Embrace IT Modernization Without Creating Cybersecurity Risks

Cybersecurity professionals, from chief information security officers to network engineers, know that updating old IT systems can cost time and money and has the potential to disrupt work continuity. As a result, many organizations postpone IT upgrades. 

However, Congress recently gave agencies the green light to begin investing in modernizing their IT systems when they appropriated $100 million for the Technology Modernization Fund in the fiscal 2018 omnibus spending bill—a component of the Modernizing Government Technology Act. Under this act, agencies may borrow funds to update aging and possibly under-protected systems. It also establishes IT capital funds for agencies to store savings from other modernization initiatives (like cloud migration projects) for future efforts.

Cybersecurity concerns are a driving force for modernization, for good reason: Federal agencies that invest more in modernization experience fewer breaches than their peers focusing on the maintenance of legacy systems, according to a study from the Fox School of Business at Temple University and the McCombs School of Business at the University of Texas-Austin. In fact, the research reveals that a one percent increase in new IT development spending results in a five percent decrease in breaches. With incidents reported by federal agencies sharply rising since fiscal 2006—from about 5,500 that year to nearly 77,200 in 2015—there is a sense of urgency governmentwide to respond.

As government leaders seek to modernize their systems, they must remember that modernization is not a “cure-all” threat mitigation remedy and they must move forward carefully and strategically to avoid unintentionally increasing their cyber threat risk. Modernizing IT systems is a balancing act, and agencies should consider the following as they move forward:

Tension Between New and Legacy Systems 

Most modernization initiatives are not a 100 percent “rip and replace” undertaking. They’re more like when you remodel your kitchen, and you replace the flooring, countertops and appliances, but you keep the cabinets. 

Likewise, even if agencies invest millions into new systems, a certain amount of legacy technology will remain because they perform a specific, critical function or the cost of replacing the technology is greater than the value of maintaining it. The challenge is that the new systems generally incorporate new, advanced security technologies—such as the implementation of two-factor authentication—that aren’t always compatible with legacy solutions. This leaves a potential entry point for hackers to gain access to your network, despite your modernization investment.

Consider these steps to reduce your risk: 

• Go “back to the store” and find a solution that configures or layers on top of your legacy technologies for two-factor authentication and/or other security capabilities. 
• Employ network segmentation and create dedicated, separate networks for legacy systems so that any activity within the legacy environment cannot impact activities outside of it.

Hastily Crafted, Complex IT Systems

With an IT modernization effort, the stakes are high. If you proceed without a well-considered, strategic approach, you could unwittingly expand your attack surface.

Unfortunately, this is what often happens as pressure builds to finish a project quickly. As a result, dispatch teams are hurriedly formed to tackle various parts of the modernization initiative with team members scrambling to quickly complete their component with limited agency-wide coordination and collaboration.

In the process of optimizing for the parts rather than the whole, immense layers of complexities are added without integration among the systems to gain and maintain a “big picture” perspective. Complex systems are harder to manage when you consider the number of individual systems across an agency and the updates, patching, monitoring and mitigation responsibilities for each one. When IT is harder to manage and you have limited personnel to work with it, it’s easier to make mistakes, which can ultimately lead to security lapses.

Careful, enterprisewide planning will help you avoid all of this:

• Narrow the breadth of new vendors and products arriving to modernize systems by closely assessing which providers are the most necessary and strategic. This principle helps offset the risk of new, unfamiliar technologies. 
• Create standardization mandates for IT acquisitions with uniform security policies and procedures supporting each purchase.
• Implement interoperability directives, so modernized systems align with existing security controls. 

The ultimate goal of an IT modernization initiative is to ensure your agency runs at peak efficiency, while safeguarding the information flowing through its networks. While bringing in today’s best products will boost the efficiency and effectiveness – and subsequently, return on investment—of your operations, it’s critical to assess the security ramifications of integrating new and legacy technologies. With a thoughtful, intentional digital transition plan, agencies can confidently update their IT ecosystems. 

Jeremy Haas is the chief security officer at LookingGlass Cyber Solutions. Prior to LookingGlass, Haas worked in the Central Intelligence Agency’s Center for Cyber Intelligence where he led and participated in cyber operations, engineering and analysis activities supporting intelligence, counterintelligence and covert operations.