States sketch out roadmaps for zero trust ‘journey’

Moving government to zero trust is sometimes referred to as a “journey” and an “ongoing challenge,” a complex challenge with no “magic bullet.” And for state governments, the road to zero trust could be even more difficult to navigate than it is for federal agencies.

States are at various stages of implementing their own zero trust approach, but progress is uneven and difficult to measure given the differences between states’ IT enterprises and the distinct ways zero trust is implemented. Making citizen-facing enterprises zero trust is often complex—more so than a single federal agency moving in that direction—and the cost to do so could be prohibitive amid strained budgets.

But state IT leaders from across the nation agree that a zero trust framework or strategy is the right thing to do, as it helps make technology infrastructure more robust against cyberattacks.

The concept of zero trust has five pillars, as outlined by the Cybersecurity and Infrastructure Security Agency. CISA said those five pillars—identity, device, network/environment, application workload and data—represent a “gradient of implementation,” and that minor advancements can be made over time in the path toward zero trust.

The model received a boost in May 2021 when President Joe Biden issued an executive order aimed at bolstering the nation’s cybersecurity, which included a call for the federal government to “advance towards Zero Trust Architecture” and mandated that the Office of Management and Budget develop a plan to implement it for federal agencies. 

While Biden’s executive order and OMB’s plan set a path forward for the federal government, no equivalent exists for state governments. Instead, many states see federal directives as a roadmap they “try to match for scope and impact,” said Montana Chief Information Security Officer Andy Hanks during a webinar last year hosted by the nonprofit Advanced Technology Academic Research Center.

Despite that guidance, some observers said that if states are to fully embrace zero trust, they will need assistance from the federal government. Brandon Pugh, a policy director and resident senior fellow for the cybersecurity and emerging threats team at the R Street Institute think tank, said the federal government could provide states with more information on how to prioritize their efforts on the journey to zero trust. 

And while it will not solve every problem, giving states more money could be crucial, he said, especially as the recent federal cyber grants will make just a small impact.

“Money doesn't solve every problem, and endless amounts of money would not instantly create a perfect world where every state has zero trust fully implemented in a very mature way,” Pugh said. “But it would help those states that are very budget strapped and have many competing priorities.”

One way of assessing how far along states are in implementing zero trust is whether it is “top of mind in security conversations,” said Jim Richberg, public sector field CISO and vice president of information security at Fortinet. And by that measure, state leaders are paying attention.

Those that have led the way on state-level zero trust said guidance already exists from the likes of the National Institute of Standards and Technology’s Authenticator Assurance Levels and Identity Assurance Levels. 

With those guidelines in place, said Adam Ford, Illinois’ chief information security officer during a National Governors’ Association webinar, states can establish a baseline for themselves, even though the system nationwide is set up so we are "50 experiments going on at the same time," he said. Illinois has included establishing zero trust as a goal of its cybersecurity strategy, which was issued in 2021.

During the same NGA webinar, Shane Dwyer, Iowa’s CISO, said one of the first steps he and his colleagues took toward implementing zero trust was building an inventory of all the systems the state uses, identifying issues and working out how to fix them, including deciding whether additional tools were necessary. Then they did the same thing with user accounts.

"What we want to do is we want to bring all these tools and technologies together in a way that they complement each other,” Dwyer said. “That's a big feat when we think about zero trust. It's not only the governance and the procedures, but the way we implement those technologies.”

Hanks said his first step was to hire a security architect who would be responsible for leading Montana’s zero trust efforts, who then took inventory of the state’s hardware, software and data before forming a game plan. He noted that zero trust is not a “black box,” but is an “incremental process” with a series of projects and steps to be taken.

When it comes to implementation, Richberg urged governments not to “reinvent the wheel,” and instead look at what has been done already and follow best practices.

The most important thing, Pugh said, is having “a plan and a path” toward zero trust. And even though it may seem too sprawling and complex for states to get their heads around, Pugh noted that “whether states realize it or not, most of them have elements of zero trust in place.”