GovLab: Gitlab in the Federal Government

Every day, the federal government tackles some of the most difficult challenges that we face as a society. From defending the country itself to ensuring law enforcement’s ability to protect citizens. Inevitably, at the core of all of these challenges, is code.

In this talk, Solomon will take a brief look into how the federal government tackles these challenges on a daily basis including how it’s evolving: how it contributes to and develops open-source, how it utilizes Innersource within and across individual agencies, and of course, how Gitlab sits at the middle of all of this.

Transcript

1. GovLab Gitlab in the Federal Government #GitLabCommit @Serubin_
2. 2 #GitLabCommit Whoami – Solomon Rubin • Software & Security Engineer • Long Time Federally Funded Research and Development Center Employee ◦ MITRE ◦ MIT Lincoln Laboratory • Work in the Government Open Source Arena ◦ Cyber Defense ◦ Military ◦ Aerospace On the Web • @serubin_ • https://serub.in #GitLabCommit @Serubin_
3. 3 #GitLabCommit Overview • How the Government uses code • How Open Source fits into USG • Where Open Source occurs • How Open Source is facilitated • How GitLab plays a unique role • How GitLab facilitates cultural change #GitLabCommit @Serubin_
4. 4 #GitLabCommit How the Government Uses Code • Code is everywhere • Technology is ubiquitous in all industries – Government is no exception • All industries are ultimately technology industries first #GitLabCommit @Serubin_
5. 5 #GitLabCommit What kind of code does the Government use? • Data science • Cyber security and digital forensics • Full stack & web engineering • Much more #GitLabCommit @Serubin_
6. 6 #GitLabCommit What kind of code does the Government use? • Data science • Cyber security and digital forensics • Full stack & web engineering • Much more #GitLabCommit @Serubin_
7. 7 #GitLabCommit What kind of code does the Government use? • Data science • Cyber security and digital forensics • Full stack & web engineering • Much more #GitLabCommit @Serubin_ secugenius.com
8. 8 #GitLabCommit What kind of code does the Government use? • Data science • Cyber security and digital forensics • Full stack & web engineering • Much more #GitLabCommit @Serubin_
9. 9 #GitLabCommit What kind of code does the Government use? • Data science • Cyber security and digital forensics • Full stack & web engineering • Much more #GitLabCommit @Serubin_
10. 10 #GitLabCommit The Government is Invested in Open Source @Serubin_
11. 11 #GitLabCommit High Engagement - With Large Challenges • Politically charged environment • External actors push against OS • Internal actors push against OS • Extreme sensitivities exist within the work #GitLabCommit @Serubin_
12. 12 #GitLabCommit External Actors Push against Open Source? Claimed • USG should not emulate fast paced innovation of Silicon Valley. • In-house government IT is not necessary Suggested • Security in Open Source is not good enough for government • Code maintained by a community is not safe • In conclusion, buy Oracle software @Serubin_ • In 2017 an Oracle Executive (SVP) commented on a GSA modernization repo with a scathing review of OS
13. 13 #GitLabCommit Internal Actors? Using • Distrust in “unknown” communities • Internal code verification • Negative opinions from agencies Contributing • Internal sensitivities make developing OS extremely hard • Sensitive Information • Intense code review and legal process @Serubin_
14. 14 #GitLabCommit Story - OSCON 2016 NSA Cryptologist @Serubin_
15. 15 #GitLabCommit Where in US Government is Open Source Occurring? @Serubin_
16. 16 #GitLabCommit A Changing Environment • 5 years ago – policies and the environment did not allow for easy open source usage or contribution • Today – Several Open Source “centers” exist with USG • All Agencies and Organizations use Open Source in some way #GitLabCommit @Serubin_
17. 17 #GitLabCommit Where are the Open Source centers in USG? @Serubin_
18. 18 #GitLabCommit What about agencies? • Agency for International Development • Consumer Financial Protection Bureau • Department of Agriculture • Department of Commerce • Department of Defense • Department of Education • Department of Energy (1600) • Department of Health and Human Services • Department of Homeland Security • Department of Housing and Urban Development • Department of Justice • Department of Labor • Department of the Treasury • Department of Transportation • Department of Veterans Affairs • Environmental Protection Agency • Executive Office of the President • Federal Election Commission • General Services Administration (2000) • National Aeronautics and Space Administration (1200) • National Archives and Records Administration • National Science Foundation • National Security Agency • Office of Personnel Management • Small Business Administration • Social Security Administration @Serubin_
19. 19 #GitLabCommit Code.Gov • USG’s platform for sharing America’s open source software • Provides a list of existing projects • Provides Agency Compliance ◦ Consistency with the Federal Source Code Policy. ◦ Amount of custom software open sourced (~20%) ◦ Amount of custom software inventoried (~50%) code.gov @Serubin_
20. 20 #GitLabCommit What does USG Open Source Look Like? • Open Source – USG’s Contributions ◦ Common Vulnerabilities and Exposures ◦ STIX & TAXII ◦ Ghidra ◦ SHA ◦ Simon/Speck ◦ Code.gov • Inner Source – USG Works Together ◦ Licenses for government wide reuse ◦ Reuse within agencies is common ◦ Inter-agency code sharing is frequently #GitLabCommit @Serubin_
21. 21 #GitLabCommit How is Open Source Facilitated in USG?
22. 22 #GitLabCommit USG’s Tools for Code Sharing #GitLabCommit @Serubin_ Sharing a keyboard Sharing a flash drive Sending files via email Github Bitbucket GitLab
23. 23 #GitLabCommit What makes USG’s Needs different? Special Sensitivities Rigorous Hosting Regulation Precautions for Classifications @Serubin_
24. 24 #GitLabCommit Who uses GitLab? Publicly disclosed users @Serubin_
25. 25 #GitLabCommit Where GitLab comes in strong • Comprehensive toolchain • Security compliance • Deployment flexibility #GitLabCommit @Serubin_
26. 26 #GitLabCommit GitLab provides security • Flexible deployments allow for higher security • FIPS compliance • Common Access Card authentication • Support for One-Way-Transfers #GitLabCommit @Serubin_
27. 27 #GitLabCommit Additional Complications • Historically USG has not been agile • Building agile workflows into a non-agile organization is a difficult challenge • Tooling for agile adds additional complication ◦ Jira, Bitbucket, Jenkins, Artifactory, New Relic • GitLab is able to provide the same functionality in one place gitlab.com @Serubin_
28. 28 #GitLabCommit GitLab Helps to Produce Cultural Change • Providing unified tooling easier • Not one-size-fits-all • Flexible Workflows • Provides enterprise-scale development platforms or one-off simple collaboration environments #GitLabCommit @Serubin_
29. 29 #GitLabCommit Commitment to Government • Increased Federal team to more than 200 • Developing Government specific features • C-Suite Level Support for Federal Workforce @Serubin_
30. 30 #GitLabCommit Continued Commitment to Open Source • Educate on value • Educate on availability • Educate on safety • Support USG open source initiatives @Serubin_
31. 31 #GitLabCommit serub.in/gitlab-commit-2019 Slides and Additional Information @Serubin_ Approved for Public Release; Distribution Unlimited. Public Release Case Number 19-2733 The author's affiliation with The MITRE Corporation is provided for identification purposes only, and is not intended to convey or imply MITRE's concurrence with, or support for, the positions, opinions, or viewpoints expressed by the author. ©2019 The MITRE Corporation. ALL RIGHTS RESERVED