Nimble thinking will galvanize federal cloud security

Nimble thinking affords organizations the ability to act and respond quickly amid evolving circumstances, and it’s key to both cloud adoption and capitalizing on cloud capabilities. Unfortunately, nimble thinking can be tough for federal agencies to integrate into operations that are subject to regulations and scrutiny. 

Federal agencies have made progress on cloud adoption, but as top researchers over the past few years have pointed out, many are still struggling. It’s hard to blame them; despite overtures around acquisition reform and contracting agility, too often decision-makers remain saddled with decades-old processes that treat security hardware as the same kind of resource as a fighter jet. Cloud security -- like IT writ large -- requires a different mindset. It’s all about investing in the future of security and embracing the promise of nimble thinking that will pay dividends.

Some federal agencies are making changes to foster nimble thinking, even within a heavily regulated system. One strategy their leaders employ is a crawl-walk-run approach, starting out with small wins by solving small problems and building progress from there. The Pentagon’s Defense Innovation Unit and the Department of Veterans Affairs are two agencies doing an admirable job practicing nimble thinking, even under tough restrictions.

Prototyping with DIU

Larger agencies can innovate and get around, or even work within, highly regulated and nearly 20-year-old acquisition policies via prototyping. The military in particular is demonstrating the art of rapid prototyping: look no further than the Air Force’s AFWerx and Kessel Run, the Navy’s NavalX, the Army’s Rapid Capabilities and Critical Technologies Office, or the Pentagon’s Strategic Capabilities Office and the DIU. 

The DIU is focused on rapidly adopting, fielding and scaling commercial technologies for national security, including using prototyping to solve mission-specific challenges. In 2020, DIU partnered with a handful of vendors to find an alternative solution for commercial cloud access; under existing security architecture, controlled information can only be sent through DOD’s two secured cloud access points, operated by the Navy and the Defense Information Systems Agency.

In a time when remote and cloud access is a necessity, this initiative allowed DIU to test how it could streamline the flow of DOD information to and from commercial cloud solutions while also safeguarding controlled information. Resolving cloud access bottlenecks today will improve data-sharing and network operations across DOD agencies in the future. Changes will not happen overnight, but these sorts of prototypes can help federal agencies progress from crawling to walking and running toward the cloud.

Unifying solutions at the Veterans Affairs

In many cases, nimble thinking in the federal sector relies heavily on adapting to evolving technology trends. The VA, for example, is spread across the country and remains mostly “on-prem” in terms of data storage and security. In recent years, however, the agency has mobilized a focused team targeting cloud-first initiatives and broader adoption -- a move that’s already helped improve veteran access to services and accelerated progress toward the VA’s goal to migrate 350 applications to the cloud by 2024.  

With so many apps moving to the VA’s enterprise cloud, securing them -- including their functionality, their data, their operators and other elements -- becomes a challenge, especially doing so in a way that doesn’t overwhelm a security operations center. 

This is a scenario that easily encompasses hundreds of different apps from different providers, all speaking different languages and requiring different management. Through industry partnerships, the VA has been unifying multiple solutions and apps under a single console that can more efficiently monitor and manage everything. This has been especially helpful in the VA’s efforts to align with the Trusted Internet Connections (TIC) 3.0 guidance aimed at flexible cybersecurity that can be tailored to agency-specific circumstances.

Cloud-ready: Are we there?

While it can be challenging to think nimbly about security in highly regulated federal agencies, if the right people are pushing for it -- with the right technology partners that clearly understand their needs -- change is possible. The cloud solutions that are transforming these organizations link back small fixes for problems -- inching agency solutions toward the cloud. 

Sometimes this means prototyping high-level cloud access points. Other times, it’s as simple as making sure the sensitive data inside cloud apps, or even in visitor internet access, stays safe. Today, this is most effectively done through partnerships and commercial technologies, such as a TIC 3.0-compliant data loss prevention solution. 

Progress might be gradual, but it’s still forward momentum. It leads toward a better, more cloud-enabled future. With verifiable progress, even if it’s small and incremental, comes the necessary buy-in from leadership that effects much bigger, more comprehensive change. That’s when nimble thinking becoming the rule, not the exception.

Editor's note: This article was changed March 17 to clarify that the VA's security and storage services remain mostly on-prem and on March 18 to more accurately describe VA's cloud team.