How IT teams can securely accelerate cloud adoption

Over the past several years, IT modernization has become a focal point for federal agencies -- many of which still rely on a legacy infrastructure. In fact, 80% of IT budgets go to the operations and maintenance of these aging systems. To increase productivity and minimize the risks posed by this legacy IT, federal agencies have begun deploying software-as-a-service applications and internet-of-things devices as they move critical workloads to the cloud.

However, this transition is easier said than done, especially where security is concerned.

Network and IT modernization often result in sprawling, complex environments. Agencies have begun using applications supported by a variety of cloud providers to allow access to distributed data and workloads from their central offices and branch locations. At the same time, agency IT teams are connecting their existing physical data centers back to these cloud providers. The result is a complex, hybrid and geographically distributed network environment that can make security and end-to-end visibility nearly impossible.

Securing cloud deployments in government networks

Security in depth is essential to federal networks, especially those that house highly sensitive information on citizens, intelligence and matters of national security. This issue has become even more critical as agency networks have become the frequent target of attacks carried out by hacktivists and nation-state threat actors looking to disrupt operations, critical infrastructure and economies on a national level or gain access to state secrets.

Without proper security assurances, federal agencies will be unable to fully adopt the cloud and achieve the speed and adaptability required for modern networking.

Therefore, to enable cloud adoption and modernization in a government setting, IT teams must put security at the foundation of modernization -- rather than something that is added on after the fact. This requires a security-driven networking strategy that begins with a security-first approach for each phase of cloud adoption. It then involves tightly integrating network and security functions, allowing security to dynamically adapt as networks scale rather than reacting to change and creating temporary gaps that can be exploited.

Modernizing federal IT with security-driven networking

In the past, network development began by building out an infrastructure and later deploying point security solutions such as firewalls or email gateways to protect specific segments of the network. With security-driven networking, security infrastructure is developed alongside network infrastructure, with security helping to determine network design and functionality. This way, changes to the network, workflows and other resources automatically result in updates to security tools and protocols.

Using security-driven networking to accelerate cloud deployments across federal networks will require stakeholders to:

• Consider security as essential to network updates.
• Identify specific dataflows and the resources involved and document anything that moves between environments.
• Determine baseline performance requirements for workloads.
• Set security requirements for cloud and on-premises environments as well as requirements for types of data and devices.
• Consider any issues that may arise when orchestrating security across these distributed environments.

Tools for security-driven networking 

Security-driven networking requires multiple types of security that can span different form factors and networking environments in public or private clouds, including virtual machines, software and agents, cloud containers, application programming interfaces to extend security into applications and more. This approach ensures a security-to-the-edge strategy, even as the number of edges in the network grows. Furthermore, these capabilities and solutions must be integrated so that federal IT teams can coordinate policies across devices, even within hybrid networks.  

However, most data center firewalls were not designed to accommodate the performance, volume and translation requirements needed to connect distributed data centers -- especially those deployed across different cloud platforms. Effective security solutions that support modernization efforts must be able to function both natively and consistently across all cloud networks, branch offices, connected devices and traditional data centers.

To meet the needs of federal agencies and similarly transforming industries, next-generation firewalls (NGFWs) have been designed to support security-driven networking in a way that accelerates cloud adoption while minimizing the roadblocks often encountered when connecting data centers to the cloud.

• Federal agencies require always-on, high-speed performance -- even as data moves between various clouds. Traditional security solutions can often slow operations, which is not an option. A new class of NGFWs that leverage custom-built security processing units (SPUs) s ensure that data moving across environments stays secure while delivering crypto VPNs, access controls, breach prevention solutions and more at digital speeds that meet both operational and security requirements. 
• Inspecting encrypted traffic can be highly consequential to performance as many firewalls are challenged to decrypt, inspect and re-encrypt traffic quickly enough to meet current performance demands. However, not inspecting encrypted traffic can result in malicious content passing through the firewall undetected. Those same integrated SPUs -- specialized ASIC chips designed to offload security functions -- also enable encrypted traffic to be inspected without hindering security performance or slowing request fulfillment. Neither of these can afford to be compromised.
• Agencies can also use these NGFWs to securely accelerate their move to the cloud through the use of intent-based segmentation. This allows IT teams to intelligently segment assets and networks regardless of whether they are running on-premises or in the cloud -- thereby securing each individual network ecosystem while also reducing the potential attack surface.
• With so many devices and applications being deployed across federal networks, it is essential that any patches and updates are administered in a timely manner. Otherwise, these vulnerabilities can be leveraged as entryways into the network.

Final thoughts

As federal agencies seek to modernize their digital infrastructures through the use of hybrid and multicloud environments, they must ensure that this new infrastructure does not cause gaps in security protocols that could leave them vulnerable. Leveraging a security-driven network approach through the use of advanced next-generation firewalls, IT teams can establish a single, cohesive security strategy across their entire distributed network. This, in turn, accelerates their move the cloud -- which minimizes the risks and costs brought on by lingering legacy IT -- and ensures that security policies are cohesively updated across distributed environments simultaneously.