Zero trust 2.0: The answer to government’s cyber woes

COVID-19 disrupted the cybersecurity landscape as industries adopted remote working to maintain business continuity. The digital shift contributed to the proliferation of data breaches and ransomware attacks, crippling organizational infrastructure and services -- prompting more than 35% of cybersecurity professionals polled by Deloitte to cite the remote workforce and insider threats as primary reasons for zero-trust adoption.

The government sector is no exception to these challenges as bad actors targeted numerous federal agencies in 2020. According to the Department of Homeland Security, the Census Bureau was victim to an attempt to access its sensitive data, change registration information and even compromise the agency’s infrastructure. Meanwhile, the Department of Veteran Affairs suffered a data breach that compromised information of roughly 46,000 veterans. Both incidents are just the tip of the iceberg and have inspired agencies and cities to adopt a zero-trust framework.

A couple of glitches in zero trust

As the name implies, zero trust protects all touchpoints linking to an organization’s network with the sole purpose of transforming it into an impregnable fortress. The New York City Cyber Command, for example, recently announced its plan to adopt a zero-trust framework within New York, aiming to refine the city’s security posture. Given the uptick in cybersecurity incidents and impact of remote working, it is understandable why government agencies have turned to zero trust.

Though it offers Fort Knox-style protection, zero trust also introduces friction and puts users through rigorous checks. With zero trust, employees must validate their identification at every touchpoint to achieve access, interrupting their user journey. Roughly 61% of employees had trouble accessing their network during the first half of 2020, prompting them to consider alternative methods (e.g. personal devices) for access and increasing the organization’s exposure to new risks. IT departments may also lack the appropriate tools to manage zero-trust policies, which can complicate password resets or exacerbate login issues.

The answer lies in zero trust 2.0

Zero trust is advantageous, but the U.S. government must implement new technologies that provide robust security measures without compromising the user experience. This new approach is zero trust 2.0 -- it leverages machine learning and passive intelligence factors to reduce any impact on security and the user experience. For starters, zero trust 2.0 can better protect passwords and profiles with features like keystroke dynamics or intelligent swipe authentication.

Even as agencies scale up their cybersecurity measures, cybercriminals’ malicious campaigns demonstrate greater sophistication. In December 2020, federal agencies fell victim to the SolarWinds breach, affecting the Departments of Commerce, Energy and Treasury as well as affiliated agencies, including the National Telecommunications and Information Administration. U.S. officials speculated that Russian hackers initiated the breach and gained unfettered access to these federal agencies through employee email accounts.

Zero trust 2.0 can deliver more effective protection as it enhances cybersecurity measures through personal habits, which are virtually impossible to replicate. Government employees’ digital behaviors are key to protecting their agency’s network from illicit access.

Making zero trust 2.0 a reality

While some agency officials may be complicit with the friction within their current security infrastructure, employees may be more productive with a solution like zero trust 2.0 that balances convenience and security.

For a seamless adoption of zero trust 2.0, the Cybersecurity and Infrastructure Security Agency (CISA) must:

• Recognize the benefits of machine learning. Unfortunately, not all authentication events are created equal. A user providing authentication via fingerprint reader on a high-end device will likely be more secure than a user providing authentication via a PIN on a low-end device. Chief information security officers must consider all factors when adopting any solution. They should focus on gathering data from a vast array of inputs and learn which events are more secure and which require a closer look.
• Apply an orchestration layer capable of managing identity and access policies. Prior to orchestration layers, managing the huge and ever-changing ecosystem of users, devices and applications was almost impossible. Now, CISOs and IT managers can create and modify access control policies across different business units and geographies with a few clicks of a mouse. This will eliminate their reliance on development time and making the dream of a dynamic zero trust architecture a reality.

Feel safe and secure with zero trust 2.0

CISA must consider which technologies will best safeguard the U.S. government from prolific cyber threats while providing federal employees the immediate access and speed to the data and resources they need. Zero trust 2.0 can be adopted within a single integration, proving more sustainable and adaptable than its predecessor.

Cybercriminals are becoming bolder and more sophisticated in their attacks, and the U.S. government is a prime target due to the amount of sensitive information within its network. By implementing zero trust 2.0, the federal  government can shrink its attack surface, enabling it to keep pace with the constantly evolving cybersecurity landscape.