What might be considered paranoia in real life has become the standard that many government officials are looking to achieve in protecting their data and networks from cybersecurity incidents.<\/p>\n\n\n\n
According to both industry and government experts that spoke at a May 8 ACT-IAC event, applying a \u201czero trust\u201d model to agency cybersecurity could provide an ideal route to protecting sensitive government data, while checking the boxes on many government security requirements.<\/p>\n\n\n\n
Zero trust is not a product, said Sean Frazier, advisory chief information security officer for federal at Duo Security. Rather, zero trust is a mindset where no user is automatically deemed trustworthy, and every system must verify the user before granting access.<\/p>\n\n\n\n
\u201cIt\u2019s a direct conversation between a user and an application on a device,\u201d said Frazier.<\/p>\n\n\n\n
Effectively, a zero trust framework ensures that every system verifies the identity of the user and their authority to access various types of information before granting access to its data or operations. And just because one system granted a person access, doesn\u2019t mean that the user suddenly has the ability to see everything on the network.<\/p>\n\n\n\n
But according to Lisa Lorenzin, that doesn\u2019t mean that systems should feel more closed off than they were before zero trust was implemented.<\/p>\n\n\n\n
\u201c\u2018Zero trust\u2019 is a misnomer. You start off by not implicitly trusting anyone, but that\u2019s not our goal. Our goal is to figure out who we can trust, how we know we can trust them and what we trust them to do or to access,\u201d said Lorenzin.<\/p>\n\n\n\n
\u201cFor me, zero trust is a way to ensure that the end user can get to whatever they need with as little friction as possible, and everything else is window dressing. We need to take cybersecurity from the group that says \u2018no\u2019 to the group that says \u2018yes,\u2019 and I think zero trust is how we do that.\u201d<\/p>\n\n\n\n
Despite the fact that zero trust is a mature and tested cybersecurity model, according to Lorenzin, it may take the federal government some time before that model can be widespread, no matter how well it works.<\/p>\n\n\n\n
Steven Hernandez, director for information assurance services and CISO for the Department of Education, said that federal agencies can\u2019t be like private sector companies such as Google, which revamped its entire architecture to adhere to a zero trust model.<\/p>\n\n\n\n
\u201cDon\u2019t expect all agencies to put out one requirement that\u2019s going to say, \u2018yeah, I want zero trust.\u2019 It\u2019s going to look different, it\u2019s going to feel different, but it\u2019s all going to have some kind of intersection with zero trust,\u201d said Hernandez.<\/p>\n\n\n\n
Limited budgets, deeply entrenched legacy IT systems and inadequate IT workforces can all hold back a wholesale transition into zero trust-based cybersecurity.<\/p>\n\n\n\n
Meanwhile, agencies should look into ways that they can map their \u201ccrown jewels\u201d up to a zero trust framework, according to Hernandez, and work on getting the rest of their data into a zero trust model in the future.<\/p>\n\n\n\n
\u201cZero trust implementations will need to be very scalable,\u201d said Jeffrey Flick, acting director of the Enterprise Network Program Office at the National Oceanic and Atmospheric Administration.<\/p>\n\n\n\n
According to Hernandez, the side benefits of zero trust can also be used to sell the concept to agency leadership.<\/p>\n\n\n\n
\u201cZero trust can drive a lot of the existing compliance programs we already have, if we do it right,\u201d he said, adding that the model can allow agencies to maintain that compliance while expanding the devices or locations where users can access agency systems.<\/p>\n\n\n\n
\u201cThat\u2019s how we\u2019re going to sell zero trust if we\u2019re going to be successful. We\u2019re going to show that, instead of government-furnished equipment with five-factor authentication for getting through, adding tons of latency, we\u2019re going to say \u2018any device, anywhere, with very simple authentication to get into that data.\u2019\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
Federal agencies are increasingly looking to a specific framework to keep critical IT systems and data safe.<\/p>\n","protected":false},"author":7,"featured_media":26565,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":31,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"9":{"categories":["cyber"],"primary_category":"cyber"}}},"categories":[106,31,110,33],"tags":[],"coauthors":[2853],"class_list":["post-9573","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-it-cloud-report","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"VR52BBFENJFR3M5GZALE4FWSMU","arc_canonical_url":"\/civilian\/2019\/05\/09\/when-zero-trust-in-government-is-a-good-thing\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n