New cybersecurity standards from the Maryland Department of Information Technology call for agencies to adopt zero-trust principles over the next 18 months.
Zero trust refers to a cybersecurity philosophy and practice that seeks to limit exposure to hackers and other criminals by continuous verification of users, securing parts of networks to defend against widespread attacks, making sure individual and varied devices carry ample defenses, and other tactics.
Other states are taking a closer look at zero trust, and Maryland’s newest policy, detailed in the recently issued Cybersecurity and Privacy Policy Suite, aims to reduce cyber risk for state agencies.
Local governments, along with the state’s legislative and judicial branches, are not required to follow the new guides but are encouraged to do so, according to a statement from the information technology department.
“Cybersecurity threats are only getting more and more advanced. Our state needed a simple, unified approach to ensure our systems, services and data are fully protected in this modern environment," said Katie Savage, secretary of the Maryland Department of Information Technology, in the statement.
The new policy seeks to “shift the state away from the traditional ‘trust, but verify’ approach to a ‘never trust, always verify’ mindset, particularly for high value state systems, by requiring continuous validation of identities and security postures,” according to the document.
That means no device or user will earn trust based only on its network location, and that all users inside and outside an agency’s network will have to be “continuously authenticated, authorized and validated before being granted access to applications and data.”
The department says its crafted the new policy with input from state agencies, local governments and cybersecurity experts. More than 1,200 comments helped guide the policy to completion.
“Cybersecurity is a team sport, and we are all Team Maryland,” said James Saunders, Maryland’s chief information security officer, in the statement.
