Adopting a Secure Digital Business Model at Your Agency

This interview is an excerpt from GovLoop’s recent guide, Innovations that Mattered in 2016. Download the full guide here.

In the past few years your agency has probably undergone some efforts to modernize and secure your infrastructure. Whether you’ve upgraded networks, updated servers, or started moving systems and data to the cloud, it’s likely that your agency’s IT department is working hard to improve your cybersecurity posture. However, funding limitations may only allow piecemeal updates, allowing improvements for certain aspects of IT infrastructure, and making it easy for critical upgrades to fall through the cracks.

Adopting a secure digital business model is one way that agencies can ensure they’re taking a holistic approach to driving agility and mitigating risk. To learn how agencies can more acutely move from a traditional model of business to a secure business architecture, GovLoop sat down with Raj Rana, Director of Federal Systems Engineering at Cisco, a leader in networking and cybersecurity.

The traditional business model that many agencies follow reflects the alignment of their internal organizations, Rana said. Despite a strategic plan at the executive level, many organizations drive their modernization efforts through siloed execution. The digital business model is a framework that agencies can adopt to drive greater agility, while preparing their infrastructure for a digital future. “The concept of secure digital business recognizes that IT continues to expand into the mission space, and allows IT to grow, regardless of the technological mission requirements,” Rana explained.

By reassessing how IT is being used, your organization can begin developing a holistic approach that effectively helps drive your agency’s mission. When taking something that is core to your mission and modernizing it, security and infrastructure implications are critical.

As the use of sensors continue to expand, whether in vehicles for agencies like the U.S. Postal Services, or out to the flight lines of an Air Force base, the amount of data being created, transmitted and stored across government IT infrastructures is growing at a historic rate. Many of these data sources are being used to influence or drive decision matrices. Therefore, the need to secure communications is critical, to ensure that the data they provide is valid. Additionally, the number of sensors on the grid expands potential threat vectors, rendering traditional methods of network monitoring invalid. It is necessary that digitization, security, and a supported infrastructure work together to foster modernization.

With increased modernization, agencies are also confronted with an increase in the sensors driving data streams coming into the IT department. Consequently, standards must evolve alongside the technology in order for agencies to make meaning from the data and facilitate digitization. As the industry works to define a data standard, Rana explained that Cisco advocates an open approach for both data and transport. This means that Cisco standards will support multiple transport standards, including Bluetooth, Wi-Fi, LoRaWAN or cellular and work to normalize data either at the edge of the fabric, or at the core. This allows Cisco to support all networks at a level of analysis that gets the same value from disparate data streams, as well as ensure that analytics can be conducted where it provides the most value.

Automation is a critical component of modernization. “Overall, automation is critical, in order to reduce operational issues, such as typographical errors, or missed configurations. However, at the next level of automation we are looking to drive greater awareness of the devices connecting to the network, thereby allowing the network to drive self-segmentation, rather than the network admin,” Rana said. Employing automation efforts allows agencies to standardize more quickly, foster agility in an environment of complexity and allow IT to shift from operations to the mission.

Ultimately, Cisco is looking to evolve the security conversation from point solutions to a secure and integrated architecture that supports and reinforces itself. ‘Security Everywhere’ is Cisco’s philosophy that recognizes that security is more of a discipline and a mindset than it is a product. This doesn’t mean that products aren’t necessary but rather than relying on them alone, the model integrates security across the infrastructure, creating a protection profile analogous to an immune response. If an incident occurs in any point of the infrastructure, the entire environment is inoculated.

As agencies move forward in implementing a secure digital business architecture, it is crucial to remember that doing so is a journey not a one-stop solution. Looking forward, Cisco is dedicated to partnering with government IT employees to securely drive agility. “Driving sustained innovation and security is significantly complicated without an integrated architecture,” Rana concluded, “and industry has a role in helping the government solve that problem.”