Work from home and cloud are prompting hard looks at security

It’s no surprise that the past year has seen increased attention in network security. The pandemic-driven growth in telework has brought with it growing security threats, and the continuing rise of ransomware attacks has agencies taking a hard look at their security protocols. Add in the recent Executive Order on Improving the Nation’s Cybersecurity, which calls for implementation of zero-trust initiatives (among other things), and the environment seems right for greater adoption of multifactor authentication and cloud-based access.

However, despite the clear advantages of MFA in securing access to important data, adoption lags considerably in the federal market compared with the private sector. The need for government to catch up in that technology will only increase, as the cloud continues to change even the most basic ways that agencies connect with users and stakeholders.

This position, and others, has been echoed in a recent threat survey report titled “Accelerated Cloud Transformation and Remote Work.” (Note: This report was commissioned by Thales.)

How COVID caught federal IT security off-guard

COVID-19 has driven permanent changes to the government workforce and has accelerated the adoption of the cloud as the requirements of pandemic isolation prompted both remote working and a re-examination of how branch offices are composed.

Unfortunately, a considerable number of federal agencies were caught without a plan when COVID-19 forced the work-from-home change. According to survey findings, over three-fourths of respondents said they were unprepared to some degree, and only 15% responded as having been “very prepared.”

Consequently, cybersecurity dangers are top of mind as these agencies navigate the hazards of working from home. Nearly half of respondents said they are “somewhat” concerned about the security implications in remote work, with 46% also saying that privacy and security were the most important investments during the pandemic. That was considerably more than those who prioritized investment in infrastructure/cloud (30%) and investment in distributed (hybrid) cloud (24%).

These responses suggest the federal government should work harder to deploy basic security solutions like MFA. The reality, however, is that even though zero trust and similar initiatives are being pushed by the current administration, MFA adoption is still lagging behind other security tools such as network and endpoint security in the enterprise.

MFA, encryption, key management and tokens: The tools of the security trade

In this year’s survey, 52% of federal respondents claim to have adopted MFA, versus 62% in the U.S. overall. The government would do well to benchmark against other industries where MFA and other identity-related security measures are becoming more common, such as retail and financial services.

Perhaps because of the sluggish adoption of MFA, less than half of respondents were “somewhat” confident of their current remote access security product to secure their networks from the risk of employees working from home. Most organizations still use VPN and VDI to access applications, with 40% using conditional access. Conditional access was followed closely by 37% using zero trust network access/software-defined perimeter or cloud-based access management.

As for the most-used choices to protect data in the cloud, encryption, key management and tokenization top the list. Just over one-quarter of respondents store more than half of their data in the cloud. More than half of respondents indicated up to half of the data that is stored in an external cloud is sensitive. What’s alarming about this is that 39% of respondents have experienced a data breach involving data and applications in the cloud. An even higher number (45%) experience a breach or failed an audit involving data and applications stored in the cloud in the past year alone.

Encryption in the cloud might be a more widely adopted means of securing data across networks, but for the fact that most organizations are using multiple cloud services. The most varied cloud usage is in software as a service, with 39% of respondents using more than 50 SaaS applications and one-third using 26-50 SaaS apps. That pattern of cloud usage could pose challenges for managing encryption keys across multiple providers.

Change is coming in the form of increased adoption of zero trust, both because of the work-from-home phenomenon and the recent White House executive order. Nearly one-third of respondents said they have a formal strategy embracing a zero trust policy, outpacing the U.S. with 25%. According to survey responses, organizations with a formal zero-trust strategy are less likely to have been breached.

What have we learned from all this? First, security strategies must be agile to respond the growing sophistication of hackers bent on breaching government IT systems. Nonetheless, as work from home and the cloud take root in the security landscape, these solutions must still be flexible enough to deal with the hybrid ecosystem of infrastructure, applications, data and users.

Cloud computing and hybrid environments add considerable complexity to good security strategies. Looking ahead, both security controls and security management will need to extend to cloud in ways prevent each cloud environment from becoming its own isolated realm.