As cloud migrations accelerate, agencies face new threats

Prior to the COVID-19 crisis, many government agencies had begun to implement strategic cloud migration projects, but progress on these initiatives had been measured due to cost and security concerns -- as well as the complexities inherent in moving data from legacy systems to state-of-the-art cloud environments.

As the pandemic hit and work-from-home mandates went into effect, however, many agencies were forced to speed up their cloud migrations. This massive acceleration introduced additional security vulnerabilities and increased agencies’ attack surface even as hackers rolled out coronavirus-related exploits, from phishing emails to ransomware.

The impact of COVID-19

The need to immediately provide remote access for the vast majority of the federal workforce created an unprecedented challenge. Agencies were often forced into a “done is better than perfect” scenario in which employees worked on personal computers, smartphones and tablets (many of which might also be used by their children for remote schoolwork or entertainment) and connected to the internet over unsecure home Wi-Fi networks.

Under these circumstances, it is much simpler, quicker and more effective to set up secure cloud access than to try and expand existing software VPNs -- which may or may not be compatible with the wide array of devices and operating systems on personal devices -- so that government workers and contractors can access data behind agency firewalls. However, a rushed cloud migration poses some unique risks.

Typically, when an agency is planning a large cloud migration project, it begins by setting up a test environment with a small number of beta users -- starting, for example, with 100 test users of Microsoft 365 and SharePoint who all have access to files contained within that SharePoint instance. This is fine during a small test because the SharePoint data wouldn’t be sensitive. If that test environment was suddenly pressed into service for a larger audience in response to COVID-19, however, user roles or permissions might not all get changed, and anything added to that SharePoint instance could be accessible to all users.

From endpoint protection and access control to a new model

Government computing networks are complex ecosystems that include the core network where data is stored, as well as branch offices, mobile and remote end users, internet-of-things devices and even multiple clouds.

Most agencies have historically approached network security by using on-premises VPN infrastructure to ensure that only authorized users and endpoints can gain access to data behind a firewall. Securing this type of ecosystem, when it moves into the cloud, requires a different approach.

Fortunately, platforms like Microsoft 365 have a number of built-in security features, and a wide variety of third-party tools can address issues like identity, configuration and compliance management. But they must be deployed correctly or they risk leaving the very network they are designed to protect vulnerable to attackers.

Government IT teams have vast experience with on-prem technology, but that expertise does not necessarily carry over into a new cloud environment. With an inexperienced staff, controls might be misconfigured or software updates overlooked, increasing the attack surface.

A successful solution depends on people who are knowledgeable about the cloud tools they are working with, and that means getting government IT support teams trained and certified, something the current accelerated timeline might not allow for. Alternatively, agencies can to work with consultants who have specialized expertise; however, procuring these types of services takes time and can drive up the cost of cloud migration projects.

Which agencies are most at risk?

It stands to reason that any agency handling data at the controlled unclassified information level and above must be especially vigilant about implementing a secure cloud environment. Not all agencies, however, have sufficient, dedicated funding to support the development of a rigorous cybersecurity posture for the cloud, let alone the expertise required to implement it correctly. In the rush to support a remote workforce, some agencies that considered themselves to be at low risk may have sacrificed security to quickly stand up cloud-based remote access, leaving their systems vulnerable to attackers.

In addition, there are risks with the vast number of legacy devices that aren’t compatible with modern cloud security software, such as software-defined perimeter agents, but must still remain connected to the network. Additionally, there are hundreds of thousands of contractors and consultants that government depends on but are beyond its ability to control from a cybersecurity standpoint.

Finally, as employees come back to the office, the flexibility and access they enjoyed while teleworking will inevitably come to an end. Recalling those rights will be challenging, but the bigger issue will be rethinking the way the government approaches the development of a secure remote work environment and balances security with flexibility as it continues its march to the cloud.

What is the path forward?

Migrating government to the cloud will not happen overnight. It takes time to move data, configure new systems and train staff to use those systems properly.

Solutions like hardware-based VPNs and virtual desktop infrastructure can fill an important role in securing network access for the disparate endpoints that make up the government IT ecosystem while agencies navigate the transition to what will eventually become the new normal.

There is no doubt that the post-COVID-19 world will look very different. Government workers will be more remote and mobile, and the cloud migrations that accelerated during the pandemic will continue to move forward. This new paradigm will make it more important than ever to create a seamless and secure government IT ecosystem that supports collaboration while also safeguarding our nation’s most sensitive data.