5 security strategies for a distributed DOD

As defense agencies continue to move to the cloud and grow their telework environments, they need a more holistic security model to secure sensitive data across clouds and data centers, while protecting users and devices in any location.

Telework is changing the way the Defense Department works -- and calling for new ways to protect data and provide secure user access. The world was already trending to a work-from-anywhere environment with mobile users and applications delivered through the cloud, but the global pandemic is serving as a driving factor, accelerating digital transformation.

Logically, defense agencies have traditionally restricted telework. Employees and contractors could access classified information only while on site. However, with a more pressing need and evolving technology options, DOD now has new opportunities to develop a remote work strategy that supports access to more sensitive information for employees working outside of the Pentagon.

“We are confident we will rise to the challenge by leveraging our innovative ecosystem,” DOD CIO Dana Deasy said in late July as he discussed pilots to improve the security of the current Commercial Virtual Remote Environment. However, “when you move to cloud … the adversary is going to pivot and try to exploit,” he said.

As defense agencies continue to move to the cloud and grow their telework environments, they need a more holistic security model to secure sensitive data across clouds and data centers, while protecting users and devices in any location.

Defense agencies looking to secure a modern, distributed IT environment and keep their missions moving forward amid maximum telework should consider these five key attributes:

1. Zero attack surface

Traditional, legacy appliance-based remote-access technology, such as virtual private networks, place users directly on the DOD Information Network. This significantly increases risks and often provides poor security controls and visibility for IT administrators responsible for managing and maintaining the environment. In addition, traditional firewalls publish applications on the internet, so they can be found by users -- and by bad actors. 

Instead, with a zero-trust architecture, users are never placed on the network, and applications are never exposed to the internet. This creates a zero attack surface, protecting agencies’ sensitive information from the malware and ransomware threats and successful VPN attacks that have been increasing over these past months.

With strong identity and access management, zero trust facilitates a dark network or “inside-out” connectivity. This means that applications are invisible to unauthorized users. Only authorized users are given access to authorized applications.

2. Connect a user to an application, not a network

In a zero-trust architecture, agencies can provide precise access to cloud-based applications. Zero trust means an organization does not inherently trust any user. Trust must be continually assessed and granted in a granular fashion. This allows the DOD to create policies that provide secure access for users on any device, in any location. 

As data is spread across multiple clouds and data center locations, agencies must shift the focus to connect the user to an application, not a network. Users should only be given access to resources and applications necessary for their job functions. This can further limit east-west traffic on the network so that users will not reach applications they were not intended to access.

Zero-trust network access solutions prevent unsafe connections and attacks that spread across an organization with simple policies that are user-centric, rather than network-centric.

For example, a user connecting from a government-furnished laptop and running a strong endpoint detection and response solution and authentication technology can access a sensitive application. Yet an agency can restrict access for that same user if he is connecting from a personal device.

The direct-to-cloud connection through zero trust also eliminates the hairpinning caused by backhauling traffic through a VPN, decreases traffic and reduces latency – ultimately, improving the user experience. 

3. Multi-tenant architecture

The pandemic has increased focus on facilitating secure data sharing and providing collaboration tools for remote workers so they can continue be productive. A multi-tenant cloud architecture is ideally suited to provide these capabilities.

A multi-tenant architecture, built from the ground up, eliminates the need for security stacks, allowing users to share resources efficiently, while securely scaling to meet increasing demand. Despite the fact that they share resources, cloud users aren't aware of each other and their data is kept separate, providing the necessary reliability and privacy the current IT environments now demand.

Many defense agencies’ initial reactions to the current crisis have been to grow capacity by implementing new infrastructure or adding new appliances. A cloud-native multi-tenant architecture, however, is the only solution that can easily scale up and down as needed when future continuity of operations scenarios arise.

4. Proxy architecture, not pass-through 

A cloud-based proxy architecture lets defense agencies easily scan all encrypted traffic to check for data exposure and threats without extra cost or degradation to performance, which ultimately results in reduced latency and improved user experience.

This allows agencies to provide a more proactive approach to security with machine learning to scan for threats in real-time and actively prevent malware and other attacks from occurring. 

With applications and data widely distributed across multiple cloud providers and SaaS vendors, it is imperative that data exposure risk is measurable and automatically remediated.

5. Secure-access service edge (SASE)

SASE is an identity-based security perimeter that allows users to connect to their data and clouds securely from any location.

Rather than focusing security perimeters around applications, SASE flips the security model to secure the user and data. It allows agencies to move security functions to the location of the users and applications to the cloud. 

The next evolution to secure DOD networks is embracing a SASE model and moving essential security functions – such as web gateway firewalls, zero-trust capabilities, data loss prevention and secure network connectivity all to the cloud. Then, federal employees will have direct access to the cloud, while security is pushed as close to the user/data/device as possible. Localized security reduces latency and improves security response times.

A true SASE will be an as-a-service model that provides simple, scalable and flexible edge capabilities. SASE can unify security functions, including secure web gateway and zero-trust network access. This reduces the significant cost and management overhaul that many agencies previously faced when adding security functions on top of current solutions to fill gaps across distributed architectures.

A security posture for the long haul

There is a new set of security requirements as DOD transforms the current Joint Information Environment to accommodate modern networks, mobile users and advanced threats. 

As defense agencies become more distributed than ever and employees need secure access to sensitive and classified information, it is critical agencies can deliver a holistic security posture to meet missions for today and the future.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.