House of Clouds: The Federal Transition to New Network Infrastructure

Mark Hutnan is Qualys’ vice president and general manager of federal operations.

It is no secret the federal government's IT infrastructures are out of date, fragmented and incredibly vulnerable, with some systems reportedly over 50 years old. The current administration is beginning to address this critical issue in an effort to modernize the federal IT practices and mitigate risk. The first step the administration made was to launch the American Technology Council on May 1, which is tasked with coordinating strategy for federal government IT use. Shortly after that, a new executive order called for agencies to use the risk management framework and move their IT infrastructure to the cloud.

While these initiatives are a step in the right direction, it is much easier said than done in the case of federal IT infrastructure. It takes time for policy changes to catch up with organizational adoption. Currently, the government spends billions of dollars operating thousands of data centers, even though it’s more cost efficient to centralize operations in the cloud and assign/leverage resources from providers that are experts in the area.

Time for Legacy Systems to Make Way

Different factors stand in the way of making a smooth transition to cloud. For instance, the federal government spends billions of dollars on operations and maintenance investments on legacy hardware that have become obsolete. One shocking example is that there are instances where some organizations still use antiquated and vulnerable technologies (such as 8-inch floppy disks) in legacy systems critical to the protection of the nation’s critical infrastructure.   

Many federal organizations are just now understanding the impact of adopting cloud technology and what it will take to realign their organizations for the cloud in terms of strategic planning, budgeting, contracting and workforce utilization. A recent survey from Deloitte found that fewer than one in 10 federal leaders believe their agency’s cloud migrations have been successful, while around 40 percent said their efforts to move to the cloud were “mixed, problematic or nonexistent.”

But this is no excuse for putting some of our most sensitive information at risk. If anything, antiquated systems are a major reason why we’ve experienced security problems. The most prominent example of infrastructure shortcomings was the 2015 breach of the Office of Personnel Management. In total, 21.5 million people’s information was compromised because the computer systems being used to store it on were too old to use modern security practices and encrypt the data.

What will it take to get them to finally buy in? Let them see it at work.

Rising to the Clouds

Demonstration and buy-in is needed by government stakeholders to implement these wide scale IT changes. But for that to happen, federal organizations need to experience the SaaS/SECaaS model in action through proof-of-concept opportunities. Once stakeholders are able to see the capabilities delivered through this model in a live environment, their myriad of questions will be overshadowed by the obvious value proposition and reduced total cost of ownership it offers.

And if seeing it isn’t enough, cloud service providers are being rigorously tested. The FedRAMP program has been created as a clearinghouse for CSPs to go through extremely costly and rigorous security reviews and vetting to ensure certification and authorization.

Education will also help and will be one of the linchpins of the future between the government and the cloud. The executive order calls for federal agencies to adopt cybersecurity best practices outlined by the National Institute of Standards and Technology. These need to be comprehensive and also outline context on cloud technologies.

While cloud computing offers increased benefits in affordability, accessibility and scalability, expectations need to be set to do the back work in creating an understanding that this will take time to ensure agencies have the right protocols in place to make the transition.

Ultimately, the framework has been laid, but it’s up to the federal sector to embrace the new technology, rethink their strategy to create new, cohesive best practices, and continue to learn about necessary standards that will need to be adhered to in the future to remain safe and productive in the era of cloud.