It's time to move beyond the traditional VPN
- By Stephen Kovac
Although federal employees have been using virtual private network technology to access their networks for several decades, VPNs carry heightened complications. They are expensive and complex and can expose sensitive federal data to increased security risks. Plus, VPNs provide a poor user experience, especially for mobile employees.
So, how can feds get a more secure and efficient solution?
Today, connections work like this: To access a remote site, federal users must use a Trusted Internet Connection. The journey starts with an open internet connection and a VPN client. The request is sent back through the agency data center, through a stack of on-premise security devices, and then out through the TIC, where it traverses another stack of security appliances to its final destination, such as the open internet or cloud-based services. To return the data to the user, the process runs in reverse.
Because users cannot traverse seamlessly between clouds, this laborious process is repeated when they leave one destination and head to another -- even if both are compliant with the Federal Risk and Authorization Management Program. This process is taxing on IT administration teams because it requires constant maintenance and upkeep to align with federal TIC regulations.
Additionally, traditional VPNs provide federal users with an extremely poor user experience. Not only is the access process slow and inefficient, but users have no control or visibility throughout the process. The many appliances involved also increases complexity and costs – it is expensive to purchase, manage and maintain all required appliances.
While many agencies are facing challenges in terms of modernizing their VPNs, recent government IT modernization initiatives -- including the Cybersecurity Executive Order, the Modernizing Government Technology Act, and the Report to the President on IT Modernization -- are helping pave the way to a more efficient government. And, government telework opportunities are growing. For example, the General Services Administration has approved 90 percent of its workforce to work remotely.
To move the ball forward in an increasingly mobile world and keep up with the government IT modernization initiatives, agencies must find a way to enable secure, streamlined connections -- regardless of device or location.
In cloud we trust
Built to FedRAMP standards, cloud-based access services take an innovative approach that lets agencies route traffic directly to the cloud -- without requiring any hardware. The three core components of cloud computing -- the application, the broker and the connector -- enable a “trust-to-trust” approach, meaning a specific trusted user is connected to a specific trusted environment. Essentially, the broker acts as the policing force inside the cloud. When a remote user attempts to access an application, the broker determines if the user has the proper qualifications to access the application. Once the broker deems the user a trusted source, it finds the closest connector -- a small piece of software that connects to the user-application tunnel from anywhere -- regardless of location. This approach greatly reduces risk because it gives users specific access to specific applications, instead of access to everything. A traditional VPN, on the other hand, places the user directly on a network, increasing the potential risk for exposed data by magnifying the attack surface.
Further, this cloud-based approach allows mobile users to securely and efficiently access data on their smart phones, laptops, smart TVs and more. Cloud-based access services eliminate the need to use the TIC -- enabling a direct user-to-application connection, with no added roadblocks in between.
Additionally, cloud-based access services enable total visibility. Unlike a traditional VPN, this approach allows real-time visibility into user activity -- not after the fact – which greatly improves security. Agencies have more time to stop a potential cyber threat and ensure users' data is secure through a trust-to-trust connection.
With a FedRAMP-compliant access solution, agencies can accelerate cloud and shared services adoption in line with FITARA, the Cybersecurity EO and recommendations in the Report to the President on IT Modernization. This approach enables secure application migration from the data center to the cloud and from a legacy hub-and-spoke network to a modern direct-to-cloud architecture.
Currently, nine federal agencies are testing cloud-based access services for their employees, blazing the IT modernization path for the expansion of an efficient mobile federal workforce.
Traditional VPNs can expose sensitive data to increased risks; they are complex and expensive, and they provide a poor user experience. Agencies must take advantage of secure solutions that can accommodate today’s cloud-enabled, mobile workforce.
Stephen Kovac is vice president, global government and compliance at Zscaler.