How governments can trust IT security: It’s all about identity

For the government, cybersecurity is all about trust. In fact, a decade-old concept known as “zero trust” is attracting a strong following among agency IT departments who see it as a way to combat the average of 100 cyber assaults they face each day.

Zero trust replaces the “castle and moat” approach to security, where organizations protect their perimeters and assume everything inside is, therefore, safe. Instead, it posits that anyone logging into a network -- whether outsiders or insiders -- poses a possible threat.

According to a recent survey, nearly half of U.S. federal government agencies, including the Agriculture Department and the Marine Corps, are already adopting zero trust. However, while adoption is increasing, consistent implementation and monitoring is key for zero trust to succeed. For most government agencies, getting the most from their security protocol will come down to how they utilize three critical technologies: multi-factor authentication (MFA), endpoint device security and self-healing capabilities.

Setting a new standard for multi-factor authentication

By now, most users have some experience with MFA, in which they are asked to input multiple pieces of information to access a system. This could involve any combination of passwords, hardware tokens, alphanumeric codes that are texted to them, biometrics, images, locations or personal information.

About 90% of federal agencies have already adopted basic two-factor authentication, according to a 2018 Office of Management and Budget analysis. However, agencies must deploy more advanced MFA technology -- which could involve three or more authentication factors -- to have the best defense against bad actors.

Time and budget constraints no doubt play a role in adoption rates. It’s never easy to know which technologies to pursue and dedicate resources to, so departments often struggle with paralysis by analysis. Some chief information security officers also fear that too many authentication factor requirements could dampen user experience.

Effective zero trust, however, requires three or more authentication factors. To make that friendlier for users, some PCs and mobile devices are now optimized with client security management features built in to support MFA functions.

Building resilience with endpoint device security

Endpoint devices, such as PCs and network printers, are ubiquitous in agencies and carry as much risk as any other connected machine. However, IDC research shows that almost half of companies treat endpoint security as a secondary issue. In other words, they are not addressing it holistically in their security strategies. Government agencies, like the private sector, must safeguard their endpoints, which are the origination point for 70% of successful breaches, according to IDC.

More often than not, these breaches involve hackers or scammers taking advantage of employee errors, such as clicking on a malware-launching hyperlink, plugging in passwords, leaving screens on in plain view of passersby or losing their laptops altogether. In fact, 77% of information security professionals in a Code42 survey said the most significant risk to organizations are employees doing their jobs with insufficient attention to security protocols.

Government agencies must be prepared for any kind of attack that comes through the network and continue to proactively invest in next-generation security protocols. They must proceed on the assumption that breaches are inevitable and adopt “security by design” features that facilitate or automate malware detection and deletion. Agencies can protect many of their endpoints with hardware-based isolated browsing that allows PCs to trap malware in virtual containers and keep it from infecting IT systems.

Investing in the next generation of self-healing technology

In an increasingly connected world, it goes without saying there will always be cybercrime. No matter how strategic an IT security department might be with its defense infrastructure, data breaches will invariably still occur.

That is why a strong disaster recovery program must play a central role in any zero-trust initiative. With ransomware, in particular, threatening to take down government systems for weeks or even months at a time, getting everything back up and running as quickly as possible is vital.

IT security professionals have long talked about accomplishing this goal with self-healing systems, where embedded features automatically check if computers or printers have been compromised, then isolate or shut down corrupt systems and return them to the last-known “safe state” with minimal impact.

The onset of next-generation self-healing technology has demonstrated how machine learning and artificial intelligence can detect and block attacks before they happen. A recent Capgemini survey found that about one in five security organizations used AI before 2019, but two out of three plan to incorporate the technology in 2020. There is also the potential for AI to help with recovery when systems are penetrated and even automatically adjust cybersecurity configurations based on what the machines learned from each cyberattack.

Adoption of zero-trust initiatives is no longer a wish list item for government agencies. Rather, it’s an imperative for the security of information and employees. If government agencies are going to trust in anything at all, it should be in the notion that they must have the best IT security their budgets will allow. Nothing less will suffice.