Executive Spotlight: Interview with Mike Cosgrave, SVP of CACI Cyber Development

“With connectivity becoming ubiquitous most platforms have varying levels of cyber vulnerabilities.  Some are well known…but others are not. We are only waking up to the scale of this challenge – and there is much work to do.”

EM: Could you tell our readers about your role for CACI and how your previous roles and experiences prepared you for this position?
Mike Cosgrave: My current job is Senior Vice President of CACI’s Cyber Development Group, a line organization focused on the national security aspects of CACI’s Cyber market.  I’m dual-hatted in that I also lead strategy development and execution for CACI’s Cyber market. It’s been a rewarding experience building upon CACI’s already strong cyber qualifications and charting the course for the company in this market.

I’ve been engineering- and operations-centric, primarily in the government contractor industry, my entire career.  After a short stint in the Navy I began as a software developer and eventually moved over to line management.  I worked at companies ranging from small to mid-sized to large, making my way up through project, program and executive management.  Through the years I’ve worked in a variety of government customer environments including the Intelligence Community (IC), Department of Defense (DoD), Law Enforcement and Federal Civilian.  The types of efforts I’ve supported include cyber defense, enterprise IT, software development, system engineering, training, policy support and program management, among others.  Having that broad experience across markets and services gives me a good perspective on strategy and execution leading a cyber-focused group.

EM: DoD and the intelligence communities are focusing a lot on integration. Could you tell us more about that and how it affects cybersecurity and data infrastructure?
Mike Cosgrave: In many places across the IC, there is a focus on integrating Open Source Software solutions accompanied by development of analytics and visualizations to ride on top of it.  Standards become more important when transitioning from traditional databases for a single mission to large NOSQL solutions such as Hadoop.  Transitioning from these non-standard legacy databases puts significant stress on the data engineering process.  Processes such as Extract, Load, Transform, Semantic Enhancement, and Normalization can be complex depending on the situation.  Leveraging data standards such as CYBOX, STIX and TAXI can be useful in easing that transition.

From a cyber perspective it’s usually a positive change.  Data access management across stove-piped databases and applications is often a mixed bag – some have strong user access management and some do not.

EM: What are the challenges that the government faces with cyber and intelligence? What are some of the solutions?
Mike Cosgrave: There are plenty of challenges – workforce development and training to address skills gaps, probing of and threats to critical infrastructure, legal norms, cyber deterrence and effective public/private information sharing of cyber data are just a few.

Cyber domain awareness and mission management is a gap that needs to be addressed.  Just as air, space, sea and land are domains that intelligence and DOD operators must factor and operate in, so too is cyber.  Having a good shared situational awareness of this space across Title authority organizations would enable effective operations in this domain.  DARPA has some promising solutions.  For example, CACI supports DARPA’s PlanX Program, which is transitioning into operations and can help address cyber mission management.  This capability is as much about the offensive aspects of cyber as it is defensive; A common understanding and perspective on the threat environment is necessary for both.

EM: Where do you see NIST standards/requirements as a market opportunity for CACI in the future?
Mike Cosgrave: I believe NIST standards will certainly drive and influence the decision-making process of the government and private sector in mitigating cyber risk.  Across the federal government, NIST’s Risk Management Framework (RMF) is being adopted in varying degrees when it comes to assessment and authorization of systems.  It will likely continue to mature and evolve as organizations adapt to applying RMF principles.

Beyond just shaping and informing cyber security, I do believe there are potential opportunities for application of NIST standards beyond traditional network and application spaces.  Namely, applying RMF principles to what I think of as platforms, which can span everything from vehicles to aircraft to ICS to weapons systems.  With connectivity becoming ubiquitous most platforms have varying levels of cyber vulnerabilities.  Some are well known, such as SCADA, with a lot of work ongoing to address vulnerabilities.  But others are not and we are only waking up to the scale of this challenge – there is much work to do.  Further, I think of this as two separate issues – pre-fielded platforms and fielded.  CACI is involved in addressing both sides of this challenge for multiple DoD organizations.  The former is where standards can have the most impact, being applied during the design, development and testing life-cycle and building cyber security in from the start.  What to do about fielded platforms is the larger problem.  Standards can assist; to some degree, but discovering, prioritizing and mitigating cyber vulnerabilities across platforms is a significant challenge.

EM: How do you see CACI growing and evolving?
Mike Cosgrave: I believe CACI will continue to execute its market-focused strategy, focusing on the right blend of talent, solutions and capabilities to allow us to advance in each of our designated markets.  We will continue to emphasize agility to respond to customer demands, innovation in meeting their requirements and move towards solution-based opportunities.  Above all else, we will emphasize our culture of character.

Specifically in the cyber market, continuing to support DOD and IC national security objectives in the cyber domain will be areas of emphasis.  Keeping pace with the degree of rapid change in cyber, offering solutions and services that are highly relevant to mission requirements in this space, and providing the needed talent are all critical to our success.
205583