Accelerating digital transformation with advanced security

Digital transformation is having a significant impact on every sector of our society. Like their private-sector peers, federal agencies are looking for ways to streamline systems, implement more effective business applications and improve the way they interface with employees and American citizens. That involves retooling networks, applications and devices.

In the push for transformation, nearly half of all federal agencies have now moved to significant operations to the cloud. Some agencies, like the Departments of Interior and Agriculture, are looking at the advantages of implementing software-defined wide-area networking for their thousands of remote offices. And those responsible for the collection and analysis of massive amounts of data are increasingly exploring ways to integrate artificial intelligence into their analysis and work streams to increase productivity and efficiency.

Of course, digital transformation at the federal level doesn’t look exactly the same as it does in the private sector. One of government challenges is that not all new digital tools meet the regulations and requirements by which agencies are bound. The fundamental requirement for data sovereignty, for example, has resulted in agencies adopting private cloud solutions at twice the rate of public cloud.

Security and privacy top the list of adoption barriers

It should come as no surprise that security and privacy issues continue to be the biggest barriers to digital transformation as agencies look to strike a balance between making changes to their digital architectures and protecting critical resources. And that caution is well founded. New networking environments and resources expand the potential attack surface, and many of the legacy security systems in place simply can’t scale to secure these new environments. According to the Fortinet security threat report for Q4 of 2018, organizations undergoing digital transformation are being targeted with malware designed to attack new network environments and devices and exploit the gaps between isolated security deployments.

In that same report, half of the top 12 exploits identified targeted internet-of-things devices, largely due to the inherent security weaknesses of many IoT devices. However, four of those top spots were held by IP camera exploits, which is a much more alarming. As the physical and cyber environments begin to merge, bad actors are developing ways control the very IoT devices used to monitor physical safety and security. Access to IoT IP cameras enables cybercriminals to snoop on private interactions, conduct malicious onsite activities (such as shutting off cameras to cloak physical access to restricted areas) and leverage them as a gateway into the systems to launch DDoS attacks, steal proprietary information, initiate ransomware attacks and more.

This is part of an overall and continuous trend in malicious cyber activities. The attack surface of today’s networks is growing at the fastest rate ever, and the goal of cybercriminals is to target every expansion of the network. Evidence of that that is shown by the number of exploits detected per organization in Q4 having grown 10 percent, while the number of unique exploits, i.e., new attacks designed for a specific target, increased 5 percent.

Security efforts just aren't keeping up. Botnets, for example, which have been responsible for some of the most severe cyberattacks in history, have now become more complex and harder to detect. The amount of time that botnets can dwell inside a network without being detected increased by 15 percent in Q4, growing to an average of nearly 12 infection days per organization.

The rise in the use of social media, most notably Twitter, has also created a new avenue for attack. This last quarter, security professionals recorded a new twist on an old threat, steganography, which involves embedding code or data into a photo or video file that can then be delivered by messaging, email or social media. The image's malicious code is then deployed when it arrives at its target. Most malware of this sort can be detected once it begins to communicate with an outside command-and-control server looking for attack instructions. But these new files, currently being distributed via Twitter, are programmed to search for other compromised images that contain embedded instructions to direct and propagate malicious activity. It's a clever approach that has managed to circumvent many traditional security tools.

Part of the reason that cybercriminals continue to maintain the upper hand is that they are relying on many of the same digital transformation technologies and techniques being deployed elsewhere, but with a single goal in mind. As these entities leverage things like automation and machine learning to propagate attacks, bypass traditional security and discover gaps between isolated security deployments, departments and agencies must likewise leverage digital transformation elements to combat these advanced attacks.

Building security to enable digital transformation

One way federal agencies can start is by establishing security protocols designed to protect connected physical systems from attack. This includes segmenting physical devices connected to an IP network, baselining and whitelisting behaviors and setting alerts and quarantines that are automatically triggered when behaviors change. In this new interconnected world, security cameras are merely the canary in the coal mine. Criminals that gain access to things like fire suppression systems, badge readers and even HVAC systems could potentially cause catastrophic harm.

Additional networking and security strategies that must be adopted include:

• Segmentation across networked environments that agencies may or may not have full control of, such as public clouds and new 5G services, to protect wide-ranging workflows, transactions, applications and data.
• A single, edge-to-edge security entity that expands seamlessly from the core network out to branch offices, mobile end-users and IoT devices and even across multiple public clouds. To do this, all devices connected to the network must be identified and rated, and their state continuously confirmed. Then, once effective visibility and control solutions are in place, all requests for access must be verified, validated, authenticated and tracked.
• Support for and adaptation to elastic, edge-to-edge hybrid systems that combine proven traditional security functionality with new technologies and strategies and can operate seamlessly across and between multiple ecosystems. 
• Intentional interoperability that enables information sharing to better stop threats must replace the traditional “accidental architecture” of disparate security tools. This change will require the selection of tools that have integrated Open APIs into their solutions, that support vendor-agnostic management tools to centrally orchestrate widely distributed security policies and that support emerging requirements such as new open 5G security standards.

An integrated strategy is best

To accelerate the adoption of critical digital transformation strategies and solutions, federal agencies must adopt open standards and common operating systems internally. This is the only way to ensure consistent interoperability between security technologies, especially across evolving, expanding and increasingly interconnected networks.

Combatting the threats introduced by digital transformation requires correlating event data, sharing real-time threat intelligence and supporting automated incident response -- all of which require security technologies to be deeply integrated. At the same time, ensuring the growing performance and interconnectivity requirements of today's digital society also requires a holistic security architecture that can leverage machine learning, artificial intelligence and automation to accelerating decision-making and close the gap between detection and mitigation.