DevSecOps and Zero Trust Architecture

in Multi-Cloud

MC: Dr. Michaela Iorga, Senior Security Technical Lead, NIST

Wednesday, January 27, 2021

Dr. Michaela Iorga

Dr. Michaela Iorga serves as senior security technical lead for cloud computing with 

the National Institute of Standards and Technology (NIST), Computer Security 

Division. She also leads the Open Security Controls Assessment Language (OSCAL) 

project and chairs the NIST Cloud Computing Public Security and Forensics Working 

Groups. Having previously served in a wide range of consulting positions in both, 

government and private sector industries, Dr. Iorga has a deep understanding of 

cybersecurity, risk assessment and information assurance for cloud, fog and IoT 

systems. In her role at NIST, Dr. Iorga supports the development and dissemination 

of cybersecurity standards and guidelines that meet national priorities and promote 

American innovation and industrial competitiveness. Aligned with NIST’s mission, 

Dr. Iorga’s work particularly focuses on collaborating with industry, academia, and 

other government stakeholders on developing a high-level, vendor-neutral cloud, fog 

and IoT security and forensics guidance. Dr. Iorga received her Ph.D. from Duke 

University in North Carolina, USA.

Varun Talwar

Varun Talwar is the Founder and CEO of Tetrate. He was the founding 

product manager on gRPC and co-founder of the open source Istio project at 

Google. Both open projects that he started are widely adopted in industry 

today for connecting, securing and managing microservices by web scale 

companies, large enterprises and SMBs. He has been a regular speaker at 

Open Source, cloud and security conferences. Prior to Google Cloud where he 

started these projects, he spent 8 years at Google and led product and 

partnerships at YouTube and Google Maps.

Last year he gave the keynote for this conference at NIST about trusting cloud 

native applications. I am happy to welcome him back as keynote speaker for 

this year.

Dr. Ronald Ross

Ron Ross is a Fellow at the National Institute of Standards and Technology. His focus 

areas include computer security, systems security engineering, trustworthy systems, 

and security risk management. Dr. Ross currently leads the NIST Systems Security 

Engineering Project which includes the development of standards and guidelines for 

the federal government, contractors, and United States critical infrastructure. He also 

supports the U.S. State Department in the international outreach program for 

cybersecurity and critical infrastructure protection. Dr. Ross previously served as the 

Task Leader for the Joint Task Force, an interagency group that includes the 

Department of Defense, Office of the Director National Intelligence, U.S. Intelligence 

Community, and the Committee on National Security Systems, with responsibility for 

developing a Unified Information Security Framework for the federal government. 

He also served as the project leader for the Federal Information Security 

Modernization Act (FISMA) Implementation Project and is the former Director of the 

National Information Assurance Partnership, a joint activity of NIST and the 

National Security Agency. During his twenty-year military career, Dr. Ross served as 

a White House aide and senior technical advisor to the Department of the Army. He 

has lectured at Stanford University, Massachusetts Institute of Technology, 

Dartmouth College, Pepperdine University, Naval Postgraduate School, Ohio State 

University, Auburn University, Hood College and gave the Commencement address 

at George Washington University (School of Engineering).

Tetrate
Dr. Ramaswamy 

Chandramouli

Dr. Ramaswamy Chandramouli is a Senior Computer Scientist at the Computer 

Security Division at National Institute of Technology (NIST) USA for over 20 years. 

His publications span diverse areas such as RBAC, Model-based Security Testing, 

Smart Card Specifications, DNS & Email Security, ABAC and Security Guidance for 

Hypervisor, Container and Service Mesh deployments. He is the co-author of 3 

Technical books, 30 NIST publications and 37 peer-reviewed conference and journal 

publications.

Zack Butcher

Zack is a Founding Engineer at Tetrate and helps drive product today. He was one of 

the earliest engineers on the Istio project at Google, and currently sits as a community 

elected representative on the project's Steering Committee. He's written Istio: Up and 

Running as well as worked with NIST to co-author NIST SP 800-204a and NIST SP 

800-204b, both relating to service mesh security. Before Tetrate, Zack worked at 

Google on Istio and across Google Cloud Platform on it's central resource hierarchy, 

service management, identity & access management systems, as well as Google's 

internal mesh that Istio draws from.

Dr. Zulfikar Ramzan

As Chief Digital Officer, Dr. Zulfikar Ramzan leads RSA IT, Security and Risk Office, 

Cloud Transformation Organization, Facilities, and RSA Labs (RSA’s forward leaning 

research and development organization). In this capacity, Ramzan drives the digital 

journey for RSA, including the implementation of IT systems and processes, refining 

the organization’s data architecture and connected flexible workplace strategy, 

managing digital risk for the organization, and developing cutting edge functionality 

across RSA”s product lines. He joined RSA in 2015 from Elastica (acquired by Blue 

Coat Systems), where he was CTO. Previously, he was Chief Scientist of Sourcefire 

(acquired by Cisco) and, before that, Chief Scientist of malware analytics company 

Immunet (acquired by Sourcefire). Ramzan holds more than 50 patents and a Ph.D. 

in electrical engineering and computer science from MIT. His doctoral advisor was 

Professor Ronald L. Rivest, co-founder of RSA Data Security.
Nicolas M. Chaillan

Mr. Nicolas Chaillan, a highly qualified expert, is appointed as the first Air Force 

Chief Software Officer, under Dr. William Roper, the Assistant Secretary of the Air 

Force for Acquisition, Technology and Logistics, Arlington, Virginia. He is also the 

co-lead for the Department of Defense Enterprise DevSecOps Initiative with the 

Department of Defense Chief Information Officer. As the Air Force’s senior software 

czar, Mr. Chaillan is responsible for enabling Air Force programs in the transition to 

Agile and DevSecOps to establish force-wide DevSecOps capabilities and best 

practices, including continuous Authority to Operate processes and faster 

streamlined technology adoption.

The Chief Software Officer works with the Program Executive Officers and is 

responsible for analyzing current software and cloud migration plans to avoid vendor 

lock-ins while allowing for rapid prototyping and a streamlined process for 

deployment. To keep up with the pace of technology, Mr. Chaillan evaluates and 

authorizes new commercially available off-the-shelf software and cloud-related 

technologies to help with their adoption across various Air Force programs based on 

their mission needs.

Prior to his current position, Mr. Chaillan was the Special Advisor for Cloud Security 

and DevSecOps at the Department of Defense, OSD, A&S and Special Advisor for 

Cybersecurity and Chief Architect for Cyber.gov at the Department of Homeland 

Security. He designed the new robust, innovative and holistic .Gov cybersecurity 

architecture (Cyber.gov), that mitigates cyber threats by leveraging best practices and 

implementable solutions with minimal impact to workforce efficiency.

In addition to his public service, Mr. Chaillan is a technology entrepreneur, software 

developer, cyber expert and inventor. He has over 19 years of domestic and 

international experience with strong technical and subject matter expertise in 

cybersecurity, software development, product innovation, governance, risk 

management and compliance. Specifically, these fields include Cloud computing, 

Cybersecurity, DevSecOps, Big Data, multi-touch, mobile, IoT, Mixed Reality, virtual 

reality and wearables.

Adam Zwickey

Adam is a solutions engineering leader at Tetrate. Prior to Tetrate, 

Adam worked as a Field Principal for VMware’s Modern Application 

Platform business unit. His focus for nearly the past decade has been 

helping Global 2000 companies modernize their infrastructure 

platforms and adopt cloud native application architectures. In the past 

Adam has presented on modern application development at various 

conferences such as SpringOne.

Ignasi Barrera

Ignasi has been building hybrid multi-cloud platforms and SDN 

solutions for more than 9 years. He is a long-term open source 

contributor and in 2015 he became a Member of the Apache Software 

Foundation, where he mentors new projects in the Incubator and helps 

with community development activities and the promotion of open 

source. In 2018 he joined Tetrate as a founding engineer where he 

works on service mesh and multi-cloud security.
Joshua Roberts

Joshua Roberts is a computer scientist at NIST. He started as an intern in 

2013 and has been working on NGAC ever since. He is currently the lead 

engineer on NIST’s reference implementations and other NGAC focused 

projects. Under a CRADA agreement with Tetrate, Josh has contributed to 

their NGAC implementation.

Andrew Weiss

Andrew is the lead architect and technical advisor to the University of 

Maryland, Baltimore County as it seeks to demonstrate the feasibility of its 

research in permissioned blockchain technologies in highly-regulated 

industries. He has extensive federal solutions engineering experience 

spanning industry and academia. Andrew is also an active participant in the 

standards development ecosystem. He has previously collaborated with NIST 

on the early development of the Open Security Controls Assessment 

Language (OSCAL) and has developed and open sourced memory-safe Rust 

implementations of various standards including the IETF's Concise Data 

Definition Language (CDDL) and ANSI/INCITS's Next Generation Access 

Control framework (NGAC).

Kevin Paige

Kevin Paige is Chief Information Security Officer at Flexport, provider of the 

Operating System for Global Trade. In this capacity he focuses on a security 

lead approach focused on mitigating risk to the business. His responsibilities 

include Information Security, Product Security, Security Operations, Physical 

Security, Infrastructure Engineering and Information Technology.

Kevin brings over 25 years of information technology and security leadership 

with expertise in delivering solutions that optimize security, compliance and 

technical operations for both the private and public sectors. Previously, Kevin 

served as the Chief Information Security Officer of MuleSoft, provider of the 

leading platform for building application networks, and helped lead the 

company to acquisition by Salesforce. Kevin’s public sector experience 

includes serving 12 years in the U.S. Air Force, and 4 years as a civil service 

employee supporting the Deputy Under Secretary of the Army - Business 

Transformation. Kevin holds a MS in Computers and Information Systems 

from Boston University and a BS in Information Technology from the 

University of Phoenix.

Dr. André Mendes

André Mendes was appointed Chief Information Officer for the Department of 

Commerce in August of 2019. There, he has overall responsibility and oversight of all 

technology systems at the United States Department of Commerce (DOC) and its 

associated Bureaus (FY2020 Budget $3.8B).

Before, Mr. Mendes was responsible for all global technology platforms and systems 

for the International Trade Administration (ITA), the DOC bureau that manages 

global trade issues for the United States of America. There Mr. Mendes oversaw a 

rapid bureau-wide transformation effort making ITA the first Federal 

Agency/Bureau to be 100% cloud based, radically changing several workflows, 

enabling a massive scale-up of service provisioning quality, an unprecedented rise in 

employee morale and job satisfaction while also lowering overall operating costs to 

less than 11% of ITA’s appropriation.

Prior to ITA, Mr. Mendes spent eight years at the U.S. Agency for Global Media 

(USAGM) in various executive roles; including CEO, COO, CIO, CTO and CFO. 

During his time at USAGM, Mr. Mendes managed overall Agency transformation 
generating over $360 million in savings from 2010 through 2018 through aggressive 

global technology and facilities optimization with projected 10-year savings in excess 

of half a billion dollars ($503M). In that timeframe, global weekly audiences grew 

78% (165-278M), all while reducing technology and front office staff by over 22%.

Mr. Mendes has also held CXO positions at Special Olympics International, PBS, 

Pluvita, MRL Pharmaceuticals, USAssist and General Health Inc.

Dr. Sorin Nastea

Dr. Sorin Nastea is Associate Director for Informatics Architecture in the Food and 

Drug Administration’s Center for Drug Evaluation and Research (CDER), Office of 

Strategic Planning. Dr. Nastea has had a long career in IT and related engineering 

fields in industry, research, academia and now in the Federal Government. Before 

joining the FDA in September 2019, Dr. Nastea worked for IBM for over 20 years, in 

Federal Government projects with the U.S. Census Bureau, NIH and FDA, as well as 

in internal IBM systems and projects. As Chief Architect, Dr. Nastea and his team 

built the Census Bureau’s American FactFinder system, Census’ premier data 

dissemination system over two decades, in two major implementations. Also, Dr. 

Nastea oversaw the building of the Census Bureau’s tabulation systems, for the 

Decennial Census (2000 and 2010) final data preparation before public 

dissemination. With NIH, as contractor Lead Architect, Dr. Nastea oversaw the 

modernization of the “electronic Research Administration” (eRA), the NIH’s grants 

management system, including the migration from Oracle Forms to J2EE and the 

eRA’s integration with grants.gov for grants submission via web services. Dr. Nastea 

started with FDA as an IBM contractor, later transitioning in his current employee 

position. Dr. Nastea and his colleagues in CDER work in numerous projects and 

initiatives to modernize and streamline the CDER regulatory review capabilities to 

help the Center better fulfill its mission, with cloud implementations; process 

automation; workflow management; analytics and data management; architecture 

and data governance; AI/ML, etc. Before IBM, Dr. Nastea taught Computer Science 

and Engineering at Tuskegee University, AL and at his Alma Matter, the Polytechnic 

University in Bucharest.

James Younger

James Younger is an information system security professional with 15+ years 

of information technology experience supporting government agencies and 

commercial partners. Most recently, James leads the information security 

team supporting engineering, system accreditation and security related 

research and development activities for the DHS S&T research activities. As 

a IT security professional, James strives to be known as the guy who says 

doesn’t just say “no” but rather works to find solutions that remain security 

compliant and effective. His experience has led to working with “Big Data”, 

AI, ML, cloud-computing and most recently zero-trust architectures. James 

was a recipient of the DHS Under Secretary’s Award as a member of a 

collaborative team with DHS S&T. In his spare time James enjoys working at 

his charcoal grill and rooting for Boston sports teams.