Connect with us

Politics

Barney changed USCIS’s cyber culture by putting the user first

Published

2 months ago

on


Shane Barney knew he had successfully changed the culture at the U.S. Citizenship and Immigration Service when it was time to debate the next year’s budget.

Barney, who left USCIS in May after serving the last almost seven years as the agency’s chief information security officer, said when the agency program offices fully funded his request for zero trust capabilities, he knew a transformation had occurred.

Shane Barney was the chief information security officer at the U.S. Citizenship and Immigration Services in the Homeland Security Department until May.

“When the zero trust executive order first hit under the previous administration, it was a huge cost to federal agencies. The day that they were discussing the funding needs that we had for zero trust, and they were significant. I mean, they were tens of millions of dollars, I couldn’t be there. I couldn’t advocate for it. I was out of the office, and I was really worried about it,” said Barney, who now is the CISO for Keeper Security, for an exit interview on Ask the CIO. “Well, the directorate heads decided ahead of time that zero trust was the most important thing for the agency to be doing. They had all allocated all the money I had asked for without me even being present or even defending it. That’s when I knew we had done something right.”

Barney called his boss, then USCIS chief information officer Bill McElhaney, and asked what happened at the meeting.

“He said, ‘You got all the money.’ And I was like, ‘What do you mean? I got all the money?’ We weren’t even there. He goes, ‘No, it was actually decided before the meeting even started. In fact, it was never even discussed. It was assumed,’” he said. “That told me everything I needed to know about where the culture of the agency was. They valued security so much that they understand the connection between what the business is trying to accomplish, and the importance of securing that at the same time, and it sold itself. I think part of me actually knew at that point that maybe my time at USCIS was probably coming to an end.”

Barney said he believes the program offices understood the value of security because USCIS was both an early adopter of zero trust concepts and because the agency survived a potentially catastrophic cyber incident.

A cyber incident wake-up

In 2015, a USCIS developer turned on one of its Amazon Web Services storage buckets in the cloud and made the data inside the bucket public instead of private. Barney said this mistake can be a common issue among security incidents, but in USCIS’s case, it meant potentially exposing 500 million to 600 million records.

“We just had to prove that yes, it was made public, but no one accessed it during the time that it was public. That was difficult because we actually hadn’t really turned on the logging necessary for us to do that. So lesson one was to get better about logging then. Then we started looking at it in detail, and I’ll never forget it, it’s 2:30 in the morning and I get a phone call from one of my security analysts and he goes, ‘Shane, listen, we didn’t really look at this as careful as we should have and yes, they made the bucket public, but they never changed the record settings themselves.’ So yes, you could go to the public record, and look at it, but the records themselves were still marked private, so you couldn’t see them. You couldn’t even know they were there,” he said. “We were actually secure without realizing we were secure. So it was a really important lesson for us in as we were pushing into the cloud.”

In the after-action report, Barney said USCIS realized how this potential incident happened and started applying automation to make sure it wouldn’t happen again.

“We just started developing in Python, and basically it was a simple script that scanned our enterprise at lightning speeds. If it found we had 20 public records, we had 20 buckets that were supposed to be public. If it wasn’t listed as one of those, it would automatically shut it off,” he said. “It was the first sort of a-ha moment for security automation for us. It dawned on us that the power of the cloud was automation. If your infrastructure is code, then your security is code too, and I literally changed the contract for my security operations center (SOC) made them all go out and become programmers, and we started building automation. We would automate it to the point where, yeah, we got an alert that something happened, but it’s already been taken care of and  we  moved on because if we know that something is a risk, and in this case making data public, I can automate against that risk, then I have an obligation to do that. If I do that, that means that my analysts and my SOC no longer have to watch for that, and they can move on to something else, and that became our driving force.”

Around the same time, USCIS was moving systems and applications into the cloud and Barney said the use of zero trust principles just made sense, including single sign-on as the foundation of identity management for the cloud services.

“You have to carefully align what you do as a cybersecurity program to what the end user goals are because if you create an environment that’s so restrictive and so difficult for them to do their jobs, they’re going to find workarounds, and those workarounds are going to introduce risk that you’re not even aware of, and it creates problems,” he said. “You’re better aligning those two, and even if you have to meet in the middle somewhere and give a little bit of a compromise on the security side, so you can meet the end users’ goals, that’s okay. That actually is going to get you further and give you more benefit back into the organization than you would have if you just forced your heavy handed security approach.”

Next challenge: Network segmentation

As for USCIS’s zero trust progress, Barney said the biggest remaining challenges remain around securing the network and the data.

The goal, he said, is to get the network under control through proper segmentation and proper transactional monitoring and controls.

“It is very, very, very, very difficult to do, and even more difficult, and if not bordering on impossible, but coming darn close is getting your data under control,” he said. “Now at USCIS we’re not unique with the data the hallmark of what they did, the organization that handles all the administrative side of immigration, on any given day, they’re interacting with 16 million or 17 million people around the world, and all their information was electronic at that point. All that information had to be correlated and brought under sort of an umbrella of zero trust, and in the zero trust world, and that means you’ve got to create meta tags around everything that you’re doing, and then those meta tags have to be correlated with sort of a central dictionary. That dictionary has to be maintained and updated, and if you make changes, those changes have to be able to ripple across your entire data verse and that’s very, very, very difficult stuff to do. So when we put forth our budget, the vast majority of the money that we were asking for at the time was to fix the networking piece and to fix the data piece.”

Barney said while USCIS still has a ways to go to meet all the requirements of zero trust, he’s leaving the agency in a good place.

One of the things he did before he left was changing the USCIS’s focus from managing risk to being intelligent about risk.

“Not all risks are created equal, and you need to understand when something is far more important for you to focus on, even if it’s not a higher or critical but it’s a bigger threat to your organization. That’s being intelligent about risk, and that’s the one thing we were just starting to try to drive forward,” Barney said. “It’s very, very difficult to do because it’s a data intensive activity. You need good cyber threat intelligence to make sure that you’re making good decisions corporately. Something we started doing, and we’re doing better at, was more of a threat hunt based culture. Part of our drive for automation was to get rid of the screen people watch for something to go red and alert then, and driving more of an automated approach to not just the alerting and monitoring piece, but also the entire incident response process.”

The post Barney changed USCIS’s cyber culture by putting the user first first appeared on Federal News Network.

Related Topics:
Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Politics

President Trump Taps Dr. Ben Carson for New Role — A HUGE Win for America First Agenda

Published

3 hours ago

on

September 25, 2025

By

Dr. Ben Carson is the newest member of the Trump administration.

On Wednesday, former Secretary of the Department of Housing and Urban Development, Ben Carson, was sworn in as the national adviser for nutrition, health, and housing at the U.S. Department of Agriculture.

Agriculture Secretary Brooke Rollins shared that Carson’s role will be to oversee Trump’s new Big Beautiful Bill law, which aims to ensure Americans’ quality of life, from nutrition to stable housing.

After being sworn in, Carson shared, “Today, too many Americans are suffering from the effects of poor nutrition. Through common-sense policymaking, we have an opportunity to give our most vulnerable families the tools they need to flourish.”

Table of Contents

WATCH:

Per USDA:

Today, U.S. Secretary of Agriculture Brooke L. Rollins announced that Dr. Benjamin S. Carson, Sr., M.D., was sworn in as the National Advisor for Nutrition, Health, and Housing at the U.S. Department of Agriculture (USDA).

“There is no one more qualified than Dr. Carson to advise on policies that improve Americans’ everyday quality of life, from nutrition to healthcare quality to ensuring families have access to safe and stable housing,” said Secretary Rollins.

“With six in ten Americans living with at least one chronic disease, and rural communities facing unique challenges with respect to adequate housing, Dr. Carson’s insight and experience is critical. Dr. Carson will be crucial to implementing the rural health investment provisions of the One Big Beautiful Bill and advise on America First polices related to nutrition, health, and housing.

“As the U.S. Secretary of Housing and Urban Development in the first Trump Administration, Dr. Carson worked to expand opportunity and strengthen communities, and we are honored to welcome him to the second Trump Administration to help lead our efforts here at USDA to Make America Healthy Again and ensure rural America continues to prosper.”

“Today, too many Americans are suffering from the effects of poor nutrition. Through common-sense policymaking, we have an opportunity to give our most vulnerable families the tools they need to flourish,” said Dr. Ben Carson. “I am honored to work with Secretary Rollins on these important initiatives to help fulfill President Trump’s vision for a healthier, stronger America.”

On Sunday, Dr. Carson was one of the many speakers at the memorial service of the late TPUSA founder Charlie Kirk.

During the memorial service, Carson highlighted that Kirk was shot at 12:24 p.m. and then continued to share the Bible verse John 12:24, which reads, “Verily, verily, I say unto you, Except a corn of wheat fall into the ground and die, it abideth alone: but if it die, it bringeth forth much fruit.”

WATCH:

The post President Trump Taps Dr. Ben Carson for New Role — A HUGE Win for America First Agenda appeared first on The Gateway Pundit.

Continue Reading

Politics

LEAKED MEMO: Deep State Prosecutors in the Eastern District of Virginia Claim There Isn’t Enough Evidence to Convict Comey Amid Reports of Imminent Indictment

Published

3 hours ago

on

September 25, 2025

By

On Wednesday evening, disgruntled officials in the Eastern District of Virginia leaked contents of a memo explaining why charges should not be brought against James Comey.

As reported earlier, former FBI Director James Comey is expected to be indicted in the Eastern District of Virginia in the next few days.

Comey will reportedly be charged for lying to Congress in a 2020 testimony about whether he authorized leaks to the media.

Officials in the Eastern District of Virginia are still fighting to stop Comey from being charged after Trump fired US Attorney Erik Siebert.

President Trump last week fired Erik Siebert as the US Attorney for the Eastern District of Virginia because he refused to bring charges against Letitia James, Comey, Schiff and others.

On Saturday evening, President Trump announced that he had appointed Lindsey Halligan – his personal attorney who defended him against the Mar-a-Lago raid – as US Attorney for the Eastern District of Virginia.

Now, with just days to go before the statute of limitations runs out to charge Comey for lying during a September 30, 2020 testimony, Lindsey Halligan is reportedly gearing up to indict Comey.

Prosecutors reportedly gave newly sworn-in Halligan a memo defending James Comey and explaining why charges should not brought against the fired FBI Director.

Per MSNBC’s Ken Dilanian:

Two sources familiar with the matter tell me prosecutors in the EDVA US attorney‘s office presented newly sworn US attorney Lindsey Halligan with a memo explaining why charges should not be brought against James Comey, because there isn’t enough evidence to establish probable cause a crime was committed, let alone enough to convince a jury to convict him.

Justice Department guidelines say a case should not be brought unless prosecutors believe it’s more likely than not that they can win a conviction beyond a reasonable doubt.

The post LEAKED MEMO: Deep State Prosecutors in the Eastern District of Virginia Claim There Isn’t Enough Evidence to Convict Comey Amid Reports of Imminent Indictment appeared first on The Gateway Pundit.

Continue Reading

Politics

Nearly 8 in 10 Voters Say the United States is in Political Crisis After the Assassination of Charlie Kirk

Published

4 hours ago

on

September 25, 2025

By

Nearly eight in ten voters believe that the United States is in a political crisis in the wake of the assassination of conservative icon Charlie Kirk.

According to a Quinnipiac University national poll of registered voters released on Wednesday, a massive 93 percent of Democrats, 84 percent of independents, and 60 percent of Republicans said the nation is in a political crisis.

“The Kirk assassination lays bare raw, bipartisan concerns about where the country is headed,” Quinnipiac University Polling Analyst Tim Malloy said of the poll results.

Quinnipiac reports:

Seventy-one percent of voters think politically motivated violence in the United States today is a very serious problem, 22 percent think it is a somewhat serious problem, 3 percent think it is a not so serious problem, and 1 percent think it is not a problem at all.

This is a jump from Quinnipiac University’s June 26 poll when 54 percent thought politically motivated violence in the United States today was a very serious problem, 37 percent thought it was a somewhat serious problem, 6 percent thought it was a not so serious problem, and 2 percent thought it was not a problem at all.

Nearly 6 in 10 voters (58 percent) think it will not be possible to lower the temperature on political rhetoric and speech in the United States, while 34 percent think it will be possible.

Over half, 54 percent, of voters believe the US will see increased political violence over the next few years. Another 27 percent said they think it will stay “about the same,” while just 14 percent believe it will ease.

A 53 percent majority also said they are “pessimistic about freedom of speech being protected in the United States.”

Surprisingly, a 53 percent majority also believes the current system of democracy is not working.

“From a perceived assault on freedom of speech to the fragility of the democracy, a shudder of concern and pessimism rattles a broad swath of the electorate. Nearly 80 percent of registered voters feel they are witnessing a political crisis, seven in ten say political violence is a very serious problem, and a majority say this discord won’t go away anytime soon,” Malloy added.

The vast majority, 82 percent, said the way that people discuss politics is contributing to the violence.

“When asked if political discourse is contributing to violence, a rare meeting of the minds…Republicans, Democrats, and independents in equal numbers say yes, it is,” Malloy said.

The survey was conducted from September 18 to 21 among 1,276 registered voters with a margin of error of +/- 3.3 percentage points.

The post Nearly 8 in 10 Voters Say the United States is in Political Crisis After the Assassination of Charlie Kirk appeared first on The Gateway Pundit.

Continue Reading

Trending