A security solution that's simple for government, tough for attackers

Over the last few decades, the U.S. government created more than 100,000 custom digital applications. These apps continue to serve different purposes and live at different levels within the government -- spanning teams, departments, organizations and even entire agencies. At a federal level, the government manages terabytes of both anonymized and personally identifiable information (PII). But with such a mammoth amount of information, how does the government keep its data safe?

Many government agencies are using an obsolete form of full-disc encryption, where data at rest simply requires one- or two-factor login credentials. The entire disc is effectively on lockdown instead of the data contained within. In a worst-case scenario, a rogue actor or nation state bent on committing espionage needs only to compromise one point of entry before hitting a metaphorical jackpot of PII. We saw this unfold when 22 million federal employees’ data was stolen by Chinese hackers during the infamous OPM Data Breach in 2015. Since then, federal agencies have been more adamant about modernizing their data security to avoid further damage.

While peace of mind can never be fully realized within the ever-changing space of cybersecurity, we can move toward a more data-centric approach where security is embedded at a more granular level. Format-preserving encryption has been widely adopted by retail and finance industries, but the federal government now recognizes the importance of this continuous form of data protection that reduces threats from insiders, malware and advanced attacks. Unlike its predecessor, FPE can’t be reverse engineered. It secures data in motion, in use and at rest -- all in accordance with Federal Information Processing Standards.

Beyond the security advantages, FPE could enable more collaboration among numerous, siloed agencies to identify short- and long-term trends. For instance, the Centers for Disease Control actively collects countrywide health data to identify any possible epidemics, illnesses and other outbreaks. But the CDC isn’t the only entity that could benefit from the same data. Sharing secure information positions data as a key driver of digital diplomacy -- shifting constituents’ expectations of government agencies to be less reactive and more proactive. Additionally, the advanced security built into FPE protocols even offers the ability to share non-PII information publicly. This kind of transparency not only enables societal progress but keeps the government accountable for the security and accuracy of the data it collects.

But let’s step back from this utopic vision for a moment. Anyone who works in public-sector IT knows that legacy systems dominate the U.S. government -- including mainframes, physical media and other equipment unrecognizable to Americans under the age of 30. Congressman Will Hurd (R-Texas), the chairman of the House Oversight and Government Reform IT Subcommittee, referenced the security risks associated with legacy IT systems in his recently introduced legislation, the “Modernizing Government Technology Act of 2017.” According to the legislation, legacy systems “pose security risks, including the inability to use current security best practices, such as data encryption.”

It has been estimated that the cost of re-architecting more than 100,000 existing apps to meet modern security protocols would exceed $1 trillion. Fortunately, FPE is versatile enough for legacy and new systems alike. The ability to retrofit decades-old mission-critical datasets without having to completely overhaul the IT infrastructure can help federal IT leaders meet their security goals without going over budget. This also sets IT teams on the correct path as more and more government resources are added to public and private cloud environments.

There is no silver bullet when it comes to modernizing the way the government stores and shares data, but FPE is a smart approach in age of nefarious and sophisticated adversaries. Legacy equipment is something we all encounter, but it shouldn’t be viewed as an obstacle, but rather an opportunity to shift the paradigm from database to data-centric security. The systems may remain, but threats will evolve -- it’s up to us to ensure that the nation’s most sensitive data remains secure.