How government can securely leverage cloud environments

In recent years, federal agencies have made significant strides incorporating cloud computing into their IT portfolios.  From the OMB “Cloud First” strategy, to GSA’s Federal Risk and Authorization Management Program (FedRAMP), the government is following commercial best practices to leverage the cloud.

Cloud capabilities can be provided over the public Internet or through connections over private networks -- and government does both. Some agencies establish private clouds due to perceived risks of making data available over public channels. At the same time, they are moving toward greater use of the open Internet, including public clouds.

In many cases, the choice for agencies is not public or private clouds, but rather a blend of the two approaches – often referred to as a hybrid cloud – where Internet-based applications provide information into a system that sits inside agency firewalls. 

Since hybrid clouds span both the public cloud as well as the user’s private environment, and integrate with systems in each, consideration must be given to IT governance across the whole enterprise. Hybrid clouds blend public and private development, oversight and integration with other processes.

One of the interesting challenges of a hybrid environment is managing security. Securing data, applications and infrastructure requires addressing the system's public and private elements.

But moving to the cloud – even a hybrid cloud -- does not mean  relinquishing direct control of the IT infrastructure. In fact, cloud computing can provide an environment that is inherently more secure.  By centralizing data storage and governance in a comprehensive view of IT assets, clouds can actually provide better security at a lower cost than can traditional computing environments.

Hybrid cloud environments include elements that require more transparency (e.g., public, shared resources and open systems), as well as other elements (e.g., data-intensive internal storage systems) that call for greater protection against penetration.  A hybrid cloud inherently provides for different levels of security within the overall cloud environment, supporting private applications that run at the appropriate security level and supporting public and open applications. 

Both the public and the private components of a hybrid cloud must be managed with best IT security practices, including user access, identity management, applications, data and infrastructure. This approach has proven to deliver security for hybrid clouds efficiently and effectively up front, optimizing protection for different levels of  risk.

Moreover, by facilitating uniform management practices across a distributed computing environment, cloud computing can improve certain key security practices across hybrid environments, such as:

Detection. Using a hybrid cloud to integrate security nodes on the Internet and inside an enterprise into a comprehensive situational awareness picture can allow for better detection of new threats.

Remediation. Quick malware remediation is vital for cyber security – the less time the malware is present, the better the protection. The cloud allows IT managers to  more rapidly address multiple locations within an agency, as well as in the agency’s interfaces with public clouds, than the older model of having to load fixes manually into multiple machines. Additionally, patch management can be enforced much better via the cloud, especially for agencies with diverse asset management solutions and platforms.

Prediction. Increasingly, cybersecurity focuses on limiting the ability of bad actors to act in the first place. The cloud helps security teams identify machines that create and disseminate malware and quickly isolate those machines – blocking their ability to infect customer systems.

Data and device protection. Data breaches from lost or stolen devices, can be mitigated because the cloud provides for central storage of data with automated network analysis and protection.  If part of an agency’s cloud assets rely on mobile computing and a device is lost, the data and applications reside on those cloud assets and thus are not lost with the device.  Further, if the user has been allowed to load the data onto the device, IT managers can now disable access to that device and its associated data.

Finally, government and industry are collaborating to advance approaches to address security properly in a hybrid (or any) cloud environment.  The government continues to adopt risk-based security through initiatives such as FedRAMP and the Department of Homeland Security’s Continuous Diagnostics and Mitigation program, which both promote the monitoring of traffic that flows in and out of agencies over cloud-based applications. 

As the government embraces greater use of cloud environments, security will continue to evolve and mature, allowing agencies to protect information while adapting to these rapidly evolving computing models.