Mitigating cyber risk with zero trust
Connecting state and local government leaders
With every point in the infrastructure supply chain being carefully scrutinized, zero trust can help agencies authenticate and manage the onslaught of new devices that need to access secure networks.
With the rise of COVID-19, the need for a holistic policy framework that can effectively manage security issues across a highly distributed workforce has grown exponentially overnight. As the public sector adjusts to emergency measures, zero trust can mitigate risk and ensure that operations continue with minimal disruption.
Managing third-party risk
The rapid shift to remote work pushed government agencies to new solutions, but many popular options for the private sector, like Slack and Zoom, simply do not meet the security requirements of a government environment. Zero trust establishes a framework for minimizing risk in third-party software by examining security gaps that occur as new platforms are adopted. It also unifies authentication policies in-house, minimizing vulnerabilities created by insufficient security practices of outside vendors.
Government IT managers on-boarding a number of new devices and remote users at once, can apply zero-trust principles to streamline the authentication process to ensure that all new laptops and phones are vetted before being granted access to sensitive information. With every point in the infrastructure supply chain being carefully scrutinized, zero trust can help agencies authenticate and manage the onslaught of new devices that need to access secure networks by:
- Verifying devices with end-point posture assessments to validate them before they connect.
- Verifying all users with single sign-on and multi-factor authentication to ensure they are authorized before connecting.
Continuous verification, the foundation of zero trust, ensures that compromised devices cannot access agency networks, even if they have been verified previously. As the need for remote work continues, this regular verification and authentication promotes security, even as hackers’ tactics evolve.
Maintaining regulatory compliance
Zero trust gives agencies better visibility throughout their infrastructure, making compliance easier to manage. Implementing measures to protect data from end to end, with technologies like always-on virtual private networks that offer flexible load management, means IT teams can ensure that every transaction is encrypted, thus reducing data leakage and increasing security compliance.
Even within secure networks, controlling access with centralized policy management ensures users can only access the cloud or data center resources necessary. By understanding what users are accessing and managing complex permissions, IT teams can minimize the risk of insider threats. For large agencies that need to enforce a wide number of permissions and clearances, data visibility and nuanced user access management is critical to maintaining operational continuity as well as adhering to reporting and oversight requirements.
Encouraging accountability in a distributed workforce
Keeping employees accountable and informed in the face of rapidly evolving threats like COVID-19 becomes even more difficult. Malicious actors, including hackers directly employed by or affiliated with the governments of Russia and North Korea, have been escalating their attacks. With zero trust, IT managers have clear standards that require employees to authenticate themselves and their devices, as well as adaptable policies that can evolve to meet increasing threats.
Crises like this pandemic highlight critical infrastructure gaps and the need for technologies that can adapt to user needs while protecting vital information. Zero trust provides a framework for managing risk in the security ecosystem, including new users, devices and additional platforms. As the National Institute of Standards and Technology continues its research into zero trust as a broadly applicable framework for all organizations, IT managers can begin scaling zero trust protocols across their agencies as they adapt to remote work and other COVID-19 emergency measures.