Still, the more connections between platforms, the greater the potential for breaches. Security tools designed for one platform may not be able to protect the entire cloud ecosystem. Applications and data residing on different platforms create gaps in visibility—and potentially missed alerts—when security tools cannot communicate with each other.

Fortunately, there is a straightforward path to securing a multicloud environment. Building on governance, cross-platform technology, and engaged personnel, agencies can protect critical data and systems and empower users to move the mission forward.

Achieving multi-platform security in a Zero Trust world

The demands of the mission, classification levels, and compliance drive cloud security. Multicloud makes this more challenging, as Zero Trust protocols must be maintained even as users move from platform to platform.

This means that identity and access control systems must work across barriers and connection points—which is not always a straightforward task, considering the proprietary design differences between platforms.

The solution starts with the mission, followed by an understanding of what tools and resources are at hand to achieve its goals. Agencies should focus on:

1. Knowing what you do not fully know.

The larger the infrastructure, the more likely some key information or vulnerability is hidden from view. That is why step one in securing a multicloud environment is to fully assess and inventory your current digital estate:

• Sensor up: Ensure all sensors across the network are operating as expected. Look for anomalies that may indicate threat activity.
• Sweep in: Examine existing analytics and logs running across all cloud platforms. Again, look for anything out of the ordinary.
• Take inventory: Applications, databases, and other digital assets all need to be accounted for. It is also critical to assess security controls and ensure they are optimally configured.
• Prioritize workflows: Determine what processes and information need to be secured and to what level. Meeting mission needs requires effectively allocating limited resources.

Clear, comprehensive knowledge of the entire cloud infrastructure is absolutely necessary to develop multicloud security that works. But there is an additional factor besides technology that needs to be considered: people.

2. Activating a culture of multicloud security.

For multicloud security to succeed, it is critical to engage the personnel operating various mission workloads across separate units and different clouds.

Consider this: Zero Trust means using identity as a security perimeter. While technology makes this work, it is all based on users taking an active role in the process, which requires not only fixed rules but also enabling users across the enterprise to take an active role.

Too often, cybersecurity protects information while putting up barriers to productivity. In a multicloud environment, where it may be necessary to log in and out several times to complete a task, this could lead to workarounds, rogue subscriptions, and shadow technology. Equipping cyber teams with the tools to identify, understand, and resolve these kinds of issues is one key element—but it is just as important to ensure everyone becomes part of the solution.

Governance should support this as well. Not only should effective governance reflect policy and compliance with standards, but it should also consider:

• The urgency of mission goals
• The changing threat environment and how to respond
• The realities and limitations of technology, and the risks of working across platforms
• The need for resources, training, and continuing education and awareness

Ongoing training and reinforcement are needed to ensure that the organizational culture evolves to balance the need for security with enabling and empowering people to do their jobs. It also provides an opportunity for upskilling personnel to take advantage of the capabilities multicloud provides, including more deeply technical and strategic roles for the existing workforce.

3. Balancing security with agility

With an ever-expanding threat space, mission workloads and data must be secure but also accessible to those with the need and authorization. Security should also provide confidence that mission priorities can be accomplished while keeping data, systems, and users safe.

One more factor is crucial to the success of multicloud initiatives. A trusted partner understands mission, security, multicloud, and how to bring those elements together effectively. The right technology partner also brings proven technology designed to make securing multicloud environments easier and more efficient—and can help integrate it into organizational processes in the most effective ways.

As reliance on multicloud grows, so do the risks—along with opportunities to accelerate mission workflows. Multicloud security can and should provide confidence that mission priorities can be accomplished, giving defense and intelligence organizations a clear advantage in protecting the nation.

CTA: Learn more with Microsoft’s 2024 State of Multicloud Security Risk Report

As the United States defense and intelligence communities continue to collect more and more data from a growing pool of sources, they need tools to help them evaluate and manage it to make it useful instead of overwhelming. Tools such as artificial intelligence can help organize and manage data, while searching for patterns or key search terms faster than humans can, while cloud services can help distribute information widely while keeping it secure. But human analysts are still needed to evaluate and make sense of what has been collected in a timely manner. That means building tools that can augment and support human skillsets, not replace them. In this webcast, C4ISRNET explored the tools available to help manage and evaluate data, the skillsets needed to get the most from those tools and what the future of AI-supported data collection looks like.

Watch Recording:

Guest Speakers:

• Col. Matthew D. Strohmeyer, Joint All-Domain Command and Control Experimentation Division Chief, Chief Digital and AI Office (CDAO)
• Derek Strausbaugh, DoD Mission Team Leader, Microsoft

Regulations like the Intelligence Community Directive (ICD) 503; the Memorandum on Improving the Cybersecurity of National Security, DoD, and Intelligence Community Systems (NSM-8); and the Executive Order on Improving the Nation’s Cybersecurity ensure that our nation’s most sensitive data is properly secured. NSM-8, for example, places a heavy focus on encryption, identifying and strengthening defense mechanisms for cross-domain connections, increasing the National Security Systems’ (NSS’) use of cloud technologies, and requiring NSS to implement multi-factor authentication. Microsoft helps organizations assess, monitor, and enhance their security posture relative to Zero Trust practices in keeping with these requirements.

In the past, Secret and Top Secret information was traditionally hosted on-premises while the cloud was reserved for unclassified materials. However, growing amounts of sensitive data have strained—and, in some cases, overloaded—the processing ability of existing on-premises solutions. Using a hybrid cloud approach means that agencies can bring in cloud capabilities like artificial intelligence (AI) and machine learning (ML) where needed to more quickly process and act on incoming data. But agencies must have a way to secure Secret and Top Secret data across the various cloud platforms where it resides.

To that end, Microsoft has developed a hybrid-first cloud architecture that better integrates and secures the full spectrum of third-party US government vendors, managed through a centralized view via Microsoft Azure for Government.

Microsoft is unique in the fact that we operate across the full spectrum of the federal infrastructure—encompassing everything from security and identity solutions to email and collaboration. And because we’re opening our hybrid cloud architecture to competitive vendors, this enables us to protect and secure the Microsoft cloud in addition to outside cloud providers and on-premises solutions in compliance with federal regulatory standards. The end result is a more versatile, more scalable, and more secure infrastructure that’s designed to empower the modern warfighter all the way to the tactical edge.

Security should enable, not restrict

Microsoft’s goal with a secure hybrid-first cloud architecture is to enable agencies, not restrict them. When we think about security in terms of regulatory compliance and identity management, there can often be a misconception that security regulations stand in the way of the public sector innovating at the same pace as their private sector counterparts. But this couldn’t be further from the truth.

Take Microsoft’s recent Authorization to Operate (ATO) of Azure Government Top Secret infrastructure in accordance with ICD 503, for example. With this ATO, Microsoft is able to provide multiple options for data residency, offering new air-gapped regions of Azure to accelerate the delivery of national security workloads classified at the US Top Secret level. This allows the US government to ingest data from disparate sources while modernizing its existing infrastructure to enable agility and protect data, assets, and people across a rapidly evolving global threat landscape.

It also opens up a wider array of toolsets and use cases for federal employees who are working with Secret and Top Secret intelligence. The ATO empowers agencies that are working through an on-premises environment to take advantage of technology innovations that are happening in the cloud—ultimately scaling and prioritizing workloads and classified data within the Azure for Government portfolio.

But the key to this enablement is meeting government agencies where they are at. Understanding that the US government works with an array of vendors, not just Microsoft, we have opened up our hybrid-first architecture to secure outside vendors, so that federal employees have the tools they need to conduct mission-critical tasks in the least amount of time and in the most secure way possible.

A hybrid-first approach allows federal agencies to do more with less

A major challenge facing the cybersecurity industry is workforce shortages. By 2025, Cybersecurity Ventures predicts there will be a skills gap of 3.5 million open cybersecurity positions. The federal government faces an additional hurdle on top of this existing shortage as employees increasingly exit the public sector in favor of private sector positions. Federal employees left their jobs at an attrition rate of 6.1% in 2021, with nearly 9% of employees under 30 leaving public sector positions. This means that incoming employees must be retrained on tools and procedures in order to operate in a highly-sensitive data environment.

Microsoft’s hybrid-first approach allows agencies to more easily upskill their existing workforce by unifying operations and bringing more efficiency into their technology model. When on-premises and cloud solutions are consolidated into a single view, it’s easier for federal agencies to train their employees and reduce the need for additional hands on keyboards.

Another challenge that federal agencies have to account for is unpredictable data workloads. Taking a hybrid cloud approach allows agencies to scale their workloads dynamically without overprovisioning large amounts of their infrastructure as capacity needs fluctuate, but agencies must first have a solid data classification system in place in order to fully capitalize on on-premises and cloud technology.

Data classification is critical because there are different regulatory standards that govern how technology providers can host Secret data compared to Top Secret data. Before Microsoft can determine which cloud techniques to deploy, we must first look at how an agency classifies its data. At its core, a hybrid-first cloud utilizes Secret and Top Secret on-premises data sets in concert with cloud tools in order to scale and lean into things like data center modernization, unified operations, application innovation, and unpredictable workflows.

As hybrid cloud technology continues to grow, security must be center focus

As we look towards the future of hybrid-first cloud architectures, security must remain a key focus. When dealing with Secret and Top Secret data, the US government is constantly looking for new ways to strengthen security compliance, identity management, and privacy. Meeting these regulatory standards without restricting technology or performance will require a robust and baked-in solution set.

One of the most effective methods we can use to accomplish this is Zero Trust. Regardless of whether classified data is stored on-premises or across cloud platforms, it still needs to be secured according to the same regulatory standards. However, this can be challenging when you’re dealing with a range of toolsets from across distributed environments. As more and more agencies look to adopt cloud technology, they’ll need to ensure that they’re in compliance with the Zero Trust framework. Microsoft helps agencies meet the requirements of Zero Trust within air-gapped environments thanks to our suite of Zero Trust optimization models and built-in security solutions that allow agencies to assess their Zero Trust maturity and implement improvements.

Microsoft Azure for Government is designed to bring commercial cloud computing capabilities to classified environments, centralizing best-in-class security solutions in a single pane that aligns with broader federal security regulations. Our goal is to protect not only Microsoft solutions but other vendors’ technology as well. In doing so, we’re meeting our federal customers where they are at with the toolsets they already use—taking a hybrid-first approach to enable innovation at speed.

Explore Microsoft’s Classified Cloud solution to learn why Microsoft is the choice for classified missions.

What has not changed is the need for precise mission planning, comprehensive personnel readiness, and the proper equipping of our warfighters to achieve mission outcomes and bring them home safely. This requires transforming data into actionable information, both at home and in-theater.

The DoD can improve the overall operational capabilities for its warfighters by adopting modern technology. They use a combination of cloud computing infrastructure, cyber security services, data analytics, and secure collaboration to provide enhanced support that aids in the execution of multi-domain operations from the cloud to the tactical edge.

A cloud-first strategy optimized for DoD

Microsoft takes seriously the privacy and security of everyone who uses our products, and that is reflected in our approach to providing Secret and Top Secret cloud services. Microsoft designed Azure for Government as a hybrid-first platform aligned with DoD networking and cybersecurity standards. Azure Government Secret is the first DoD-authorized Impact Level 6 cloud accessible directly through the DoD SIPRnet.

The U.S. military has an unparalleled global presence, with roughly 750 military bases scattered in 80 countries around the world. The geographic diversity of the immense DoD footprint means that not every operational force has equal access to hardware and bandwidth.

Where access is abundant, programs can run largely in the cloud in alignment with the DoD’s cloud-first strategy. When forces are forward-deployed in remote areas or in areas with less-developed infrastructure, they often must rely on local hybrid cloud tools. Microsoft’s Azure for Government Secret and Top Secret clouds provide hybrid cloud capability without the compromise of persistent connecting — arming warfighters with the resources they need to execute their missions and achieve operational success.

Full hybrid and edge portfolio for Secret cloud

With Microsoft Azure for Government, DoD forces can access hybrid and edge computing capabilities in the Secret and Top Secret clouds. After decades worth of lessons learned from building for the commercial industry, Microsoft Azure for Government is commercial grade but built to support the defense of our nation.

The DoD has access to best-of-breed infrastructure from Microsoft Azure datacenters located around the globe. Upon this foundation of geographically-dispersed data centers operated at the highest levels of DoD and US Government compliance, Microsoft has built a rich set of services to serve the core mission of the military community.

Office 365, which incorporates a unified identity and access management and cybersecurity tools from Azure, makes collaborating easier than ever. This can be through a Teams collaboration session between policymakers on Capitol Hill, co-authoring a presentation intended for the commander halfway around the world, or a chat session with civilian partners participating in a humanitarian assistance effort domestically.

Integration for more robust and secure data sharing

The amount of Secret and Top Secret data produced daily by the DoD is staggering, and storing it all was simply unimaginable not all that long ago. When that data is stored on isolated networks in far-flung locations with disparate security implementations and limited bandwidth, this creates barriers to information sharing and the production of actionable intelligence.

Microsoft Azure for Government enables users to move data between separate cloud fabrics by using logical rather than physical controls such as air-gapped and isolated networks. This approach helps users fuse data together more easily. Data can now be shared and integrated more quickly and securely than ever before.

The ability to move data between clouds is a direct result of Microsoft’s decades of building and fine-tuning commercial solutions that enable people to collaborate and share data. Building a custom solution for classified data runs the risk of quickly becoming outdated and emulating the same problems experienced with data management in the DoD today. Instead, we took our existing technological breakthroughs and coupled them with our deep understanding of how to support the far-ranging requirements of the DoD.

The result, Microsoft Azure for Government, opens datasets and promotes data integration unlike ever before. Data is now accessible to authorized users with native connections to classified networks or through private, resilient, high-bandwidth connectivity using ExpressRoute and ExpressRoute Direct.

Rich solutions, from within and outside of Microsoft, supported by optimized infrastructure

In an organization as vast, both demographically and geographically, as the DoD, it is no wonder that the number and range of technological solutions is just as diverse. When a unit comes to us and tells us they are using an application built on Linux with a JavaScript front end and running Cassandra as a data store, we can assure them that they can run that or virtually any other application stack on Microsoft Azure for Government.

Our commitment to open source software means that Microsoft works with our government partners every day to meet the specific needs of the DoD workforce, from the stateside clerks to soldiers in-theater. With Microsoft Azure for Government, DoD teams not only have access to Microsoft’s deep portfolio of solutions but also the best of tools from third-party vendors and the open-source community.

The majority of the solutions on the Azure Marketplace are from third-party vendors. Microsoft is proud to partner with DoD-focused system integrators and independent software vendors to ensure that those who do the difficult work of protecting our nation have the tools they need to do so safely, regardless of who wrote the code.

A focus on operational technology makes for better data and better missions at the edge

Teams at the tactical edge need powerful computing power and rich applications to accomplish their objectives and return home safely. By processing data close to the source, Microsoft Azure for Government addresses latency and connectivity issues and gives forward-deployed personnel access to actionable information. When feasible and practical, data is then transferred back to Azure to continue to improve the model.

Microsoft Azure for Government empowers tactical teams to achieve greater visibility, move faster, and make more informed decisions. By bringing intelligence to the edge, providing unified security to protect the nation’s most critical data, and delivering solutions for secure remote collaboration, Microsoft Azure for Government makes the DoD future-ready.

Do more for the mission with Azure. Visit Azure for U.S. Government.