Secure and rapid modernization takes innovation from all sides
As the past few months have shown, close collaboration and aggressive sharing of lessons learned can pay big dividends.
Across all levels of government, IT teams were forced to quickly adapt to the COVID-19 pandemic in order to securely connect their newly remote workforce to data and applications, and to better align security controls, access and operations.
Digital transformations – and the required risk management decisions -- that might have taken months or years in the past were now requiring deployment timelines of days or weeks. To achieve these rapid shifts, IT teams that once worked in silos are collaborating much more closely – network administration, security, etc.
Today, networks are increasingly becoming disparate – data is distributed across on-prem data centers and many flavors of cloud. Remote employees connect from a variety of locations and devices. As the traditional network perimeter disappears, the attack surface expands – bringing new security headaches.
The disruptions are unlikely to dissipate anytime soon, and the only path forward is continued community-based innovation. The success many agencies have achieved in these past few months is a direct result of the hard work and new ideas coming from all sides – government and industry – and collaboration between the two sectors.
While there are many challenges, the progress is a hopeful signal. As we modernize for the long term, and for the next unknown challenge, there are three important steps:
Share Modernization Lessons Learned and Guidelines
The General Services Administration, as an example, recently unveiled an enhanced digital experience for its one-year-old Cloud Information Center (CIC), a central repository of cloud information and resources covering security, technical capabilities and implementation.
Recognizing the complexities of cloud migration, GSA updated the CIC to organize information into an easily accessible format. The enhanced CIC provides an improved interface, and more sequential information to make it easier for agencies and industry to consume the theories and apply cloud migration guidelines.
The CIC also explains and emphasizes the importance of using a Federal Risk and Authorization Management Program-authorized cloud solution to facilitate rapid modernization efforts. Cloud Service Providers that are FedRAMP-authorized, especially at the Joint Authorization Board's high baseline level, have undergone a rigorous in-depth audit for critical security controls that enable any agency’s team to ensure a foundational level of security assessment, authorization and continuous monitoring for cloud products and services.
Take Advantage of TIC 3.0
In another important step to modernization, the Cybersecurity and Infrastructure Security Agency (CISA) issued the Trusted Internet Connection (TIC) 3.0 Interim Telework Guidance, opening the door for modern access and security (including “direct-to-cloud” approaches), letting agencies take advantage of modern, efficient, and importantly – scalable – cloud applications from the vendor community. This guidance allows agencies to shift to as-a-service models, which ultimately improves scalability, while reducing legacy appliance costs and maintenance requirements.
The opportunity to implement a “direct-to-cloud” access model that optimizes security, gives Federal agencies the chance to take advantage of technologies such as Secure Access Service Edge and Zero Trust Network Access, resulting in significantly accelerated cloud adoption and modernization strategies.
A FedRAMP-authorized zero trust security model allows IT administrators to wrap policies around users and applications to ensure comprehensive security regardless of where they connect from, and what they connect to. This approach reduces the attack surface and the risk of users accessing unauthorized data or applications. Additionally, IT administrators have centralized, "single pane of glass' visibility to track, log, and manage all users connecting to the network on any device, in any location. This provides a huge advantage for managing an extensive work-from-home environment.
Reshape the Workforce Through Public/Private Partnerships
As agencies upgrade security and adopt cloud for long-term modernization, strong agency/industry partnerships will be critical. Through innovative industry/government programs, government employees are able to gain valuable insight in the private sector value propositions, and industry is able to gain specialized government skill sets and perspectives. This exchange of ideas helps push modernization forward.
I had the opportunity to participate in the DOD SkillBridge program, though which military service members participate in industry-sponsored positions, gaining experience and training as they transition into the civilian workforce.
In addition to supporting the service members, the program helps to meet the needs of the industry workforce, matching service member’s skills and abilities to industry organizations across a variety of fields, including information technology.
The lessons learned from COVID-19, combined with continued government/industry collaboration, will improve our ability to support whatever comes next, and strengthen our cyber defenses to modernize for the long-term. There are no silver bullets, and there is certainly still room for improvement. But we do have a good start.