Securing the federal hybrid cloud

Federal agencies are under pressure to make a timely, secure shift to the cloud with minimal disruption. For many, however, this is easier said than done. With a wide array of data that falls under a variety of privacy and protection regulations, "how?" is a complicated question.

For nearly every agency, the end result will be a unique combination of physical servers and private and public cloud -- a hybrid environment -- designed to shift and evolve as resource and workflow requirements change. While these dynamic and elastic environments will make agencies more efficient and allow them to keep up with evolving demands from both employees and citizens, they become increasingly difficult to secure. This is especially true with the sorts of legacy security solutions that are already in place.

To protect the data that moves across these hybrid environments or, even more challenging, any data that moves between agencies or branches with different network configurations, it is essential that security systems and protocols be able to both span the entire distributed network and dynamically adapt as network environments change. This requires a security system that is as innovative as the networks it needs to protect.

A recent study surveyed federal chief information security officers and IT security professionals not only to determine how they are managing their cloud migration, but also what that migration looks like. The survey also looked at federal IT managers’ sentiments regarding the success of their agencies’ security efforts with respect to their existing infrastructure as well as their evolving cloud environments.

The survey revealed important insights into the state of hybrid cloud in the federal market. Major findings include:

Mixed clouds in the forecast. Survey responses indicate that the ideal ratio of a hybrid environment is around 60 percent cloud and 40 percent physical servers. And their outlook is optimistic: 70 percent believe that in 10 years, the majority of federal agencies will rely on hybrid cloud environments for their core applications.

Security concerns hinder efforts. IT managers at federal agencies also report, however, that their biggest cloud challenge is expanding security policies and measures to cover cloud environments. The challenge of how to solve this problem is evident in the mixed response of those surveyed. While almost half of respondents feel hybrid cloud environments have made complexity, visibility and security easier to manage, a little more than half say that it’s increased the difficulty. Even more concerning, over half report that their networks are at significant risk for a security breach due to both the level of complexity of their evolving networks and the lack of visibility that this complexity imposes.

The benefits of success. Federal agencies that rated themselves as having “excellent” security integration between their agency’s virtual and physical environments are more likely use  a security information and event management system  or other analytic tool to centralize management, enable automation and impose consistent control. Federal IT managers believe that, when done properly, the successful adoption of hybrid cloud will reduce their agency’s security spending (70 percent) while strengthening their overall security posture (69 percent).

Recommended best practices

Successful hybrid cloud deployments result in greater efficiencies, reduced costs, improved network performance and scalability, greater innovation, and more secure data and systems. Success is possible, particularly if federal IT managers implement the following best practices:

1. Agencies would do well to leverage both mandates and policies to ensure top-down support as well as to sustain authority and control over physical and virtual appliances, ensuring that these environments and the data, applications and workflows they support remain secure.

2. While federal IT managers must tackle visibility issues and infrastructure complexities before enjoying all the benefits that a successful hybrid environment has to offer.

3. To ease the burden of securing cloud environment, agencies can use carefully crafted automation to improve efficiencies and outcomes as they centralize management and consider using third-party tools.

Developing the cloud that feds need

The Executive Order on cybersecurity has given agencies opportunity and impetus to improve efficiencies and security alike. To date, progress has been made on cloud migration, and though results may currently be inconsistent, getting these first steps right is crucial to safeguarding the federal government’s digital assets.

Today’s IT complexity and the need for both deeper and broader visibility demand effective integration among the security solutions deployed to protect both physical and virtual environments. An integrated security fabric, built around open standards, allows deployed security tools to see and share threat intelligence, dynamically correlate data, enable the agile and intelligent segmentation of networked data and resources and automatically coordinate a response to detected threats. It also increases visibility and control across a hybrid environment, thereby protecting networked systems at the speed and scale cloud environments can provide.

By weaving traditionally isolated security resources together into an integrated and holistic security fabric, federal agencies can share and correlate threat intelligence from across the distributed network and implement automation to make critical decisions at machine speeds. This will allow federal IT managers to achieve their goal of deploying highly secure hybrid cloud environments combined with broad visibility and granular controls.