Air Force Chief Software Office Prepares ‘Big Questions’ for Next CSO

In the wake of the first Air Force chief software officer’s fiery, public departure, officials in the office he exited are pinpointing complex questions about properly delivering software to strategically confront with their next chief.

The Air Force Office of the Chief Software Officer’s mission “is really to make the digital Air Force and Space Force a reality,” the office’s Military Deputy Major Christopher Olsen told Nextgov during the Roadmap to Modernization Summit. 

During that panel discussion last week that included Defense Logistics Agency Chief Information Officer George Duchak, Olsen shed light on his office's recent priorities, as well as ongoing defense initiatives to advance technological capabilities and boost staff skills. 

The software office’s small but mighty team is ultimately working to remove impediments to DevSecOps adoption and IT innovation across DOD, and provide enterprise services for modern software development, Olsen noted. But applying such forward-looking techniques doesn’t come without some challenges. 

Earlier this year, the Air Force's first CSO, Nic Chaillan, quit the federal office he was leading. He pointed to a lack of resources and dwindling support from DOD leadership, among other issues, in a candid LinkedIn post detailing his decision to step down.

“Let me give props to the chief software office of the Air Force. I’m a big fan of [Chaillan and] what he did,” DLA’s CIO Duchak noted during the panel. “He was really a visionary and a forcing function, and I think there was an impedance mismatch between how fast he wanted to move, and how fast the department could move.”

Olsen confirmed the Air Force is recruiting a new CSO. 

“The Office of the Chief Software Officer is going to endure,” he explained during the panel. “Anytime a new leader comes into an office, there's going to be, you know, changes and that person is going to have a vision and goals that they want to execute.”

Their plans may change with a new chief, but in the meantime, the small team is “looking at pretty broad, meaty questions” the force needs to answer about how to go about developing and deploying software better, according to Olsen. 

“And some of it gets at some of those things that Mr. Chaillan pointed out in his LinkedIn posts,” he said. “So we want to try to lay the groundwork, if you will, on those questions. At the action officer level, it's hard to answer them. But we'd like to tee them up so that when the new CSO comes in, they're ready to go—and we have some courses of action laid out and they're ready to make decisions.” 

Olsen elaborated on some of those “big” questions, noting that the first involves this “relatively new concept of Air Force software factories.” At this point there are roughly 18 of those small units for delivering niche and specific software capabilities deployed in the field. The factories and DevSecOps tools they use represent a new domain in cyber defense that doesn’t fit within present governing frameworks. 

“So, how do we adapt to that to make sure that we're allowing innovation but also doing it securely?” Olsen said. “That's a big question.”

Among other questions are ones pain-points that are keeping software factories from fully innovating that the office could help alleviate. 

Open source software has also become a powerful asset for the commercial sector, Olsen noted—but one with its own unique set of risks. His office steers the use of Platform One, an open source project and capability that underpins internal software deployments. Olsen added that protecting the nation requires the Defense Department to have a “special bar” for software security.

“What we want to look at is how can we use open source software and know that it's going to do what we want it to do, and nothing that we don't want it to do?” he said.

The service aims to get to a point where it can implement tools, processes and procedures that enable assurance that code used in their weapon systems is safe. Olsen’s remarks were made and the panel was recorded prior to the exposure of the ‘Log4j’ vulnerability—the latest, but certainly not the first, cybersecurity incident involving open-source tools.

Officials are also posing questions around how to best modernize the Air Force’s approach to other cybersecurity risks, Olsen added, and ultimately aim to produce dashboards that show systems’ cyber risk posture in real-time.

The Air Force’s CSO office is additionally co-leading the DOD’s enterprisewide DevSecOps initiative. Many projects are unfolding under that broad effort to make best practices and reference designs available across the massive agency’s software ecosystem. Through one of them, Olsen said officials are working to codify and streamline how various military branches define and use continuous authorities to operate.  

Beyond those and other pursuits, the Air Force’s software-pushing arm is steering a pilot program called Digital DNA, which he noted is meant to “establish a digital foundation for the workforce, and teach them how to apply those concepts inside of the Defense Acquisition System.” 

Currently, the course is self-paced but completed within cohorts. It’s designed in four modules and intended to help officials better understand DevSecOps, create agile acquisition strategies and more. Results, so far, have been positive.

“This is a pilot course we ran a few cohorts through—I'm actually going through myself right now, and I'm loving it,” Olsen said. “Going into the next year, we really want to try to now start scaling it up, making it open enrollment and trying to make it available to the larger DOD community.” 

He detailed a variety of other plans for 2022, including capturing the roadblocks and codifying the success of the Air Force’s ground-based strategic deterrent, or GBSD, program. That early stage effort is enabling the making of the future U.S.-based intercontinental ballistic system that will replace the legacy Minuteman III missiles. Olsen said the flagship pursuit is “doing just a bang-up job” and has become a model program for demonstrating that agile approaches can enable modern software development within a major defense procurement program.

“We want to codify that, and we want to share that with other program managers and say ‘Look, if GBSD can do it—which is, you know, possibly the most important government program in the history of ever considering the weight of what it's supposed to do—then your program can do it too,’” Olsen said. “So, we want to capture that information and we want to share it, maybe in the form of a roadshow across the Air Force, to get people on board with what we're trying to do.”