5 security strategies for a distributed DOD

Telework is changing the way the Defense Department works -- and calling for new ways to protect data and provide secure user access. The world was already trending to a work-from-anywhere environment with mobile users and applications delivered through the cloud, but the global pandemic is serving as a driving factor, accelerating digital transformation.

Logically, defense agencies have traditionally restricted telework. Employees and contractors could access classified information only while on site. However, with a more pressing need and evolving technology options, DOD now has new opportunities to develop a remote work strategy that supports access to more sensitive information for employees working outside of the Pentagon.

“We are confident we will rise to the challenge by leveraging our innovative ecosystem,” DOD CIO Dana Deasy said in late July as he discussed pilots to improve the security of the current Commercial Virtual Remote Environment. However, “when you move to cloud … the adversary is going to pivot and try to exploit,” he said.

As defense agencies continue to move to the cloud and grow their telework environments, they need a more holistic security model to secure sensitive data across clouds and data centers, while protecting users and devices in any location.

Defense agencies looking to secure a modern, distributed IT environment and keep their missions moving forward amid maximum telework should consider these five key attributes:

1. Zero attack surface

Traditional, legacy appliance-based remote-access technology, such as virtual private networks, place users directly on the DOD Information Network. This significantly increases risks and often provides poor security controls and visibility for IT administrators responsible for managing and maintaining the environment. In addition, traditional firewalls publish applications on the internet, so they can be found by users -- and by bad actors. 

Instead, with a zero-trust architecture, users are never placed on the network, and applications are never exposed to the internet. This creates a zero attack surface, protecting agencies’ sensitive information from the malware and ransomware threats and successful VPN attacks that have been increasing over these past months.

With strong identity and access management, zero trust facilitates a dark network or “inside-out” connectivity. This means that applications are invisible to unauthorized users. Only authorized users are given access to authorized applications.

2. Connect a user to an application, not a network

In a zero-trust architecture, agencies can provide precise access to cloud-based applications. Zero trust means an organization does not inherently trust any user. Trust must be continually assessed and granted in a granular fashion. This allows the DOD to create policies that provide secure access for users on any device, in any location. 

As data is spread across multiple clouds and data center locations, agencies must shift the focus to connect the user to an application, not a network. Users should only be given access to resources and applications necessary for their job functions. This can further limit east-west traffic on the network so that users will not reach applications they were not intended to access.

Zero-trust network access solutions prevent unsafe connections and attacks that spread across an organization with simple policies that are user-centric, rather than network-centric.

For example, a user connecting from a government-furnished laptop and running a strong endpoint detection and response solution and authentication technology can access a sensitive application. Yet an agency can restrict access for that same user if he is connecting from a personal device.

The direct-to-cloud connection through zero trust also eliminates the hairpinning caused by backhauling traffic through a VPN, decreases traffic and reduces latency – ultimately, improving the user experience. 

3. Multi-tenant architecture

The pandemic has increased focus on facilitating secure data sharing and providing collaboration tools for remote workers so they can continue be productive. A multi-tenant cloud architecture is ideally suited to provide these capabilities.

A multi-tenant architecture, built from the ground up, eliminates the need for security stacks, allowing users to share resources efficiently, while securely scaling to meet increasing demand. Despite the fact that they share resources, cloud users aren't aware of each other and their data is kept separate, providing the necessary reliability and privacy the current IT environments now demand.

Many defense agencies’ initial reactions to the current crisis have been to grow capacity by implementing new infrastructure or adding new appliances. A cloud-native multi-tenant architecture, however, is the only solution that can easily scale up and down as needed when future continuity of operations scenarios arise.

4. Proxy architecture, not pass-through 

A cloud-based proxy architecture lets defense agencies easily scan all encrypted traffic to check for data exposure and threats without extra cost or degradation to performance, which ultimately results in reduced latency and improved user experience.

This allows agencies to provide a more proactive approach to security with machine learning to scan for threats in real-time and actively prevent malware and other attacks from occurring. 

With applications and data widely distributed across multiple cloud providers and SaaS vendors, it is imperative that data exposure risk is measurable and automatically remediated.

5. Secure-access service edge (SASE)

SASE is an identity-based security perimeter that allows users to connect to their data and clouds securely from any location.

Rather than focusing security perimeters around applications, SASE flips the security model to secure the user and data. It allows agencies to move security functions to the location of the users and applications to the cloud. 

The next evolution to secure DOD networks is embracing a SASE model and moving essential security functions – such as web gateway firewalls, zero-trust capabilities, data loss prevention and secure network connectivity all to the cloud. Then, federal employees will have direct access to the cloud, while security is pushed as close to the user/data/device as possible. Localized security reduces latency and improves security response times.

A true SASE will be an as-a-service model that provides simple, scalable and flexible edge capabilities. SASE can unify security functions, including secure web gateway and zero-trust network access. This reduces the significant cost and management overhaul that many agencies previously faced when adding security functions on top of current solutions to fill gaps across distributed architectures.

A security posture for the long haul

There is a new set of security requirements as DOD transforms the current Joint Information Environment to accommodate modern networks, mobile users and advanced threats. 

As defense agencies become more distributed than ever and employees need secure access to sensitive and classified information, it is critical agencies can deliver a holistic security posture to meet missions for today and the future.