Get 'cloud smart' and focus on security, procurement and workforce training
Connecting state and local government leaders
As more government agencies migrate their infrastructure and applications to the cloud, Cloud focusing on security, procurement and workforce will ensure a smooth, secure transition.
The federal government’s 2019 Federal Cloud Computing Strategy — Cloud Smart calls for improvements in security, procurement and the workforce. But how can agencies “get smart” as they migrate resources to the cloud? Let’s look at each of the three Cloud Smart pillars to understand how agencies can successfully manage their cloud migrations.
Security
As more government agencies migrate their infrastructure and applications to the cloud, it’s imperative that they focus on protecting their data. This means carefully considering which datasets, applications and workloads are or are not appropriate for the public cloud.
It’s also important to remember that protecting data is the responsibility of the agency, not the cloud service provider. Amazon Web Services, for example, clearly states in its shared responsibility model that it’s the users' responsibility to secure their data, while AWS is responsible for managing the physical infrastructure.
This shared responsibility model makes it even more critical for agencies to implement proper security controls before data leaves on-premises environments. These steps could include implementing patch management solutions to address software vulnerabilities and managing user rights to control unauthorized employees or contractors from accessing data they're not authorized to see.
Procurement
Public-sector organizations strict procurement and budgetary constraints have traditionally made it more difficult to easily and quickly deploy on-premises, hardware-based solutions and contributed to the growing shadow IT epidemic.
Cloud Smart recognizes the need for expedited procurement -- a need borne out by a recent SolarWinds survey of its THWACK user community of more than 150,000 registered members.
When we asked users how long it typically took to get on-premises infrastructure set up, the common answer was two to three months to complete the paperwork and approvals, order hardware, accept delivery, identify a physical location for the new hardware, get it racked, networked, properly cooled and powered.
Conversely, with the cloud, setting up a new application or infrastructure can be done in hours -- if not minutes -- with ready-to-go services from AWS, Microsoft or Google.
Cloud Smart provides guidance on standards and approaches that can streamline and accelerate the procurement process without sacrificing security. The idea is to provide agencies with a quick turnaround in a world where everyone expects rapid results.
The processes championed by Cloud Smart can give public-sector agencies the chance to enjoy the primary benefits of the public cloud -- greater scalability and flexibility -- more quickly. With the cloud, agencies can spin up and tear down compute resources when they need them, giving them more agility and scalability to meet increased demand rather than procuring and installing physical infrastructure.
Take, for instance, healthcare.gov. During annual open enrollment, the federal government scales its systems to process significantly more web traffic. This past November, more than 2 million Americans enrolled in health care insurance plans, with approximately 700,000 people each week signing up. After open enrollment, the site will be scaled down to accommodate a significantly lower number of users -- a testament to the flexibility of the cloud.
Workforce
A January 2019 Gartner report predicted a significant shortage of experienced and trained cybersecurity experts by the end of 2020.
With the cyber skills shortage, it’s important agencies ensure existing staff is properly trained in the basics of cloud cybersecurity and training is consistently refreshed. The cybersecurity landscape is continuously shifting, with enterprising hackers deploying new tactics such as “vishing,” where AI is used to mimic voices of executives to perpetrate cyberattacks. Staff should be always be learning about emerging tactics and threats.
IT staff should also be encouraged to talk to their colleagues about best practices for cloud migration, scaling and securing sensitive data. When employees are unfamiliar with the nuances involved in working in cloud environments, it’s often helpful to complement training with insights from outsiders who can share their cloud expertise.
While migrating systems to the cloud can give agencies the flexibility to easily scale their systems up and down to manage spikes in demand, they must focus on Cloud Smart’s three key pillars of security, procurement and workforce to ensure a smooth, secure move to the cloud.