{"id":16551,"date":"2022-06-28T18:38:51","date_gmt":"2022-06-28T18:38:51","guid":{"rendered":"https:\/\/one.sightlinemg.com\/federaltimes\/uncategorized\/2022\/06\/28\/six-proven-steps-to-zero-trust\/"},"modified":"2026-08-08T17:55:22","modified_gmt":"2026-08-08T17:55:22","slug":"six-proven-steps-to-zero-trust","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2022\/06\/28\/six-proven-steps-to-zero-trust\/","title":{"rendered":"Six proven steps to Zero Trust"},"content":{"rendered":"\n

First, it was the attack on SolarWinds, then the Colonial Pipeline, and most recently, Log4j. Unfortunately, these successful and very public cyber exploits weren\u2019t the first, and they certainly won\u2019t be the last.<\/p>\n\n\n\n

Federal leaders are no longer surprised when attackers identify the next crack in the dam. That doesn\u2019t mean they can sit complacently by and wait.<\/p>\n\n\n\n

The onset of COVID-19 and the shift to hybrid work expedited the need for government agencies to reevaluate how best to utilize their limited resources to plug the unfilled holes. The need to fast-track remote access has led to the recent adoption, emphasis on, and implementation of Zero Trust innovations.<\/p>\n\n\n\n

White House Executive Order 14028<\/a> on May 12, 2021, made ZT architecture central to the federal security landscape, required agencies to develop new standards that could better prevent cyber incidents, and mandated the transformation of government systems into more secure digital infrastructures.<\/p>\n\n\n\n

Since then, the Office of Management and Budget released its federal strategy<\/a> in January, and the Cybersecurity and Infrastructure Security Agency issued its latest ZT guidance<\/a> for agencies this March.<\/p>\n\n\n\n

While guidance abounds, there are many steps required to implement federal efforts to identify, detect, deter, prevent and respond to these ever-evolving threats. Agency leaders are working to adopt the mindset of trust nothing and verify everything to prioritize the transformation of legacy systems.<\/p>\n\n\n\n

The General Service Administration is supporting the implementation phase with plans to issue ZT playbooks <\/a>this year. These roadmaps will help operationalize the ZT strategies required by the EO and recently submitted by each federal agency.<\/p>\n\n\n\n

So, what should these playbooks contain? First, they should define the key tenets of ZT. Second, playbooks need actionable and proven guidelines that go beyond top-line EO-driven agency strategies to guide adoption in six key steps.<\/p>\n\n\n\n

Define Key Tenets of ZT<\/h2>\n\n\n\n

For starters, ZT is not a destination but rather an ongoing journey. It optimizes and improves security by increasing levels of automation, refining access to data and making sound decisions based on policies and risk. It includes six key tenets that leaders must fully understand to drive implementation. These key tenets include:<\/p>\n\n\n\n

Identities<\/b>: people, services and internet-of-things components<\/p>\n\n\n\n

Devices<\/b>: monitoring and enforcing device health and compliance<\/p>\n\n\n\n

Apps and Services<\/b>: ensuring appropriate permissions and secure configurations<\/p>\n\n\n\n

Data<\/b>: giving the necessary attributes and encryption to safeguard out in the open<\/p>\n\n\n\n

Infrastructure<\/b>: hardening against attacks on-premises or in the cloud<\/p>\n\n\n\n

Networks<\/b>: establishing controls to segment, monitor, analyze and encrypt end-to-end traffic<\/p>\n\n\n\n

Implementing Trust Resilience<\/b><\/h2>\n\n\n\n

Agencies can benefit from proven strategies poised to tackle EO ZT requirements in actionable bites and implement a \u201ctrust resilience framework\u201d in six key steps.<\/p>\n\n\n\n