IT Modernization is Finally Coming to Federal Agencies

The Department of Homeland Security describes Phase 4 of its Continuous Diagnostics and Mitigation (CDM) program in just 36 words. But even that may be too long.

Phase 4 is about data protection. How agencies go about it comes down to them.

As we discussed in our recent blog focused on CDM Phase 3, these final two phases of the program bear little resemblance to the first two. Phase 1 (what is on the network) and Phase 2 (who is on the network) set baselines with the goal of slightly improving federal security across the board.

Both Phase 3 and Phase 4, though, provide agencies the ability to be creative and to implement innovative solutions that make a real impact. While addressing Phase 4 may ultimately still be a while away for most federal agencies, now is the time to start planning, especially since the requirements dovetail nicely with the White House’s current IT modernization effort.

CDM and Modernization

The Modernizing Government Technology (MGT) Act will provide federal agencies with $500 million over the next two years to update legacy systems. The act, alongside the American Technology Council’s “Report to the President on Federal IT Modernization” calls on agencies to use new technologies, such as cloud computing, to replace older systems that impose an increased security risk.

The recommendations also place a focus on agencies to modernize the Trusted Internet Connections (TIC) initiative and National Cyber Security Protection System (NCPS) program to better enable cloud migration. This is important because current security architectures, such as TIC gateways, EINSTEIN and others, were designed at a time when the government’s approach to security was a hardened perimeter that delineated a “trusted” network boundary.  As today’s IT environment evolves toward the use of cloud services, including Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS), the hardened perimeter approach no longer applies.

Cloud technology can provide agencies with enhanced capabilities at a lower cost and, if done properly, can be secured more effectively. The challenge for agencies, though, will be to step out of the traditional security approach that has driven the federal government for decades. Traditionally, federal agencies could focus security defenses on the network perimeter itself, but cloud computing eliminates the network boundary, requiring agencies to focus security efforts on the data.

Updating the TIC

The TIC was created to “optimize and standardize the security of individual external network connections currently in use by the Federal Government, to include connections to the Internet.” The policy has been updated over time to address additional connectivity considerations, but with this new boundary – as noted above – the current version is no longer sufficient, which is why the IT Modernization Report is calling for an update.

Improving the current level of inspection provided by TIC, while adding the capability to gain complete visibility and control at the data layer, should be the main focus for government agencies – enabling them to meet both Phase 4 requirements and adhering to established modernization goals. 

How to Protect Data

By protecting the data – opposed to a set network – agencies can ensure that data remains secure no matter when or where it is being used. To protect data, agencies need to look at implementing enterprise-wide security solutions that can follow the data from on-premise infrastructure to the cloud and beyond. Modern capabilities open up the visibility of the data to understand the users accessing the data, knowing what that data is (classification or sensitivity) and where the data is.

This modern approach must accommodate web applications and messaging security, as well as address any “other” protocols while providing government-wide situational awareness and understanding. It must also incorporate legacy applications to consolidate attributes for intelligence government-wide.

Seize the Opportunity

Today’s federal agency resembles other modern work environments – employees are no longer tied to a single workstation. CDM Phase 4, and the larger IT modernization effort, has these same goals in mind. To take advantage of these two programs, agencies need modern technologies that can keep data secure no matter where it lives. The convergence of CDM and modernization provides a real opportunity for federal agencies to go beyond baselines, using the process to make strong improvements to cyber security that will have a major impact now and into the future.

If you found this information useful, you may also enjoy these other blog posts:

• Continuous Diagnostics and Mitigation
• New DHS Program Presents Security Opportunity for Fed Tech Leaders
• Cyber Security Now a Priority in Fed Government’s Modernization Initiative