The Rx for DX: Multilayered security for digital transformation

Digital transformation (DX) can be both a blessing and a curse for government agencies. New technologies simultaneously improve the user experience and expose those same users -- and the agencies themselves -- to data security threats unheard of just a few years ago.

To protect data, agencies must stop focusing on the perimeter and deploy a multilayered strategy for data security. Tactics in such an approach range from better shared responsibilities with cloud service providers to zero trust when it comes to accessing network resources.

I’ve often said that the real goal of government IT security is to “secure the breach.” To minimize the damage caused by attacks, agencies must adopt rigorous means to secure data, not the network perimeter.

That position has been echoed in a recent threat report from a leading industry analyst firm, titled “Federal Government Looks to Zero Trust Approach to Data Security.” (Note: This report was commissioned by Thales.)

Doing more with less does more damage to security

The government mantra to “do more with less” has led agencies to adopt of a wide variety of solutions, including cloud, mobile and internet of things (IoT) technologies. DX certainly allows agencies to streamline operations and improve constituent services. Apparently, however, some agencies fall short of the mark when it comes to sufficiently securing the data accessed through transformation technologies.

Historically, organizations would concentrate security efforts on the network perimeter first, concluding that the IT infrastructure would be more easily defended behind a strong perimeter. But the report noted that “the perimeter is increasingly permeable, or even non-existent with the rapid adoption of cloud and increasing amounts of sensitive data stored in the edge.”

The cloud has also created an inflection point in the fight for cybersecurity, with 54% of all federal government data currently stored in cloud environments, according to the report. Sensitive data accounts for 51% of that total. What’s more, most government organizations use multicloud environments, and this combination of factors has created complications that have affected network performance and processes -- and an increasingly nightmarish data security scenario.

Perception is not reality when it comes to agency security

Agencies’ beliefs about their own security “are incongruent with the reality painted by survey results,” the report said. Some 71% of federal government respondents believed their infrastructure to be very secure from cyber threats. Nonetheless, the analysis concluded that these agencies “are not sufficiently implementing the processes and investing in the technologies required to appropriately protect their data.”

This position is supported by findings that more than half of agencies have either been breached or have experienced failed security audits. Most government organizations, the survey reported, “incorrectly look to their cloud providers to implement data security measures for the portion of the shared responsibility model that is owned by the government organizations themselves.”

Data security still holds a small share of the overall security budget for the U.S. government. Fifty-six percent of federal agencies reportedly plan to increase data security spending in the next 12 months. Nonetheless, the bulk of this spending is expected to be on network security rather than data security, which represents just over 17% of overall IT security budgeting.

A multilayered prescription

So what is to be done? Because government agencies are facing growing and increasingly complicated data security challenges, it is incumbent on IT professionals to invest -- both in terms of money and resources -- to improve their data security posture. Security policies must be established that take into account not only the current landscape of digital transformation and the cloud, but other disruptive technologies looming on the horizon.

The answer to data security, as described in the survey, is a “multilayered approach,” comprising better compliance with the shared security responsibilities outlined by cloud service providers to the adoption of a “zero trust” perspective on access and data protection. This approach requires authentication and validation of users and devices accessing applications and networks.

But even that is not enough. More robust data discovery, hardening, data loss prevention and encryption solutions must also be folded into this new multilayered approach to data security.

This prescription may be a bitter pill to swallow for agencies that thought their missions would be made magically easier through digital transformation. Improved operational efficiency is a benefit of digital transformation, but to ensure proper security, agencies must stop focusing on the perimeter and start securing the breach.