In the ever-changing security landscape, federal agencies are challenged to find a security solution that not only works right now but will also address future security needs without adding unanticipated costs.
To help agencies choose a service that works for them, we compiled a list of the seven critical questions to ask vendors about the security solutions they provide. With this information in hand, agency IT decision makers can choose the service that best fits with their agency missions and priorities.
Many vendors say their services and technology are adequate enough to secure sensitive government data. However, without third-party verification to validate these claims, you could not only be risking the efficacy of your investment but also the security of your networks.
Cloud-native and resilient services mean fewer security interruptions to the mission. You need to know if the service scales, and if scaling will cause outages. Often, updates to legacy infrastructure require an outage window, which is downtime for your users. A true multitenant cloud platform that scales reduces outages, which is why it's important to choose a cloud-native service.
By default, zero trust security means the system was designed with zero trust principles from its inception. For context, zero trust requires identity verification from everyone trying to gain access to the system and its applications. Access is granted based on policy requirements being met while all other connections are denied by default. This added layer of security prevents data breaches and secures agency data.
Knowing how your data moves improves performance. Ask whether the vendor peers with SaaS providers, such as Microsoft and Salesforce, and how these peering relationships will impact performance and cost.
Chances are, if the company says it can set up a proof-of-concept/proof-of-value quickly, then their solution is likely cloud-native and resilient. If a vendor says it's going to take eight weeks or more to provide a proof-of-concept, and with additional costs, then the service is likely not easy to scale.
Nearly every federal agency uses Office 365, meaning hundreds of thousands of users rely on it for everything from creating documents to hosting team meetings. Any security-as-a-service solution must interact well with O365, must be easy to configure, and must perform well without interruption. If configuration isn’t seamless, you spend more on professional service hours to get it working.
Mobile devices are ubiquitous within the government, and they need to perform as well as desktop devices. Whether users are deployed in the field or working from home, they need the ability to stream video and other high-bandwidth apps and content.
Don’t fall for a lift-and-shift of old appliances to the cloud. Asking these seven questions will help you determine whether your security provider truly has a cloud-native platform that is dynamic, scalable, and resilient. For more detail about what to assess in their answers, download the white paper: The 7 Critical Questions Agencies Should Ask Security Providers
Mark Harman is a sales engineer at Zscaler.