An agency can run a completely compliant network and still be breached by a trusted user’s account being exposed.
The U.S. government is one of the largest cyber targets in the world. With a broadening array of endpoints globally, agency networks are increasingly vulnerable to malware, spyware and ransomware, and there have been a number of high-profile breaches that exposed vulnerabilities inside those networks. The government obviously regards cybersecurity as critical, but the current cyber requirements for agencies are heavily focused on compliance.
Put simply, compliance is not security; compliance is accountability and ensuring specific security requirements are met. Those requirements have traditionally assumed that enterprise users are trusted and have access to all internal corporate assets. An agency can run a completely compliant network and still be breached by a trusted user’s account being exposed.
Zero-trust security assumes no user or device is trustworthy. All authentication is continuously validated and recorded in real-time and rather than taking for granted that a user who logs on with the right credentials is who they say they are, a zero-trust approach is built on giving least-privilege access to that user. This limited access reduces damage and loss a potential attacker can achieve.
Zero trust is the opposite of the old “trust, but verify” methodology—instead, it’s a risk management approach that translates to: “trust nothing and record everything.”
For decades, a basic tenet of security was to assume anything inside the perimeter was safe. In reality, internal cybersecurity violations happen all the time, from inadvertent issues, such as clicking on phishing emails or leaving screens open when leaving a workstation, to malicious insiders bent on stealing classified documents or sabotaging key assets. Both scenarios mean your data and systems are likely compromised in some way already.
The perimeter itself has become malleable even before our new COVID world: It now includes cloud storage and apps; remote endpoints, such as mobile devices for field staff or teleworkers; IoT devices; and vendor systems, such as kiosks and credit card terminals, which can be found on ships and bases worldwide.
This means there are exponentially more ways to compromise users and systems than ever before. If you are only focused on compliance, you’re likely always going to be cleaning up after breaches, rather than hunting—and stopping—intruders before the damage is done. What’s required is changing the mindset from “protect the network” to “secure the users, assets and resources.”
In NIST Special Publication 800-207, a key element of zero trust is described as a focus on protecting resources instead of network segments; users and assets aren’t trusted solely because they are on the network.
Robust authentication is essential to this approach. User credentials need to be confirmed through identity management procedures that involve more than just a username and password, or even a common access card or personal identity verification card. Authentication may also include biometrics and behaviors to determine if the correct person is using an expected device in the usual way from a likely location.
At the same time, security can’t interfere with personnel’s ability to do their jobs. By automating much of the authentication process, which can be done using AI tools, delays should be minimized without reducing security.
Never miss a story with the daily Govtech Today Newsletter.
This content is made possible by our sponsors; it is not written by and does not necessarily reflect the views of e.Republic’s editorial staff.