Constitutional Data Collection Goes Digital

The U.S. government has gone digital with the constitutionally mandated decennial population survey. The agency in charge of the decennial data collection has taken full advantage of available technology to make participation easier for all Americans, while providing U.S. government and its enterprise customers more efficient access to the resulting data. Over its 230-year history, the agency has relied on surveyors to gather population data by recording information on paper — until now. 

Technology, like cloud computing and the proliferation of mobile devices, made it easy to go digital. But technology also posed challenges that needed to be addressed. The first challenge was security. This included making sure the survey was available and that the confidentiality and integrity of the data collected was protected. The second challenge was to ensure access to the survey for everyone. 

To meet the challenges, the agency looked to RavenTek and Akamai. With a global edge platform of over 350,000 servers, Akamai was able to place the agency’s first layer of security within one network hop of 85% of all users and threats. Furthermore, Akamai’s mobile edge optimization and performance routing ensured optimal performance and availability for all Americans. 

From the start, the agency had already planned an expansive cloud architecture that included multiple regions, each with redundant active and reserve workloads. Even with this level of back-end redundancy, it was clear that the survey application required a more dynamic scalability to be able to maintain optimal performance while mitigating threats. 

To meet these needs, RavenTek and Akamai worked closely alongside the agency to move forward with its deployment of front-end solutions for a domain name system (DNS), application-layer security, and UX optimization.

Key to availability, and often overlooked, is DNS. A robust and scalable DNS resolver was required to withstand sudden peaks in traffic, while automatically mitigating attacks. With 2,000 DNS zones, Akamai’s market-leading Edge DNS was able to handle high traffic volumes securely while improving performance and availability. 

Akamai Edge DNS uses a distributed network of recursive resolvers and redundant authoritative resolvers to increase availability with robust scalability. Built-in rate controls prevent the risk of being targeted by volume attacks while Akamai threat intelligence enables DNS servers to reject requests from known active threats. 

Edge DNS fully supports DNS Security Extensions (DNSSEC) with the capabilities of automating the processes for zone signing, re-signing, and key rotation. 

The agency was able to integrate the Edge DNS solution into its own internal system. Because Edge DNS can be deployed as a secondary resolver, the agency was able to continue using its current internal DNS management system to manage all internal and external zones. 

In addition to DNS resolution, Akamai was able to provide the agency with DNS-based load balancing. Integrated into the Edge DNS platform, Global Traffic Management (GTM) performs target location polling to determine the availability of each location. In the event of failure, GTM provides automatic failover at the DNS level. Edge DNS automatically mitigates DNS attacks by only accepting requests from known nameservers as well as leveraging Akamai’s threat intelligence to prevent requests from known active threats. Default rate controls further protect against excessive requests.

The agency now needed to address the availability and security of the survey application. It implemented App & API Protector, a cloud security solution that provides DDoS mitigation and a fully functional web application firewall (WAF). 

Operating as part of the Akamai Connected Cloud, App & API Protector extends the security perimeter to the edge, mitigating attacks targeting web applications, including:

• DDoS 
• Scripting and injection attacks (XSS, SQLi, CDMi, PHPi, RFI, LFI) 
• Traffic protections within OWASP Top 10 list 

With enormous capacity at its disposal, the platform automatically scales to absorb and deflect malicious traffic, while maintaining site performance and availability for production users.

Included with the App & API Protector is Akamai’s full-featured WAF, which offers a rich collection of predefined but configurable application-layer firewall rules. Akamai maintains this with regular updates for different categories, such as protocol violations, request limit violations, HTTP policy violations, malicious robots, generic and command injection attacks, Trojan backdoors, and outbound content leakage.

Like all Akamai features, the security features function on Akamai edge servers, which are within a single network hop of 85% of all end users. Even in cases where a client outside the U.S. is requesting a site/application with caching configured for the U.S. only, the end user will be first connected to the closest available edge server. It is at that edge server where security policies are applied, and mitigations are enforced. 

Mitigation at the edge enables Akamai to route traffic over the best available route between the client and origin, without having to redirect requests to a centralized PoP or third-party cloud for security inspection and mitigation. Akamai provides security mitigation in a direct line, at the edge, without impacting performance. 

This massive capacity and mitigation accuracy have earned Akamai recognition as an industry leader in DDoS mitigation and WAF from both Gartner³ and Forrester.⁴

Despite the mass proliferation of smartphones, only 77% of Americans have home broadband access, while 15% can only access the internet over their smartphone.⁵ The agency also considered underserved communities, which are critical population segments necessary for the policy and legislative decisions. A key requirement of its digital strategy was to ensure that everyone who was smartphone-dependent, or lacked internet access altogether, was counted.

The agency was aware that it needed more than just accelerated dynamic web content across the middle mile; it needed to be able to optimize content on a per-device basis. While a responsive web design (RWD) can accommodate varieties of devices, it also introduces many new challenges, such as delivering a much larger payload to the client and increasing the number of requests back to the origin. RWD can cause multiple calls back to the origin for responsive content because of the diversity of devices that are making initial requests. 

Akamai Ion was designed specifically to optimize the user experience through edge site content adaptation. Ion goes beyond mobile detection and redirection by adapting content for mobile clients at the edge, reducing the client-side payload, and offloading the increased number of requests that are necessary for RWD. 

Akamai’s dynamic routing mitigates middle-mile latency, and Ion takes optimizations to the edge, using client-specific situational intelligence to dynamically adapt content for the end-user experience. 

With Ion, Akamai’s content delivery service provides maximum offload, scalability, performance, and availability for the agency’s survey application. At the same time, Ion minimized survey abandonment by ensuring an optimal user experience, regardless of the user’s devices or network capabilities.

RavenTek recognizes that in today’s challenging fiscal environment, federal agencies need the right partner who can help them advance mission goals through efficient and innovative IT, engineering, administrative, and program management solutions. Learn more at www.raventek.com.

^{1 Census Estimates U.S. Population As High As 336 Million Ahead Of Actual Count. Npr.org (2020). Retrieved from https://www.npr.org/2020/12/15/946396277/census-estimates-u-s-population-as-high-as-336-million-ahead-of-actual-count.}

^{2 Smartphone Users in the US Expected to Reach Over 270 Million by 2022. Internetinnovation.org (2018). Retrieved from https://internetinnovation.org/general/research-peek-of-the-week-smartphone-users-in-the-us-expected-to-reach-over-270-million-by-2020/.}

^{3 Akamai Positioned in Leaders Quadrant of Gartner Magic Quadrant For Web Application Firewalls. Akamai.com. (2017). Retrieved from https://www.akamai.com/newsroom/press-release/akamai-positioned-in-leaders-quadrant-of-gartner-magic-quadrant-for-web-application-firewalls.}

^{4 Forrester Names Akamai a WAF Leader. Akamai.com (2020). Retrieved from https://www.akamai.com/lp/report/forrester-waf-wave-q1-2020?.}

^{5 Mobile Technology and Home Broadband 2021. Pewresearch.org (2021). Retrieved from https://www.pewresearch.org/internet/2021/06/03/mobile-technology-and-home-broadband-2021.}

^{6 U.S. Code. Law.cornell.edu (n.d.). Retrieved from https://www.law.cornell.edu/uscode/text.}