What If Your Data Could Secure Itself?

The thought that data can secure itself may sound more like a sci-fi movie plot than a goal for a chief information security officer at a federal agency. Nonetheless, I remain bullish on the idea that data-centric security practices can achieve this goal within the U.S. government.

While the government manages and secures large, complex and often outdated legacy IT systems, as federal agencies modernize their IT, it is possible to harden systems from the inside out by encrypting and anonymizing data to minimize the potential for loss when an adversary invades.

For the past year, Accenture Federal has been calling for a Cyber Moonshot—one that engages our nation’s leaders, policymakers, government, industry and even our citizens. The Federal Cybersecurity Risk Determination Report and Action Plan recently released by the Office of Management and Budget outlines the necessary steps our government must take to create a resilient environment. This is a critical step in the right direction. One of the four core requirements outlined in the report calls for the standardization of IT and cybersecurity capabilities to control costs and improve asset management. Which means we must take the necessary steps now to secure our data.

Remember there are two things that adversaries want when they try to access government systems: data and control. To move beyond a state of cyber reaction and into a state of cyber resilience, we need to secure our data. Regardless of whether the attack comes from inside your organization or from an outside foe, the objective is the same: to steal, modify, or destroy data and/or implant a capability to take control of systems or networks at a time of the adversary’s choosing.  

Building strong protections at the network perimeter—while critically important—are only part of the solution. A data-centric approach is one of five key strategies agencies can use to reach cyber resilience. Data-centric security provides the tools and techniques to make it possible to safeguard data and remain firmly in control of your enterprise. So, in the spirit of one step at a time, start with what’s good—then keep working your way to what’s even better.

GOOD: Data tagging and marking and encryption. Start by formally reviewing your data and systems and then prioritize them in term of the data’s importance (mission critical, reputation critical or existential threat). Of course, budgets are not infinite, so focus first on hardening the high-value assets. Making decisions on access permission and automated access control decision services requires strong data tagging and marking. If your data is not already tagged and marked for that purpose, it is critical to establish a framework for doing so. You also want to ensure your data is encrypted at rest and in transit.  Make this the default condition for all data and systems.

BETTER: Across-the-board IDAM. Strong identity and access management (IDAM) services are essential—not just for people but also for data, applications, networks and devices. Separate data from applications, applications from security, security from rules, rules from data. This approach minimizes the impact of any change to data, security or application and ensures the data is securely available to the business systems that need it. Once you have established who should have access to what data, you need to provide a mechanism for users to discover data they may not have explicit permissions to see—along with an automated mechanism to request access. Also, take steps to ensure data integrity by using blockchain or blockchain-like processes to detect and prevent unauthorized alteration of data.

BEST: Adopt tokenization and segmentation. With this capability, you can substitute alternative values for sensitive data in both structured and unstructured formats. At a minimum, you should tokenize all data covered by PII, HIPAA, PCI or GDPR rules and regulations, or any other data considered sensitive for business, national security or other reasons. Be consistent in how you tokenize to ensure that analytics and other advanced computations can be calculated correctly. Where possible, encrypt and store your real data and your tokenized representations in different systems.

With this approach, no single vulnerability can be exploited to give attackers unfettered access to everything needed to reconstitute to the original form. As we discuss in our new report, where appropriate, throttle an individual’s access to data to help prevent wholesale data theft. For example, an adjudicator of security clearance applications can only process a limited queue of people. Further, segment accesses to specific roles. For example, a reviewer of financial information doesn’t need to see medical information. Segmentation combined with access throttling limits the damage that phished credentials or a bad insider can do.

The to-do list is long and may appear insurmountable. Don’t let it overwhelm you. Instead, consider these suggestions as guideposts that will help achieve system modernization and data security. With each system that you update or replace, you have an opportunity to implement data-centric security. As you make progress over time, you will reach the critical point where you’re no longer securing data—the data is practically securing itself.

Gus Hunt is a cybersecurity strategy lead for Accenture Federal Services.