Mitigating government's risks in a cloud-based world

Government organizations are seeking the benefit of cloud-based collaboration and have put cloud-first initiatives front and center. In fact, more than 70 percent of state government CIOs are cloud first, and local governments continue to adopt software-as-a-service offerings. On the federal level, the Data Center Optimization Initiative is driving agencies towards the cloud.

SaaS technology gives government organizations more IT agility than on-premises management and maintenance allowed and lets them rapidly scale up or down as their needs change. Collaboration tools such as G Suite (formerly Google Apps) and Microsoft Office 365 have also produced great productivity gains for government agencies. SaaS applications like these and others reduce the need for on-premises management of application storage, updates, patches and maintenance, freeing IT to do more even if budgets restrict adding staff.

For all its benefits, however, this shift to the cloud and SaaS apps does not come without risks. The biggest risks to agencies don’t generally originate from the SaaS vendor’s infrastructure, but from the new division of responsibilities arising from deploying SaaS applications.

Before the advent of cloud computing and SaaS applications, IT was responsible for managing everything in the technical environment, ensuring that data management aligned with regulatory requirements, organizational governance and defined controls. Ultimately IT must also meet the agency's need for business continuity -- including backing up SaaS data in a way that facilitates a fast return to operational readiness.

And while the adoption of SaaS and cloud technologies does not remove IT responsibility for data protection, the shift may obscure areas of risk. This is particularly important since SaaS and cloud vendors -- while secure and resilient to their own infrastructure failures -- cannot fully protect organizations from the three biggest risks:

• Human error. Aberdeen Research notes that 64 percent of all data loss is caused by human error, which includes misconfiguration of retention policies, improper data uploads that overwrite good data with bad and accidental deletions by end users.

• Programmatic errors. Both sync errors and integration errors can overwrite or delete good data. These issues are common across SaaS apps including Office 365, Salesforce and G Suite.

• Malicious activity. Government sysadmins are familiar with the risks posed by disgruntled employees and are increasingly familiar with government ransomware attacks. (WannaCry, anyone?) The central issue for those using collaboration apps such as G Suite and Office 365 is the “folder grenade” -- when a document or email is shared, and the ransomware encryption spreads from one shared folder or document through every shared folder or document, at compute speed. This may have been why the malware lock-out spread so quickly through recent victims’ systems.

Data changes initiated by authorized users, or those that appear to be authorized users, are implemented by the SaaS provider because they appear to be legitimate, intentional actions --  even when they’re not.

Given that a government organization’s admins and end users are more likely to be a significant source of risk to its SaaS data, here are some steps to take in order to mitigate that risk:

Teach end users how to be “phishing proof” regarding SaaS data. To effectively educate employees, establish basic security practices, policies and rules of behavior for how to handle and protect customer information and other vital data. Security is everyone’s job, so the people aspect of it must be addressed -- not just the IT aspect.

Limit access to admin rights. Organizations must ensure that only the right people have the right access to the right data. From a data security perspective, organizations must also understand what data they have and how important it is -- essentially classifying the data -- so that the right controls are put around it. Leveraging protective technology is critical as well, ensuring that both internal and external threats cannot shut down an organization’s service or breach the walls they’ve put in place.

Ensure SaaS data is safe, backed up and quickly restorable for business continuity needs. Whether data is stored on-premises or in the cloud, organizations must make sure that they can restore access to data quickly and efficiently after a security event. Backup and recovery technology helps organizations protect and restore data quickly. Here are some questions to ask when evaluating options:

• Can the vendor perform fast, accurate, point-in-time restores and do so at scale?
• Does the vendor disclose the location for data backups, and does that location meet data sovereignty and compliance regulations?
• Has the vendor successfully completed the SSAE 16 SOC 2 audit certification process, a rigorous evaluation of the repeatable operational and technical controls?
• Does the vendor protect data at rest with 256-bit AES object-level encryption?
• Does the vendor compartmentalize and limit access to the production environment, only granting access to named employees who have specific operational requirements?

From there, making improvements to recovery plans and communicating the impact of the event are key.

Develop and document a response and recovery plan. Agencies must be prepared for a security attack. The initial focus should be on removing the threat and continuing business operations. Then, agencies should focus on communicating the event to constituents, conducting analysis of what happened and undertaking improvements to further mitigate risk and reduce the business impact of the next event. Cybersecurity insurance may help agencies respond with notification requirements, third-party damages and lost funds.

Like most technology advances, moving to the cloud provides considerable benefits while shifting the responsibility for risk. Understanding the risks allows organizations to protect themselves while taking full advantage of the SaaS applications to increase agility, scalability and IT team productivity.