Observability: The foundation of zero-trust networks
Connecting state and local government leaders
By identifying and tracking every app, user and transaction flow, agencies can gain complete visibility into their entire cyber ecosystem and build a zero-trust architecture.
In December, Defense Information Systems Agency Director and Vice Adm. Nancy A. Norton announced that the immense increase in work-from-home arrangements within the Department of Defense has expanded the cyberattack surface of agencies. This is why, she said, the DOD is determined to transition to a zero-trust architecture.
“We are being attacked in the cyber domain constantly,” she said, “with state and non-state actors generating more than a billion cyber events a month on our networks across every DOD component around the world.… We are moving towards more micro-segmentation in this cybersecurity model with zero trust. It will apply to our data and critical resources from our data centers to our mobile devices.”
More recently, Federal Chief Information Security Officer Chris DeRusha told lawmakers in March testimony before the Senate Homeland Security and Government Affairs Committee that the White House will push agencies to move toward a “zero-trust paradigm.” He cited Russia’s massive hack of SolarWinds software last year -- in which adversaries easily accessed emails at the Treasury, Justice, Commerce and other departments -- as an urgency driver for a major overhaul in cybersecurity policies and practices. “Successful implementation will require a shift in mindset and focus at all levels within federal agencies,” he said.
So what is zero trust? At its core, it is about following the tenets of “never trust, always verify.” Security teams must assume the network is hostile, with threats either already inside the virtual gate or plotting to gain entry. Palo Alto Networks -- where John Kindervag, one of the first analysts to champion zero trust, once served as field CTO -- describes zero trust as requiring consistent visibility, enforcement and control that can be delivered directly on a device or via the cloud. The concept inevitably involves the enforcement of least privilege, limiting access to only that needed to perform an approved/authorized function.
Fortunately, this transition is well underway: Nearly one-half of federal government IT decision-makers report their agency is “substantially” on the way to adopting zero trust to protect access to agency resources, according to research from Duo Security. Seven of 10 say zero trust has emerged as a greater priority as more apps and devices access agency resources.
However, 53% respondents say they are average at best at limiting access to individual enterprise resources on a per-connection basis, and 48% indicate they are average at best at allowing access to resources according to existing policy and observable user behavioral attributes. Forty-two percent admit they are average at best at enforcing dynamic and strict user authentication before access is allowed. All three of these capabilities are considered foundational building blocks for an optimal zero-trust architecture.
Given the challenges, CISOs and their teams should focus on a single, essential capability as they seek implementation: absolute observability. Without it, there simply is no zero trust.
ON2IT, the security company where Kindervag currently serves as senior vice president of cybersecurity strategy, recommends that organizations start small by drawing up a zero-trust risk map. To do so, they must define their “protect surface” by identifying and classifying every app and user regardless of where they exist. Without this complete visibility of the entire cyber ecosystem, agencies cannot develop an adequate risk map.
Then, agency CISOs and their teams must track all transaction flows, which is where observability -- or, to be more specific, automatic and intelligent observability -- again proves indispensable. With this, they continuously monitor and capture all data from logs, metrics and end-to-end transactions, deploying artificial intelligence to set performance baselines and automatically identify anomalous and potentially threatening activity in the interest of enforcing least privilege.
It’s encouraging to see that the federal government is committing to zero trust. But agencies will never get there unless they can get a grasp on “what is talking to what,” 24/7/365, throughout the entire enterprise. They must arrive at a logical and comprehensive breakdown of what their systems are and how they work at every transaction level. By combining observability, automation and AI, agencies will achieve optimal absolute observability -- and thwart attacks such as the SolarWinds hack before they even get started.