As agencies undertake return-to-the-office planning, most agree work will look different.
“I think that the patterns are going to continuously change,” Jane Datta, assistant administrator and chief human capital officer, NASA said at the recent Resiliency Colloquium. “And interestingly, we’ve had a lot of discussions at NASA about what does it take to have really good shared space rather than individual offices or cubes, and how much investment do we want to make.”
Over the past year, Federal IT and security leaders have worked to make remote work, work – for team members executing government missions that range from military operations, to delivering front-line citizen service, to those researching new ways to put advanced technology to work.
This means more clouds – and for the most part, hybrid or multi-cloud environments, which means more complexity and increased cyber risks. Agencies can lean on the lessons of the past year as they build out, and secure these multi-cloud environments. What we know:
- Federal IT leaders are concerned with multi-cloud management.
With the rise of ransomware and malware attacks infiltrating Federal remote networks and endpoint devices, cloud management capabilities are becoming more important than ever.Federal IT leaders surveyed say concerns stem from a host of challenges, including budget constraints, meeting Federal requirements, workforce competencies, and increased attack surfaces. - Security is a process, not a product.
Federal IT teams can’t purchase a product from a cloud service provider that says you’re secure – there’s a lot more to it, said Eric Trexler, vice president of global governments and critical infrastructure, Forcepoint in a recent interview.“You need to work through it with security, with IT, with business operations, and see the cloud service provider as the integrator.” - Multi-cloud environments can be purpose-built to meet specific mission needs, efficiently.
The majority of Federal IT decision makers report their agency uses multiple cloud platforms to satisfy different IT needs.Multi-cloud also “helps agencies drive pricing and allows them to play off of the different clouds,” said Trexler. - Prioritizing the user helps keep data secure.
Traditionally, security methods tend to have a reactive posture, using things such as firewalls and log shipping that can lead to a lengthy discovery remediation and/or recovery time, lasting as long as six to 18 months, said Ray McCay, vice president of solution sales, ViON Corporation. “During this time there are potential open windows for attack, insider threat issues, and even sensitive data exfiltration and leveraged exploits.”Instead, agencies should think about adjusting their multi-cloud security models from reactive to proactive.Proactive, human-centric security focuses on the people who use the data, and how they use the data. This approach helps cybersecurity teams better understand the value of the data, the risk equations associated with the data, and as a result – gain the visibility they need to improve network protections from advanced cyber threats.
Human-centric security “allows our analysts to be able to focus on the things that matter, versus just constantly looking at a monitor and not really knowing what’s going on,” said Luis Coronado, Jr., executive director, IT Operations, at DHS in a recent webinar.
- Continuous monitoring helps to simplify multi-loud security.
Agencies that have had the most success migrating to multiple clouds have a cloud management office of some sort that provides visibility into what resources are available and establishes a system of continuous monitoring. With continuous monitoring, IT teams have a better handle on what the user is doing within the network and what they should be doing.
Related Stories:
Federal Cloud Growth Puts Spotlight on Proactive Multi-Cloud Security