Author: Josh Achtemeier

The good news: Every state in the US now has a Chief Information Security Officer (CISO) appointed with formalized authority to help ensure security and data privacy across state government operations. The bad news—as we’ve learned from the 2024 Deloitte-NASCIO Cybersecurity Study—is that “nearly 40% of CISOs say funding falls short of what they need to keep assets and citizens safe.”  These budget shortcomings are becoming an even more acute issue as all levels of government work to protect against the cyber threats associated with their evolving use of Generative AI technology.

The Growing Role of AI in Government 

At the state level, most governments across the US have started actively deploying generative AI (GenAI) tools. Only 8% of state CIOs said that they were not using any GenAI tools in their respective states. 

The most common uses among government adopters include virtual meeting assistants, cybersecurity, software code generation, and document creation.  However, the earliest adopters of the technology are already deploying more sophisticated applications to provide services like public-facing chatbots, as well as leveraging GenAI for increasingly critical purposes like analyzing crime reports and public health data. However, these are a just a couple examples of the countless ways that GenAI is being leveraged to enhance government efficiency and (hopefully) increase constituent satisfaction. 

Generative AI Brings Its Own High Availability & Cybersecurity Challenges 

As generative AI technology plays an increasingly critical role across all levels of government, application uptime becomes a key consideration. To sustain the front-end AI application capability for end users, the database backbone must be integrated into a flexible and resilient high availability (HA) framework. In the context of AI, this means employing HA technology that can unify HA across a complex mix of platforms and cloud infrastructure. 

Additionally, the public sector has always been an unfortunately attractive industry for foreign state actors and private criminal organizations to wage cyberattacks due to its wealth of sensitive data. And while generative AI technology unlocks huge gains for the government in terms of efficiency and automation, it also intensifies security threats within data environments. AI-perpetuated vulnerabilities include: 

Increased Attack Surface: Generative AI models often require large amounts of data to function effectively. This can lead to an increased attack surface, as more data is being collected, stored, and processed. If this data is not properly secured, it can become a target for attacks. 

Complexity and Interconnectedness: Generative AI systems can be complex and interconnected, making them harder to secure. As these systems are integrated with existing infrastructure, they can create new vulnerabilities and increase the potential for lateral movement in the event of a breach. 

Model Theft or Manipulation: Generative AI models themselves can be stolen or manipulated, allowing attackers to use them for malicious purposes. For example, a stolen model could be used to generate fake identities or documents. 

Dependence on Third-Party Libraries and Tools: Many generative AI systems rely on third-party libraries and tools, which can introduce additional security risks if these components are not properly secured or updated. 

Lock Down Networks with DxOdyssey Software-Defined Perimeter 

DH2i’s DxOdyssey Software-Defined Perimeter (SDP) can help the public sector enhance cybersecurity in several keys ways to help address the security challenges posed by generative AI: 

Secure Access Control: DxOdyssey SDP provides secure, granular access control to sensitive resources and applications, ensuring that only authorized users and devices can connect. This is particularly important when dealing with generative AI models that may require access to large datasets or computational resources. 

Micro-Segmentation: The public sector can leverage DxOdyssey’s micro-segmentation capabilities to isolate critical assets and applications from the rest of the network. This reduces the attack surface, making it more difficult for malicious actors to move laterally within the network in the event of a breach. 

Zero Trust Network Access: Implementing ZTNA tunnels with DxOdyssey SDP ensures that all users and devices are authenticated and authorized before being granted access to resources, regardless of their location or device. This is crucial when generative AI models may be accessed remotely or by third-party vendors. 

Highly Available Network Connections: DxOdyssey allows for the creation of ZTNA tunnel groups to provide failover support in the case that a certain endpoint goes offline, ensuring high availability for your network connections. 

Encryption: DxOdyssey provides end-to-end encryption for all traffic, ensuring that even if data is intercepted, it will remain unreadable without the decryption key. This protects sensitive information used in or generated by AI models from unauthorized access. 

Support for Mixed-Infrastructure Data Estates: Many public sector organizations operate in mixed-infrastructure environments, with applications and data spread across on-premises, cloud, and edge locations. DxOdyssey SDP supports these diverse environments, ensuring consistent security policies can be applied everywhere, which is vital for securing generative AI workloads that may span multiple deployment models. 

Eliminate VPN Infrastructure: Virtual private networks are not cut out for the complex, cloud-based infrastructure that supports AI applications. Not only that, but they leave excessive swaths of network vulnerable to attack, and rely on physical appliances (another potential point of failure) to do the job. DxOdyssey introduces a standalone, software-defined alternative to facilitate isolated application-level access and eliminate the need for any physical network security infrastructure. 

Potential Use Cases Among Government Agencies 

DxOdyssey’s infrastructure-agnostic nature and cross-platform capabilities can allow it to help a variety of government agencies protect their sensitive data and applications from unauthorized access. DxOdyssey can also help ensure compliance with relevant regulations and security policies. Here are just a few possible examples of how specific agencies could lockdown their networks if they chose to deploy DxOdyssey SDP: 

National Institutes of Health (NIH) 

The NIH uses GenAI applications to analyze medical images and genomic data to accelerate disease diagnosis and treatment. They need to protect sensitive patient data and research information from unauthorized access. 

Use Case: The NIH could deploy DxOdyssey SDP to secure the network infrastructure supporting their GenAI applications. DxOdyssey would allow them to: 

• Isolate the GenAI application servers from the rest of the network, ensuring that only authorized researchers and clinicians can access them. 
• Encrypt data in transit between the GenAI application servers and the research teams’ workstations. 
• Implement role-based access control to ensure that researchers and clinicians can only access specific patient data and research information based on their roles and permissions. 

Benefits: The NIH could benefit from DxOdyssey SDP by ensuring the confidentiality, integrity, and availability of sensitive patient data and research information—allowing them to stay in compliance with regulations such as HIPAA and FISMA. 

Federal Bureau of Investigation (FBI) 

The FBI uses GenAI applications for facial recognition, natural language processing, and other investigative tasks to support law enforcement operations. They need to protect sensitive case data and intelligence information from unauthorized access. 

Use Case: The FBI could deploy DH2i software to lock down their GenAI application networks. Specifically, they could use DxOdyssey SDP to:  

• Create encrypted Zero Trust Network Access (ZTNA) connections for remote investigators to securely access case data and intelligence information from anywhere. 
• Use micro-segmentation to isolate specific segments of the network, such as those containing classified information, from the rest of the network. 

Benefits: DxOdyssey SDP would benefit the FBI by ensuring network security, performance, and availability of sensitive case data and intelligence information, even for their off-site workforce. 

National Oceanic and Atmospheric Administration (NOAA) 

NOAA uses GenAI applications to analyze climate models, weather patterns, and oceanographic data to support environmental monitoring and prediction. They need to protect sensitive research data and intellectual property from unauthorized access. 

Use Case: NOAA could deploy DxOdyssey SDP to: 

• Secure the data ingestion process for research data from various sources, such as weather stations and satellite imagery. 
• Implement network access control to ensure that only authorized researchers and scientists can access specific research data and models. 
• Use encrypted ZTNA connections to protect sensitive research data in transit between NOAA’s data centers and research partners’ networks. 

Benefits: NOAA would benefit from DxOdyssey SDP by keeping intellectual property and sensitive research data encrypted and secure while in-transit. The use of DH2i network security technology would also help them to comply with regulations such as FISMA and the National Institute of Standards and Technology (NIST) Cybersecurity Framework. 

Other Useful Cybersecurity Best Practices 

Having the right network security technology in place is a fantastic start, but not the only measure that public sector organizations need to take. To further mitigate the risks posed by generative AI, government agencies should engage in the following: 

Regular Security Audits and Penetration Testing: Conduct regular security audits and penetration testing to identify vulnerabilities in the system. 

Employee Education and Training: Educate employees on the potential risks associated with generative AI and provide training on how to use these systems securely. 

Model Monitoring and Validation: Continuously monitor and validate the output of generative AI models to detect potential security issues or data manipulation. 

Incident Response Planning: Develop incident response plans to quickly respond to and contain potential security breaches. 

By taking a methodical and multi-faceted approach to cybersecurity, the government sector can minimize the risks associated with leveraging generative AI technology and ensure that these systems are used securely and effectively. DH2i’s DxOdyssey SDP offers a robust security solution that can ensure secure access control and reduced attack surface across any mix of infrastructure. Implementing additional proactive best practices around internal education, testing, and disaster-readiness can further bolster your organization’s overall cybersecurity strategy. 

DxOdyssey can be easily installed on any of your existing infrastructure in just a few clicks.
Get signed up for a free trial license today

Our collaborations with technology partners over the years have been critical in engineering the most flexible and impactful software solutions for our customers. 

DH2i has worked in different capacities with Microsoft for years. We’ve maintained a collaborative, mutually-beneficial relationship that has fostered some massive advances in SQL Server high availability technology, especially in the Linux space. E.g. DH2i’s groundbreaking SQL Server Operator for Kubernetes has become Microsoft’s officially recommended SQL Server Operator, even receiving dedicated documentation articles within their SQL Server resource library. 

Over the last couple years, we have started working closely with the fantastic team over at SUSE as well—pioneering some powerful new solutions to facilitate SQL Server modernization with unparalleled ease. E.g. Take a look at this demo video featuring DxOperator and Rancher Prime to facilitate the easiest possible approach to a SQL Server Kubernetes deployment in AKS.  

 From robust, certified platforms to meticulously developed Kubernetes orchestration and security technologies, SUSE provides perfectly complementary capabilities to enhance our existing solution stories with Microsoft. The functional possibilities and applications of our combined solution portfolios are wide-ranging, but this blog will focus on the ability of our three companies to unlock easy deployment of highly available SQL Server in the cloud with Microsoft Azure, SUSE Linux Enterprise Server (SLES), and DxEnterprise. 

A Full Suite of Services and Security for Cloud Databases 

Microsoft Azure: Azure is Microsoft’s public cloud platform, which provides a wide range of services, including computing, storage, networking, and database management. Azure supports various operating systems, including SUSE Linux Enterprise Server (SLES). 

SUSE Linux Enterprise Server: SUSE is an open-source software company that offers a range of products, including the SLES operating system. SLES is a popular choice for enterprise environments due to its stability, security, and scalability. 

DxEnterprise: DxEnterprise is Smart High Availability Clustering software developed by DH2i, which provides an easy-to-mange, flexible, secure, and highly available clustering framework for managing SQL Server databases on Windows, Linux, and Kubernetes.  

When used together, Azure, SLES, and DxEnterprise can provide a robust solution for deploying and managing highly available databases in the cloud. Here’s how they work together: 

1. Azure as the cloud platform : Azure provides the underlying infrastructure for deploying and running SLES virtual machines (VMs) or containers. 
2. SUSE Linux Enterprise Server: SLES is installed on Azure VMs or used as a container runtime, providing a stable and secure operating system environment for running databases. 
3. DxEnterprise : DxEnterprise is deployed on top of SLES, providing a high availability framework that can manage multiple database instances across the Azure (and any mix of) infrastructure. 

The benefits of using Azure, SUSE, and DxEnterprise together include: 

1. Scalability: Azure provides a scalable cloud infrastructure that can be effortlessly integrated with the DxEnterprise HA management framework, regardless of region or Availability Zone. 
2. High availability: DxEnterprise ensures high availability of databases by providing real-time monitoring, load balancing, and automatic failover (for instances AND containers) to ensure that workloads are always running in their respective best execution venues. 
3. Security: SLES provides a secure operating system environment, while DxEnterprise offers the additional capability of encrypted, app-level zero trust network access connections across any mix of clouds and infrastructure. 
4. Simplified management : DxEnterprise simplifies high availability management by providing a unified platform for managing multiple database instances across Azure and any mix of infrastructure or platforms. 

Use Cases for the Azure, SLES, & DxEnterprise Solution Stack 

Some possible use cases for using Azure, SUSE, and DxEnterprise together include: 

1. Database consolidation : Consolidate multiple databases into a single DxEnterprise high availability cluster running on SLES in Azure.
2. Easy Multi-Site DR in the Cloud: If organizations need the real-time replication provided by Always-On Availability Groups (AGs), DxEnterprise can be used to easily stretch the AG across multiple Azure regions or availability zones, ensuring high availability and disaster recovery capabilities between sites.
3. Cloud migration: Migrate on-premises databases to Azure using DxEnterprise and SLES, taking advantage of proprietary tools like DxEnterprise’s SQL Server Operator for Kubernetes.

For organizations looking to deploy highly available SQL Server in the cloud, it’s impossible to outdo the benefits provided by Azure cloud infrastructure and its tight, out-of-the-box integration with SQL Server. Microsoft and SUSE’s longstanding partnership has culminated in an incredibly stable and secure operating system environment with SUSE Linux Enterprise Server. And SLES provides a cost-effective platform that is inherently optimized for SQL Server workloads. Lastly, DxEnterprise delivers the perfect high availability solution to manage all your workloads across Azure—instances or containers—and easily unifies mixed infrastructure and multi-site deployments for disaster recovery. 

Together, Azure, SLES, and DxEnterprise provide the go-to solution stack for deploying and managing SQL Server databases in the cloud. Their close integration and robust management capabilities stand head and shoulders above the competition in terms of scalability, high availability, and security.

Check out other resources detailing Microsoft, SUSE, and DH2i’s continued collaborations below:

• SUSE Blog: Unlock the Easiest Path to HA SQL Server in Kubernetes
• Joint Webinar: Unlock Fast and Secure Container Deployment with the SQL Server Operator for Kubernetes

Also published at: The IT Nerd