Getting started with TIC 3.0

Government agencies are constantly working to meet the expectations of a workforce that requires simple, secure and scalable access to data and applications. These needs have increased exponentially over the course of 2020 due to the pandemic and the new normal of remote work. With the current situation expected to continue well through 2021, it is important for IT teams at federal agencies to understand and embrace the latest guidance laid out by Trusted Internet Connections (TIC) 3.0.

Years ago, when TIC guidance was originally introduced, the focus was on establishing and tightening perimeter security for government agencies. The belief was that there were simply too many access points into and out of government networks, creating untold security risks. The idea was to collapse these into fewer entry and egress points and then fortify the ones that remained.

While this seemed like the correct roadmap at one point, it failed to take into consideration just how quickly organizational traffic patterns would change, long before the pandemic hit. Since the initial framework, cloud computing and remote access have become widely deployed, meaning that TIC architecture had to evolve to more efficiently support these use cases.

Understanding the new framework

TIC 3.0 takes a major step toward allowing government agencies to utilize the same technologies available in the private sector. The new framework provides guidance that enables reliable and secure cloud access, branch office connectivity, and a high-quality remote user experience. These are all critical elements to the modern way of working -- and were previously difficult to roll out at agencies trying to adhere to the 2.0 guidelines.

In short, TIC 3.0 helps eliminate the barriers to cloud adoption.

TIC 3.0 recognizes that there are different types of internet traffic, with different purposes, priorities and risks. TIC 2.0 tried to push all traffic through a single access point, creating unnatural traffic patterns that slowed down performance and responsiveness, hurting the employee and/or citizen experience. TIC 3.0 fixes this problem, recognizing the need to account for multiple and diverse architectures and ways of working.

TIC 3.0 allows for distributing security enforcement to different locations along the network, as long as the deployed protections maintain a commensurate level of defense based on the agency’s (and traffic’s) risk. Security capabilities, or policy enforcement points, can be installed closer to the data, rather than forcing the rerouting of data to specific areas. This is where TIC 3.0’s understanding that there are different types of traffic (and different risks associated with each) becomes important.

Many have asked: “How can an organization validate that it is TIC 3.0 ready?” Unfortunately, there’s currently no easy answer. TIC 3.0 is non-prescriptive, in order to create flexibility. With TIC 2.0, validation was easy. The goal was to pass all traffic through the same access point. If agencies did that, they were successfully following the guidelines. With 3.0, agencies are required to self-attest on their adherence to the framework. It is up to the specific governmental entity to determine the risk level for its internet traffic and make the correct decisions. Agencies must ask themselves:  “What types of traffic are coming into and leaving the network and what security is in place to match it?”

Getting started

With TIC 3.0, government agencies can avoid the inherent inefficiencies and performance constraints of traditional hub-and-spoke network architectures, providing better service quality and user experiences through cloud applications and services. To realize the benefits of the new framework, however, agencies should start with a few main steps:

1. Understand employees’ needs

What types of technologies and services do employees need to do their jobs successfully? Do they need a mix of cloud-based services and mobile device capabilities? What are the most critical services that the network must deliver to ensure employees are successful in their mission?  Agencies should review how their employees work -- or should be working -- and evaluate the available resources to empower them.

Agencies have probably already done some work in this area, given the pandemic and the shift to remote work. Are things working as planned? Are there improvements that can be made? Now that we’re nine-plus months into the remote-working lifestyle, it’s a great time to audit the setup, get feedback and plan to make adjustments. If a work-from-home schematic was rapidly rolled out when the pandemic hit, it’s a good time for agencies to ensure the architecture reflects the latest TIC 3.0 guidance.

2. Understand constituents’ needs

End users expect services to be delivered quickly and efficiently without interruption. This is true of any end user, but even more so of citizens. Have agencies providing user-facing services been doing so successfully? Is the traffic getting to and from the network efficiently and securely -- and are folks satisfied? Are there areas where the traffic flow or response time can be improved? Were there any problems when the pandemic hit with bandwidth or providing service? Taking a moment to review the actual -- and expected future -- needs of end users can help ensure that any changes are made while keeping their overall experience in mind.

3. Understand traffic and levels of risk

A large part of TIC 3.0 is that it leaves it up to the agency to self-audit its traffic and determine where there is risk and where there is not. The framework now understands that there is traffic of differing levels of importance -- say, for example, an inter-agency team meeting taking place over Zoom vs. an encrypted set of plans being shared over email. 

It may be helpful to look again at all critical systems traffic and develop a directional service matrix. Identify the tenants that must access exposed network services -- whether internal or external to the enterprise. Too often, shared systems are granted a wide scope of access. What is the risk if this shared system is compromised?  Do shared systems need access to enterprise systems or the internet, or can service scope be limited?  Can remote users and cloud traffic be managed in a more precise and directional manner to limit the attack surface of a compromised system?  Some of the key tools to determine risk are architectural documents, system design information, existing security documentation and any key artifacts, such as previous assessments or authorizations. 

TIC 3.0 has given agency teams the opportunity to manage traffic on their own terms.  The flexibility embedded into the framework makes it possible for government organizations to select the security approaches they want and implement them how they best fit into their current networks and future roadmap. They just need to fit the tools to the traffic and assumed risk.

4. Leverage existing materials

While TIC 3.0 has been intentionally designed to be flexible, that doesn’t mean agencies are on their own. Quite the opposite, in fact. The Cybersecurity and Infrastructure Security Agency, which manages the TIC program, reminds government executives to “... leverage the Security Capabilities Catalog, use cases, and overlays when implementing the TIC capabilities in their network environment. These documents, in conjunction with documents like National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and NIST Special Publication (SP) 800-53, will help agencies design a secure network architecture and determine the appropriate requirements and service providers tailored to their agency.”

As government IT managers know, CISA also issued remote access guidelines at the start of the pandemic to help agencies determine how to securely support telework. A draft version of the TIC 3.0 Remote User Use Case was released at the end of December 2020 and will be open for comments until the end of January 2021. That said, if agencies are looking to implement TIC 3.0 before the new use case has been finalized, then the guidelines and the draft can serve as a solid guide to what the final guidance will look like.

Agencies and organizations across the government are actively migrating their IT infrastructure, applications and services to the cloud to save money, improve the service they provide and accelerate innovation. To embrace the TIC 3.0 framework -- and its flexibility -- when designing future network and services, agencies must first understand their own traffic and how that is strongly tied to their employees’ and end users’ needs. TIC 3.0 makes it possible to strengthen network security, while improving the speed, efficiency and cost-effectiveness of the organization.