a massive organization, and naturally, there is a relationship between the size of an organization and its agility. The Department of Defense (DoD) is a major investor in technology and often collaborates with leading companies. If they’ve decided not to partner with you, it’s worth considering their feedback. It's more likely that there's an issue with your offering rather than a negative perception of your company within the DoD.

Innovation is Hard, Everywhere

Even in the venture capital world, innovation is a significant challenge. The success rate is low, and many efforts fail. The DoD is no exception to the challenges of innovation. Even if you believe the DoD is struggling with innovation, publicly disparaging our national security efforts does not serve our national interest. It can demoralize those working hard to keep us safe and may even embolden our adversaries.

Silicon Valley and National Security

In the San Francisco Bay Area, where I live, we face challenges, but there's no denying our innovative spirit. National security is a growing priority for many prominent venture capital firms, and Silicon Valley is making significant investments in this sector - even Y Combinator is looking to contribute. The skinny jeans entrepreneurs, which I said were coming two years ago, seem to be joining. Networks like Alumni Ventures, Git1K, Gaingels, and Mana Ventures are now prolific national security investors. There are also several national security non-profits organically forming to enable national security innovation, like the Spades Institute, and DEF - more such organizations will emerge and grow to fuel DOD innovation. The senior DoD stakeholders I've met are receptive to new ideas, dedicated to innovation, and actively engaged. They are consistent in their actions, and their words align with their deeds.

Unfortunately, some of the harshest criticism of the DoD comes from those who aren't innovating themselves. These "rent seekers" economically benefit from criticizing the DoD. They claim the DoD can't innovate but position themselves as the solution. As David Beckham wisely once said, "Be honest!" Thank you.

Moving Forward

Steve Blank suggests that innovation, especially in startups, is about searching for a viable business model rather than executing a known one. For large organizations, true innovation requires an "ambidextrous organization" - one that can both execute existing business models and explore new ones. The DoD is already on this path with initiatives like SpaceWERX, AFWERX, and DIU. These programs are successfully partnering with industry, and there are already several success stories, with more to come. Some of their successes are not public because of security clearance constraints.

So, before you type up the next critical LinkedIn post, consider the impact on morale. We have the best military forces in the world, and we are privileged to be defended by them. At RapidFort, we strongly discourage our employees from speaking negatively about our partners, especially when they share sensitive information with us. It’s unprofessional and disrespectful to criticize those who are working diligently to protect our security, particularly in today’s complex geopolitical landscape. Remember, careless words can have serious consequences.

If you're attending the AFA conference, I'd be happy to discuss both problems and solutions. If you have a pedigreed technology solution, but it has to be value-added, I'd be delighted to facilitate introductions. We're all working together towards a common goal. However, it's important to remember that the DoD already has access to cutting-edge technology, so the standard for innovation is exceptionally high. Mere promises won't suffice; genuine innovation is what matters. I speak from personal experience.