• CHEVY CHASE, MD.

Michelyn LeBlanc, the deputy chief information officer for the Defense Commissary Agency (DeCA), recently spoke with the Federal News Network (FNN) podcaster Jason Miller on the “Ask the CIO” show about a variety of topics, including cyber security and how it interweaves with the online and brick-and-mortar environment.

FNN: What is the Defense Commissary Agency, what is your mission, and what are your goals?

Michelyn LeBlanc: The Defense Commissary Agency operates a chain of really retail grocery stores that provide services as a benefit to our Department of Defense service members, their families, retirees and eligible veterans and their beneficiaries.

We bring grocery services, familiar names and brands, to the soldiers and service members stateside and those serving around the world.

It is an important piece of home and a crucial part of their compensation benefit.

FNN: Cyber security is a key piece to any organization’s lifeline as you have to keep your data and your systems secure. Talk about your strategy and security technology across your environment.

ML: We employ a zero-trust strategy. That really is a multi-faceted approach in securing our enterprise and aligning with those principles incorporates multiple vendors, technologies and solutions providers to accomplish those activities required across the board, including zero trust.

Our routine principles as we go through those exercises in implementing those zero-trust principles is to ensure secure communication across the agency in all operation levels and to ensure that those zero-trust technologies are providing improved system performance, and to ensure that those zero-trust technologies remain operable across our DoD, commercial retail and eCommerce partners, which is fundamental to our mission.

FNN: There are so many pieces and parts to zero trust. You have commissaries in dozens of countries; is that the big challenge that you face, that being that we have to make sure that people can communicate, but we can’t make it so hard that communication gets shut down and they can’t get the data that they need?

ML: Absolutely. Across the retail landscape, as with businesses universally, data is critical, and certainly, we know that with our retail suppliers and distributors, it is fundamental to our capability to keep shelves stocked, which means getting healthy, affordable food in the hands of soldiers and authorized patrons that need it.

That is a core fundamental component of not only our zero-trust implementation, but within the operations of the commissary where we use our connections with our vendors to stock shelves, but people trying to use the payment card industry technologies … if they aren’t able to make those communications, that is a problem.

FNN: It is not only a problem, they have to feel secure in doing it. If they feel that your infrastructure can’t handle it, there is a chance of getting hacked.

We hear a lot from DoD about the tactical edge. Do you see the same challenges in ensuring communications … the bandwith in different countries is different than in others, the infrastructure is also different, adding another layer of complexity?

ML: Absolutely. With global retail operations, we have a number of regional hurdles to overcome.

We do have a great working relationship with other retail partners, in the department and in the exchanges, so in many instances, our commissary locations are co-located or in close proximity of these exchange partners, so we are able to collaborate together to overcome some of those hurdles.

FNN: That is a huge benefit to be able to lean into others in DoD, and you can trust them because they are on the same team, so to speak.

ML: Absolutely. There was actually an initiative at Congressional levels to encourage that collaboration across the exchanges and commissaries, called the Joint Synergies Effort, and so we do make maximum use of that partnership and we have a really great working relationship with the exchanges over the past couple of years.

FNN: Do you have meetings with other CIOs related to cybersecurity and what challenges all of you face?

ML: Without a doubt. And it is not only the exchanges, but we also work with partners in the MWR, the larger sort of ecosystem in providing services and support to troops … again, there are synergies that you might now think about on the surface, not just between the commissaries and exchanges, but the teams running the libraries … we are all similarly positioned.

We have unique missions within the department, and we work with vendors who are not typically DoD partners, so we have a common approach, or we collaborate to work with those vendors, to initiate some of the nuances in doing business with us, not only in cyberspace but also in the IT space of the department.

FNN: It is always important to recognize that you are not by yourself, you are not on an island … it takes a village, and with IT, it certainly does.

One of the things about cybersecurity that we hear time and time again is that we don’t want to make cyber so hard that the user gets frustrated, yet you can’t make it so easy that the attacker finds it easy to go in.

There is always a balance. How do you measure that performance, look at zero trust and group performance and how do you strike that balance?

ML: For DeCA, with our retail mission being paramount and our responsibility to our patrons to make sure that we adequately protect their data, that singular focus on executing the mission while maintaining the safety and security of our environment and our solution is not only so we can keep doing business and providing the benefit, but also so we are doing it in such a way that we are protecting department and patron data is of utmost importance.

This is not only related to the mission execution perspective but also from an optics perspective. It is a struggle for Target or any retailer to handle a confidence loss in the security solutions.

FNN: Sometimes folks in the non-retail world forget about that.

If you work in the Army or Navy and you have a cyber incident, confidence loss is there, but you have no place to go. If somebody wants to go to the commissary, and there is no confidence, there are probably other grocery stores they can go to, but you are not looking at profit and loss in the same way, but still, people feel that they are not being served the way that they should.

ML: Absolutely. And that confidence loss, and the perspective of our patrons, is always paramount.

And because of our unique mission and our positioning within the Department of Defense, as a defense agency, we are still required as an agency that receives appropriated funding, to follow all of the cybersecurity requirements as the services in the other federal agencies.

What I will tell you at least from my experience within partnerships across the retail landscape, the Department of Defense has a strong foundation in cybersecurity.

So for our patrons, I would hope that that instills a strong sense of confidence, as not only are we ensuring to retail grocery standards, but we are also ensuring to the standard of the department.

FNN: Have you taken specific steps, or have you installed some government user experience efforts related to how we apply zero trust or capability under user trust and make sure that the users are not impacted in a way that they get frustrated or stop using it?

ML: More and more in today’s retail landscape, the user experience is shaped by technology. We really don’t think about our trip to the grocery store as far as the technology experience.

But if we compare and contrast the experience of today with the experience of 20 years ago when we were using those sticker label guns, it really is a vastly different place.

Not only are those technology enablers paramount to our ability to execute our mission, which is always, of course, top of mind, it is also paramount to customer experience.

When you walk into a grocery store, and how many self-checkout lines are closed, and there is only one line open with a line that reaches to the back of the store, that type of customer experience is a lasting one, and not necessarily in a good way.

All zero-trust implementation is with the intent that it does not impact our ability or our mission and does not impact the customer.

FNN: How are you ensuring that you are meeting the requirements and pillars of the class of requirements that you need laid out and without busting the budget?

ML: That budget point is a key one. It is not only for DeCA, but across the department, it is a universal struggle to make sure that we are implementing the elements of zero trust but within the constraints of what is a fiscally constrained environment.

To that end, our approach really centers around maximizing the use of existing technology and infrastructure with discreet and targeted investments as necessary to meet those pillars of zero trust.

In addition, we are relying on the security offerings from the service operations from DoD and commercial cloud service providers, as a key portion of that overall zero-trust picture.

FNN: What can we use today to apply to that zero-trust and to meet its goals? The tool you bought for X,Y and Z can also be used for A, B and C. Are you finding that the tools had more capabilities than you understood, realized or taken advantage of?

ML: Yes. Part of the market research is that we look at capabilities to implement and realize this; it is really an introspection of a complete set of capabilities we have with the resources already in our portfolio, so it is absolutely part of the exercises as we worked on this app .

FNN: Have you taken the time to do the gap analysis? Give me a sense of what that process looks like, what you have today and what the gaps are.

ML: I think it is part of the establishment of that type that lets you roadmap which is originally intended to meet certain goals and those zero-trust principles and where those technologies align.

I don’t think anyone across the department has money to waste time on redundant solutions, so that is critical.

It necessitates an alignment of our direction from our retail grocery mission as well as implementation and execution of those security requirements.

FNN: Do you find that your gap analysis that because it is retail, it is a different type of gap … we need somebody at the Pentagon working or working on a ship, it is a different environment?

ML: To a degree, there is the uniqueness of DeCA, but for the most part, our zero-trust implementation is designed to align with the intent of the zero-trust objective.

We had a hurdle … we just had a problem that we couldn’t overcome. But right now, we have not identified any of those challenges that couldn’t be worked out one way or the other.

FNN: Interoperability is another big piece. If technologies can’t work together, they can’t share data, they can’t access data, to a common platform, that becomes straining and more complex.

How is that important and how are you addressing it?

ML: Ensuring that not only our technical solution and our architecture is configured in such a way that allows us that dialogue across a variety of areas, our stakeholders and our distribution partners to vendors to our eCommerce partners really is always top of mind.

Whatever our implementation is, we know that we can’t interrupt that interoperability. If we are offline with our vendors for 24 hours, that is 24 hours that stores across the world can’t reorder supplies to stock the shelves.

That may seem like a blip, it has significant and serious impacts in the stores and on the shelves, and I don’t want to create that customer experience, so we are desperate to really encourage folks that the commissary today is not the commissary it was five, 10, 15 years ago, and we understand that bare shelves don’t help us in that regard.

FNN: Is the interoperability with your partners add a layer of complexity … if you are offline with an order because the partner had a cyber attack, or the supplier had some sort of malfunction, does that also create complexity around zero-trust that maybe others don’t have?

ML: Yes, it is hard for me to speak across the department, but the uniqueness of our mission that perhaps those in the totality of the retail sphere that we deal with don’t have the privilege of experiencing this part of the zero trust as a DoD organization, or don’t view or handle such risk in the same way.

To them, it is a business risk, which can be mitigated in some instances, using other control measures.

We have been lucky in that none of the ripples of the impacts in those commercial partners have had ripple effects across our environment.

So certainly it is on our radar. We can control what is in the boundary of our environment and make sure to protect those touch points with which today, we have had good experiences.

FNN: You mentioned that things are different in the stores than they were years ago.

I would imagine things are also different with end points, and the security of those end points.

How are you starting to look at the security of those end points, and how does that fall into the zero-trust discussion?

ML: We live in a digital age, and as such, data is part of our most valuable assets.

The retail organization takes very seriously related to the responsibility we have about our patron data. Unlike traditional retailers, we also have the obligation to protect DoD data.

To meet both of these goals, we have coordinated a collection of solutions and services to monitor, detect and protect the data that we are entrusted with.

Our coordination is an enduring effort which allows us the constant feedback to make adjustments to that end point security posture to the maximum extent possible.

The capability is provided by DoD, including security solutions. We also have solutions for monitoring cybersecurity and malware.

So those are just a few of the ways those end points that exist are monitored.

FNN: The end point detection and response tool … you have operational technology, you have the things that are not traditional … does that cause you any more challenges that it would cause in a more traditional IT environment?

ML: From DeCA’s perspective, we look at that, operational technology from the same lens. We look at our information technology, the end point is the end point and it needs to be protected as such, and that is sort of how we treat both the IT and the OT environments.

FNN: Do you find that when it comes to operational technology, there are some requirements and challenges there … we want to treat it the same, but they are not built the same?

ML: Definitely I think within the landscape of our OT, we’ve got some differences. We have a lot of systems that are old. I sort of classify them differently than our more frontline retail technology.

Regarding that aging or legacy operational technology, it is more of a challenge, and we are really focused on bringing OT more directly into the fold.

Once upon a time, we thought of trucks as just trucks, refrigerators were just refrigerators, Now, my dishwasher needs a WiFi connection.

All of these systems, whether it is organic or they were retrofitted, has some type of monitoring or reporting system.

Many of those OT systems have their own unique limitations, whether they are processing power, that make it really challenging to manage them the same way we do other points, and that is where we really employ a strategy that doesn’t rely on a singular layer, but multiple layers to make sure that everything in that network is protected.

FNN: Another key piece of all of this is automation. Talk a little about how you use automation for security improvements.

ML: All aspects of DeCA’s business, and certainly from a universal perspective across all the systems, automation represents much in our security practice.

Once upon a time, asset management was walking around with pieces of paper and forms and carrying them from desk to desk, a more labor-intensive process.

In configuration management, we use tools to automate the management tracking of our infrastructure, vulnerability management we have a system to help us assess and gauge visibility into the infrastructure, which is a significant reduction in manual labor and that goes into identifying and collecting and the preauthorization of those remediation efforts

I think it would be safe to say that it would be difficult to realize the vision of zero trust without automation and how it works.

FNN: Let’s go back to vulnerability management. Have you measured how we can reduce that by 10 percent, by 20 percent, or can you put a dollar figure on it?

ML: We haven’t. This is one of the things that we have to do. It is an efficiency, so we are moving forward to be aligned with those DoD directives.

FNN: Do you have the view that because we were able to reduce the manual labor, we are able to close the manual threats quicker?

ML: Sometimes, where our position as the retail group of the Department of Defense doesn’t play in our benefit because among the defense communities, there is the certain perception that no one is going to lose their lives at the commissary.

It is a constant conversation in the Department about customer confidence, the protection of patron data is something that DeCA holds in the highest regard.

There is a certain sense of assurance that we are CIOs, and those in the technology community that we do have such good counseling and requirements that we are following from the Department.

It really does put us head and shoulders above our competition, and certainly in the retail grocery space.

When I was a kid, playing sports, my coach used to always tell me that you get better by playing with people that are better than you.

As the retail player in the DoD space, we play with some of the best in the world, so that makes us better as well.

FNN: Automation and orchestration helps you because it is always difficult when it comes to cyber. You are probably no different, because you are all over the world.

Is that also helping to relieve some of the pressure that is on you, on the staff and on cybersecurity?

ML: Without a doubt. We wouldn’t be able to manage the requirements from the cybersecurity perspective without using these automated tools.

As part of the DoD organization, we are part of the same rules about organizational size, and it is hard for us to plus-up positions as I would imagine as it is in agencies in other departments.

So the justification is we are doing so much more from the technology perspective, the cybersecurity perspective, and it might resonate differently in the commercial world than it does here.

I am sure that this is not unique to DeCA. We are in a constant state of do more with no more, so those automated enablers are paramount to our ability to execute.

FNN: Given the fact that there is a balance between the user experience and the importance about protecting data systems, are you using some sort of dashboard, some sort of way that you can look at your cyber data in a way to understand and do an analysis on it?

Is there a place you would like to go when it comes to cyber data?

ML: Not only in our IT and cybersecurity community in DeCA, but organizationally, we are trying to increase our overall data maturity, not only our ability to analyze and visualize the data we have, but it is sort of increasing our data literacy organizationally.

We are a data-rich organization. That data really is the fuel that drives our pillars. It is worthy of significant investments and what we, as DeCA, are moving toward is really a wholesale approach to increasing data maturity across the organization so that not only can we make better use of the assets that we have, but we can begin to identify where we have data gaps.

We really could benefit significantly from minting those data sources and then moving that data in a more seamless and real-time fashion to make decisions.

For a long time, the retail grocery world lived and died by certain fact processing, and to a degree, we are not going to get out of that anytime soon, but certainly coming out of the COVID-19 pandemic with the supply chain snarls that had everyone feeling the pain, the ability to understand what we had and what resources we had to get supplies and products to the stores that needed it was fundamental.

We acknowledge as an enterprise that this is a viable endeavor, and we really are taking steps, not only the business side but on the IT and security side as well, to do more with the data that we have.

FNN: Is there a plan to increase that data and the understanding of data?

ML: Right now, the center is heavily on the totality of data maturity an important part of which is data literacy across the organization, understanding our data sets … how does that data flow through our solutions and analytics tools.

And in that sort of progressive evolution, as we have a better understanding across the enterprise of the data environment and how to better utilize it, we are also becoming more aware of where we have those data gaps, not only in key components of information, but we need increased analytics to make informed decisions.

Those are the key considerations from our data maturity perspective today.

FNN: Cybersecurity … what is our risk, how does that increase our risk, do we have vulnerability, where do we fit with all the pieces and parts … a key piece to that analytics effort is the cybersecurity side too.

ML: Absolutely. So unlike traditional retail, our patrons are service members, or at least many of them. It is not just patron data, it is service member data.

There area always privacy considerations when dealing with any data, and we work very closely with the Chief Digital Artificial Intelligence Office and various entities to make sure that we address, those privacy considerations.

There are also considerations from a business perspective as well.

That retail data, in grocery circles, is gold, it’s water in today’s market. So working across the CDAO and others to understand is important.

With the advent of the CDAO, all data is DoD data. We want to make sure that as we walk this path, to being more effective and efficient with our retail partners, we are doing so with our retail partners’ considerations in mind.

FNN: The evolution of your strategy … how have you and your team look at cybersecurity today differently than you did in the past?

ML: DeCA, as a whole, our cybersecurity strategy has evolved at a keen pace with the changes in the cyber landscape.

Also, we have kept pace with the changing retail landscape. Most recently, in that resale landscape, there have been rapid shifts to eCommerce .

Our switch at DeCA was an effort that really accelerated during the height of the COVID-19 pandemic. The integration of our online shopping capability, which we call Commissary CLICK2GO is actually available at all commissaries globally with our traditional brick-and-mortar shopping experience.

It requires assured and consistent security across all aspects of the retailing environment. It refers to that mix between online and in-store shopping experiences.

I think in today’s technology, our patrons are really tuned in to the security considerations for shopping online. The brick-and-mortar grocery store environment is really tech heavy, point of sale, checkout, price checkers, electronic shelf labels … the grocery industry is not the same as it once was.

FNN: We have heard a lot about the integration of eCommerce. Does that cause you, from a CIO perspective, any extra heartburn than anything else did, and has it caused you to rethink how you budget, how you look for technology?

What is the big change from your thinking?

ML: Less a change from our thinking but more about the uniquenesses of our DeCA DoD retail grocery mission … our eCommerce platform is a broad-based solution, as such, navigating with our vendor partners in that process.

It took a lot of finessing. Working together collaboratively, to get there from here.

That is really the standout for the implementation of the eCommerce capability, but again, that partnership with the vendors as well as the clear guidance from certain entities and the partnership in the DoD cyber community was really pivotal in our implementation of this environment.

FNN: Hiring and training, and getting the folks in place…Tell us about the workforce challenges that you are facing from a DeCA perspective, and what are you doing about it?

ML: DeCA is not unique in the department. Attracting and retaining qualified IT and cybersecurity talent is a challenge.

Our HR Directorate has been a phenomenal partner. They provide access to cybersecurity training and certification materials and resources.

They have also been really good partners helping us providing guidance to how to best utilize those hiring authorities to obtain highly qualified cybersecurity personnel.

We are also trying to maximize use of developmental program that give entry-level cybersecurity candidates a clear path to succession and advancement within the organization, which helps not only with recruitment, but with retention.

Those are the pillars of our approach for the cybersecurity workforce, but it is a challenge.

FNN: Do you find that finding these workers, because you are all over the world, does that add more complexity, or challenges, or is it just that you have to lean into technology in a new way, and don’t have enough workers for every commissary to have somebody on staff and on site to make sure things are safe?

ML: To a certain degree, it is a challenge, and it is something that we’re continuing to learn and to work through.

Within our organization, we recently, as DoD organizations do, had a reorganization, and in the course of that reorganization, one of the things that were very clear, and one of the driving factors, was the need for realized people that are available in the place where the customer is, where we support not only our patrons, our DeCA customers, but also the Store Operations personnel, the marketing personnel.

We are aligning so that we have adequate, or improved direct support to those customers.

And it is not only challenging, but it is an opportunity. It is an exciting opportunity for the young professional to be able to serve in the DoD civilian around the world and certainly, DeCA can accommodate that.

FNN: If, as a vendor, I wanted to work with DeCA, what do I do?

ML: DeCA is the only retail grocery store operated by the Department of Defense as a benefit to our service members and authorized patrons.

That is a unique mission, and with that unique mission comes unique challenges.

But at the end of the day, it is a tremendous opportunity for vendors who are looking to make a real tangible and meaningful impact in the lives of our authorized patrons and families.

We welcome the partnership, and really have benefited from the nature of those relationships.