3 ways agencies can fix their lagging digital verification infrastructures
Connecting state and local government leaders
To ramp up authentication safeguards, agencies should monitor for leaked credentials, enforce agencywide access controls and promptly share threat information with the appropriate authorities.
Bipartisan members of the House recently introduced legislation that would require the government to drastically modernize the United States’ digital identity infrastructure. At the same time, lawmakers are calling on the Office of Management and Budget to examine the feasibility of a federal governmentwide digital identity verification system.
Both efforts are long overdue. Unfortunately, the absence of secure, accessible, interoperable digital credentials increases security vulnerabilities, encourages online fraud and inhibits the expansion of digital public services.
As agencies await federal guidance and standards, here are three things they can do now to ramp up their safeguards and begin to fix the nation’s “lagging” digital verification system.
1. Monitor for leaked credentials
If account credentials -- such as a username, email address and password -- are breached, federal IT administrators must know as soon as possible. Widely available on the dark web, credentials are one of the most sought-after data types by hackers. Indeed, for four years in a row, the 2021 Verizon Data Breach Investigations Report found 61% of data breaches involved credentials. All it takes is one leaked credential to create a whole trail of woes.
When a single email account is compromised or taken over, a hacker can access sensitive data, initiate social engineering attacks, propagate spam and malware and move laterally across an agency network. And, because most people use the same credentials for multiple systems, threat actors can easily use the same username and password to breach mission-critical applications.
To stay one step ahead of credentials leaks, agencies must continuously monitor their email domains for exposure. They should also set up alerts to ensure they’re immediately notified when credentials are found on the dark web or accounts are compromised. Lastly, they should leverage tools that automatically force password resets before they can be misused.
2. Enforce agencywide access controls
Protecting every network endpoint with a digital verification mechanism would seem a logical approach to safeguarding federal systems. However, a lack of resources, funds and time means tools such as multifactor authentication are often reserved for critical entry points such as VPN and email. But as the network perimeter widens and digital ecosystems expand to include cloud-hosted data, applications and services, agencies must prioritize checks and balances to ensure users can prove their identity.
Fortunately, many of the basics of digital verification, such as multifactor authentication and access rights management, can be implemented at scale and across hybrid environments in an automated manner -- ensuring users have appropriate access rights while reducing IT workload.
Agencies can also better secure their growing network perimeter and cloud-based applications by layering in emerging technologies like secure access service edge. SASE is a cloud service that converges security and network technologies into a single platform. Taking a zero-trust approach, SASE prevents unauthorized access by layering security on top of the network. Using defined policies, SASE dynamically approves or denies access, eliminating the need for multiple point security technologies.
While emerging technologies are worth exploring, they are not a silver bullet. As the most recent SolarWinds® Public Sector Cybersecurity Survey found, a widespread lack of organizational maturity in critical areas of cybersecurity persists across government. Notably, foundational security capabilities, such as multifactor authentication, require attention if agencies are to keep up with evolving threats.
3. Focus on public-private partnerships
Tools and technology can only go so far. Building the government’s digital ID infrastructure also requires a collective effort. As malicious actors increasingly look to take advantage of the nation’s digital dependencies, a successful defense will require enhanced levels of public-private partnership.
This collective defense approach is being encouraged by The White House. The May 2021 Executive Order on Improving the Nation’s Cybersecurity calls for the private sector to “partner with the Federal Government to foster a more secure cyberspace.”
What this partnership will look like is to be determined, but the executive order is an important step toward achieving a collective defense posture. The coordinated disclosure of incidents and transparent, prompt information sharing -- in a “safe place” free from public shaming or criticism -- only helps protect us all.
NEXT STORY: DHS Cybersecurity Talent Management System