Implementing zero trust for government clouds

State and local governments have been plagued by hackers, especially since the big pivot to remote work during the COVID-19 lockdown. Securing cloud-based assets has been an ongoing battle for government security professionals. As more operations migrate to cloud servers to save costs and improve efficiencies – cybercrime has migrated with them. 

Today’s workplaces are complex and depend on multiple cloud-based resources, making them difficult to secure with traditional perimeter defenses that protect on-premise networks by relying on passwords and firewalls. Government entities of all shapes and sizes must embrace zero trust principles and adopt processes and technologies that limit access to resources to only what is actually needed, and only for the moment, not for all time.   

At first glance, zero trust is a sensible policy that simplifies governance and enforcement of access policies in these complex environments, but adopting zero trust architecture also comes with some challenges. 

First, shifting away from trusted networks and users is a new approach for most organizations, including a large number of governmental agencies. The process of adopting zero trust will force them into a journey outside their comfort zone. The Office of Management and Budget’s own memorandum about zero trust noted that the basic tenet is  “a principle that may be at odds with some agencies’ current approach to securing networks and associated systems.” Users and administrators will need to adapt to new practices and technology tools, such as multifactor authentication (MFA) and identity access management systems. 

Second, no one solution provides full zero trust architecture and compliance. A recent survey found cybersecurity was the top priority for local government CIOs in 2022—followed closely by improving outdated legacy IT systems. Agencies will need to support zero trust with multiple solutions and strategic initiatives at multiple layers, including MFA, identity authentication, authorization and traffic encryption at several levels. 

Finally, all security starts with knowing what assets must be secured. Visibility and transparency are common to all security approaches and to security officers. Any attempt to change network infrastructure—including zero trust adoption—must begin with identifying all internet-accessible assets. That’s not always easy when resources are housed on the cloud. Governments need deep visibility, including into the multicloud environments that are increasingly the norm. Nearly a third of the city and county CIOs who said cybersecurity is a top priority are also planning to migrate more assets to the cloud in the next two years. Administrators need to know every identity in the environment, what each one’s access level is and the difference between their current entitlements and the real access requirements for that user’s function at the moment. Once that is established, an automated remediation program should be capable of closing the gap between the user’s functions and privileges and right-sizing permissions.

State and local government organizations are facing up to those challenges. At least 4 out of 5 CIOs say adopting a security framework that’s up to national standards is a high priority; half say it is a top priority. The following best practices can ease implementing zero trust across cloud-based government networks:

• Gain visibility: The first step to zero trust is to know the resources in the network, who needs to use them, how and when. Monitor all identities, configurations, permissions and activities across the cloud infrastructure, focusing on network access and publicly exposed resources. 
• Manage risk: Perform continuous risk assessment across the full cloud IT stack including identity, network, compute and storage, as well as third-party risks brought on by clients, vendors and partners and any publicly exposed resources.
• Establish governance: Implementing least-privilege policies that regulate who has access to which resource and when and limiting that access to minimum requirements are the basis of zero trust adoption. Agencies must implement those least-privilege policies via workflows and continuous integration and continuous delivery pipelines and avoid misconfigurations that will put them at risk. 
• Hunt for threats: It’s common knowledge that credentials are the weak link in cybersecurity. To prevent credential compromise and other identity-based threats, agencies must monitor activity for behavioral anomalies and quickly detect and remediate those threats. 
• Enforce policies: Highly privileged users are a ticking time bomb in some organizations. Engineers are often granted a perpetual all-access pass when they only need it to complete a project.  Just-in-time access policies can enforce least privilege for DevOps while avoiding disruptions in the development pipeline. 

The recent infrastructure bill passed in Congress includes a significant appropriation to help state and local governments improve cybersecurity. The bill made $1 billion in grants available over the next four years to help state and governments update their systems. Now, as organizations take advantage of those grants to modernize their infrastructure, it is time to embrace identity-centric security strategies like least privilege and zero trust in order to secure cloud-based operations for the future.