In a Zero Trust World, Compliance Doesn’t Equal Security

The U.S. government is one of the largest cyber targets in the world. With a broadening array of endpoints globally, agency networks are increasingly vulnerable to malware, spyware and ransomware, and there have been a number of high-profile breaches that exposed vulnerabilities inside those networks. The government obviously regards cybersecurity as critical, but the current cyber requirements for agencies are heavily focused on compliance. 

Put simply, compliance is not security; compliance is accountability and ensuring specific security requirements are met. Those requirements have traditionally assumed that enterprise users are trusted and have access to all internal corporate assets. An agency can run a completely compliant network and still be breached by a trusted user’s account being exposed.

Zero-trust security assumes no user or device is trustworthy. All authentication is continuously validated and recorded in real-time and rather than taking for granted that a user who logs on with the right credentials is who they say they are, a zero-trust approach is built on giving least-privilege access to that user. This limited access reduces damage and loss a potential attacker can achieve.

Zero trust is the opposite of the old “trust, but verify” methodology—instead, it’s a risk management approach that translates to: “trust nothing and record everything.”

What’s Outside Is Already In

For decades, a basic tenet of security was to assume anything inside the perimeter was safe. In reality, internal cybersecurity violations happen all the time, from inadvertent issues, such as clicking on phishing emails or leaving screens open when leaving a workstation, to malicious insiders bent on stealing classified documents or sabotaging key assets. Both scenarios mean your data and systems are likely compromised in some way already.

The perimeter itself has become malleable even before our new COVID world: It now includes cloud storage and apps; remote endpoints, such as mobile devices for field staff or teleworkers; IoT devices; and vendor systems, such as kiosks and credit card terminals, which can be found on ships and bases worldwide. 

This means there are exponentially more ways to compromise users and systems than ever before. If you are only focused on compliance, you’re likely always going to be cleaning up after breaches, rather than hunting—and stopping—intruders before the damage is done. What’s required is changing the mindset from “protect the network” to “secure the users, assets and resources.”

Knowing Who’s Knocking on the Door

In NIST Special Publication 800-207, a  key element of zero trust is described as a focus on protecting resources instead of network segments; users and assets aren’t trusted solely because they are on the network. 

Robust authentication is essential to this approach. User credentials need to be confirmed through identity management procedures that involve more than just a username and password, or even a common access card or personal identity verification card. Authentication may also include biometrics and behaviors to determine if the correct person is using an expected device in the usual way from a likely location.

At the same time, security can’t interfere with personnel’s ability to do their jobs. By automating much of the authentication process, which can be done using AI tools, delays should be minimized without reducing security

The Path Forward

Compliance usually comes down to “yes-or-no” questions, distilling complex variables into a simple, binary checkbox. Add in standards that also rely on long-in-the-tooth technologies, such as file-based antivirus software that are always playing catch-up with evolving threats, and it’s too easy to create a false sense of security.

A zero-trust approach assumes a problem exists, while compliance is most often focused on prevention. Zero trust is a framework, not a product or service. This gives agencies a huge benefit: instead of being locked into a single vendor, IT leaders can choose the best technologies to monitor, manage and control access to resources wherever they reside. 

However, this flexibility is completely dependent on the technologies’ ability to interact with each other. Enabling open interoperability and adopting interchange standards between different vendors’ technologies should be insisted upon by government from the vendor community.

Most of all, agencies need to realize that moving to zero trust will take time and resources, so a long view is a necessity. Zero trust is as much a cultural shift as a technological change, requiring agency leaders to start with the premise that the network is already compromised. Steps can then be taken to minimize the risk while still allowing users to access data and collaborate with their teams. 

The job of security is to protect the mission. With a zero trust approach, security can become an enabler that allows smarter access to systems and data while delivering a greater level of protection, helping to drive the mission forward.

John Harmon is regional vice president of Cyber Solutions at Elastic. He has spent the past 17 years in the U.S. intelligence community as a SIGINT analyst, cyber capabilities developer, technical team lead and federal sales director in cybersecurity.