Get Your Federal Team In Sync With Zero Trust Security
hywards/Shutterstock.com
Adopting a Zero Trust architecture solves the “flat network” problem that helps attackers move undetected inside corporate networks so they can find and exfiltrate sensitive data.
Historically, industry is more forward-leaning than government when it comes to innovation—at least at the unclassified level. But unlike most industries, the U.S. government is driving the cybersecurity market and has been for almost the last decade.
Federal fingerprints are everywhere: Where did cyber-compliance start? Where did the first frameworks for cyber operations originate? Who are the most employed cyber operations personnel? In each of these instances and many others, government or government-related leaders and organization are the answer.
You heard it from me first: Government has led the way on cybersecurity, and that’s a good thing for everyone. Meanwhile, the industry around cyber and cyber ops has been basically churning out better technological solutions and optimizing frameworks working within the bright lines defined by the past decade’s cyber mindset.
Enter Zero Trust
This year is different. Zero Trust—a cybersecurity architecture centered on the belief that both internal and external networks cannot be trusted—and Zero Trust eXtended (ZTX) came out swinging in January, and the industry has been changed ever since.
The ZT architecture is a data-centric network design that puts micro-perimeters around specific data or assets so that more granular rules can be enforced, solving the “flat network” problem that helps attackers move undetected inside corporate networks so they can find and exfiltrate sensitive data. Most vendors have at least some knowledge of Zero Trust, many have marketing and projects around the strategy, and almost everyone is actively engaged in some form of Zero Trust conversation.
Zero Trust works in government systems and networks. I have personally done advisories and workshops with a handful of government agencies struggling with the same issues: There is no overarching strategy, ownership is hard to determine, simple things are needed to fix the issues with security due to budget, and the government perimeter is constantly under attack. Combine those issues with a mobile workforce, a lack of available talent, and the need for data security above all else, and you have a perfect storm of why Zero Trust was created.
Since 2012, Forrester’s has preached the gospel of how Zero Trust is focused on data, aimed at strategy, aligned with internal controls, negates the issues around perimeter defenses, and requires a focus on segmentation and focused ownership of the infrastructure. Combine all that past thought leadership with ZTX and the research and initiatives around next-generation access and how this all plays into Zero Trust writ large, and things suddenly become very real for any agency or infrastructure that needs to move into a new schema and strategy for security.
3 Tips On How To Implement Zero Trust
It's easy to talk about the changes to security government should implement, but what actions can agencies take now to effectively apply the Zero Trust strategy to their environments? For starters, they must:
- Engage with emerging technology vendors to enable Zero Trust across the enterprise: Leverage next-generation tools that integrate and optimize with their current legacy solutions to enable better control and insight of their infrastructure.
- Make security operate covertly: Stop arguing with users about their issues around their lack of a security culture, make security operate by default across the enterprise and function so seamlessly that there is no need for the culture of users to adapt.
- Identify, analyze, vaporize: Follow this ZTX mantra and discover what tools and technologies they don’t need, decide how best to use what their team needs to operate effectively, and finally get rid of wasted budget and failed technology investments.
Government agencies face evolving challenges and security threats, and next-generation technology like Zero Trust is a necessity to keep networks safe. Federal teams need to step up and address the struggles they’re facing to ensure that Zero Trust strategies are in place to keep government secure.
Chase Cunningham is a principal analyst at Forrester.