Hybrid and multi-cloud computing is the future of the federal IT service infrastructure, but the complexity of these environments can create significant challenges and security vulnerabilities for agencies. Here’s how agencies can begin to overcome those challenges.
Cloud computing is the future of the constantly evolving federal workforce. To allow for seamless integration with mission systems requiring data proximity and on-premises hosting, many agencies are adopting hybrid and multi-cloud (HMC) environments to help push their capabilities forward while still supporting legacy applications and mission critical applications.
While HMC can easily accommodate mixed workload portfolios, its complexity can present significant security, cost, reliability, and performance challenges to already-strained IT departments. This raises the question of how agencies can fully maximize the benefits of cloud computing at speed and scale, without further burdening their IT teams.
“There’s a huge mix of different cloud platforms and application services provided by leading cloud service providers,” said Gary Wang, vice president, Cloud and Application Services for Peraton, which delivers transformative enterprise IT solutions to government agencies. “From a security, governance, productivity and cost saving perspective, managing an HMC environment has become a big challenge.”
Here Wang and Harry Kidder, Peraton’s director, Cloud Technology, discuss the challenges agencies face with HMC management and how hybrid multi-cloud management and zero trust solutions can streamline operations for mission success.
Challenges: HMC is a Double-edged Sword
HMC environments offer numerous potential benefits, including leveraging the most suitable cloud service features, applying the right environments for the unique application persona, achieving the most cloud cost savings, or avoiding vendor lock-in. While an HMC environment is meant to increase productivity and flexibility, it can be a double-edged sword for agencies that don’t have the capacity to manage complexity.
For a single organization, managing workloads spread across different cloud platforms requires a wide technical skillset in operational management — something Wang noted that agencies have historically struggled to obtain.
According to Wang, many agencies have essentially backed into situations where they are using multiple clouds without realizing that’s what they were doing, or how this could be a risk.
“If you look at how AWS adoption has been going in federal government—by itself, it requires a lot of dedicated practice and resources,” said Wang. “Now, when you throw Microsoft, Google, Oracle into this mix, it’s just getting more and more complex. When dealing with multi-cloud you need to have resources, skills, training, operation capacity, and maturity to manage different platforms.”
Challenges: The Security Struggle is Real
A challenge equally as daunting is keeping hybrid and multi-cloud environments secure. HMC architecture has taken data and workloads beyond traditional physical data centers and network perimeters to the open internet, which increases the number of potential attack vectors. According to Kidder, who spoke at NextGov’s 2022 Cloud Summit, this new security vulnerability has resulted in the need for a complete revamp for government cybersecurity practices.
“At any moment, you can have a different number of services running in a single environment,” he said. “Traditional security approaches and tools are no longer applicable in this highly dynamic and elastic environment.”
With cloud, where data can be accessed from anywhere, agencies must rethink how to mitigate cybersecurity risks. “The implementation needs to be a phased approach that takes into consideration the risk priorities, business asset value, budget, and operational maturity,” said Kidder.
Managing security in such complex operational environments, according to Wang, makes updating their technology and applications a constant struggle. “You need a software-defined infrastructure to ensure platform security. It’s a balancing act to protect these systems while modernizing because we want to protect data without sacrificing productivity.”
Solutions: Trust No One
Kidder is a strong advocate of agencies committing to protect their HMC with a zero trust framework that automates, simplifies, and secures cloud operations in one standardized, unified platform. As applications and services reach beyond traditional data center and network perimeters, a paradigm shift is required to safely mitigate and minimize risk.
“The ideal zero trust architecture is a holistic cybersecurity framework that applies rigorous security controls, network identity, application services and data,” said Kidder. “It can also adapt to emerging technologies, as well as to emerging threats and the changing digital landscape.”
Peraton’s HMC management platform provides centralized automation, governance, and end-to-end workload lifecycle management across many cloud platforms. The platform can be fully equipped with their zero trust architecture (ZTA) as-a-service solution built with commercial and open-source technologies that continuously vet access to cloud services, configurations, threats, and security posture with AI-enabled automation, and provide fine-grained segmentation among services and resources so that risks can be localized, contained, and remediated rapidly.
Solutions: Don’t Forget Your Purpose
Because proper HMC management and security implementation can be an overwhelming and financially detrimental task, agencies rely on contractors with comprehensive expertise and a deep bench of talent to help them navigate the transition and ongoing management.
Kidder and Wang’s decades-long work in the field has taught them that every agency has specific cloud requirements. To avoid becoming overwhelmed and ensure they remain on the right track, Wang advises agencies to always keep their end state top of mind.
“The reality is that an agency is going to have a very complex environment,” said Wang. “It is going to have different offices that want to use different cloud environments; different network connectivity requirements; and different security requirements.”
“The key is to understand where you want to go,” he said. “From there, seek out the help, knowledge and tools necessary to allow you to be successful in this cloud journey. Otherwise, you can quickly lose sight and lose control of your HMC environment. And that won’t benefit anyone—you, your leaders, or the taxpayer.”
Learn more about how Peraton can help you successfully manage and secure your HMC environment.
