Zero Trust is Difficult to Deploy, but Vital for Agencies

For U.S. federal government agencies, it’s a Presidential mandate they have to deploy a zero trust cybersecurity architecture, but how broadly and cost-effectively has to be a big part of their plan.

The zero trust model has been gaining momentum in the government in the last few years. It got a particularly strong boost with the White House’s May 2021 executive order to improve national cybersecurity. That order mandated all federal agencies develop a plan to implement zero trust architecture, based on the migration steps outlined by the National Institute of Standards and Technology (NIST) within the Department of Commerce.

The push toward zero trust—the concept that users and devices should not be trusted by default, even if they were previously verified—could not come at a better time. Many employees still work remotely or in a hybrid model, using their own devices and networks to access networks. Cloud services usage continue to rise within government, as does demand for digital transactions. Meanwhile, cyber threats such as ransomware are getting increasingly sophisticated and costly.

All of this adds up to more risk for agencies, and the need to be especially vigilant about the identities and authentication of users trying to get access to systems and data. That’s where zero trust can make a big difference. The model is particularly important for cross-domain access, including restricting access to highly secured systems.

Access is Everything

One of the biggest security challenges agencies face is controlling who has access to what information, said Peter Dunn, Chief Technology Officer Federal and Robert Smith, senior manager of professional services at IT services provider CDW-G. Individuals who think they need to access certain information to achieve a mission, but are blocked by policies, try to circumvent security provisions, Dunn said.

“When it comes to the security of any solution, the user is your weakest link. You could put in the best [tools] and the right policies, and you’re still going to have to worry about the user,” said Dunn.

Because a key component of zero trust is managing identities, the model can help organizations ensure that only qualified users have access to data resources, including cross-domain access.

Identity is a difficult article to manage, however. Many security programs assume that if they have Microsoft Active Directory or another application, that will provide the identity assurances they need to protect their networks. “The problem is, they don’t just need identity,” Smith said. “They need the identity, the credential and the access management, and they all work hand in hand with one another.”

One portion of a solution provides identity management, while another provides credential management, and still another provides access management, all while ensuring that there’s federation between all devices and components and enforcing governance and policies that are required, according to Smith. “It comes down to we don’t trust anything. It’s a constant cycle of revalidating and ensuring that trust is always there,” Dunn said.

Cross Domain Solutions

Agencies might face other challenges when it comes to adopting a zero trust model, Smith said. For one thing, there are the budgetary restraints that can keep agencies from deploying tools and services needed for zero trust. For another, there’s the complexity of implementing these tools and services into existing environments.

Following the executive order, when agencies realized they needed to improve security to meet the mandate, “the biggest problem was everybody believed zero trust was an easy-to-implement methodology,” Dunn said. “But zero trust is not just a matter of buying some new hardware and software. It’s not only the addition of items to the network or policy changes, it’s a mindset change for the way things operate.”

CDW-G is working with more than a thousand industry partners to build and implement technology solutions that support secure cross-domain access in a zero trust environment.

Over the last year or so, “the biggest hurdle for our industry was educating our federal customers and partners alike, so that they could see what zero trust really looked like,” Smith said. Many agencies want to shift to zero trust on an aggressive timeline, when what’s really needed is a methodical approach of implementing it in phases, he said.

Part of the education process involves explaining how zero trust can work for cross-domain access and what tools and policies are needed.

“Unfortunately, when it comes to zero trust commercial cross-domain solutions provide a portion of zero trust; they don’t provide the whole thing,” Dunn said. “When you’re looking at cross-domain solutions, it also takes the implementation of proper policy, risk management and governance, proper authentication mechanisms and authorization mechanisms, and the constant reminder that nothing on the network is trusted. The difference between normal cyber security and zero trust policy is that zero trust automatically assumes that everything is bad and we don’t trust anything until it’s been completely validated.”

CDW-G is working with more than a thousand industry partners to build and implement technology solutions that support secure cross-domain access in a zero trust environment.

Holistic Solutions

By deploying leading tools and services from a variety of vendors in the market, government customers can get “the latest and greatest in each one of the avenues, from endpoint devices to storage capabilities to security analytics to network monitoring,” Smith said. “One of the benefits of CDW-G working with its partners and its customers is we’re a trusted integrator for the NSA [National Security Agency], so the commercial solutions for classified [data] were already approved and on the list by the NSA.”

These solutions have already been deployed by many customers within the government, Smith said. CDW-G also has a capability called Enterprise Security Management Infrastructure. This is essentially a security suite coupled with support services to provide federal agencies with a platform that can not only monitor what’s going on currently from a security standpoint, but predict what will happen in the future.

Beyond technology tools, “we have individuals who can assist customers with developing policy adhering to governance and making sure they are staying ahead of the threats that are coming out,” Dunn said.

Perhaps the most important thing to keep mind as agencies move to a zero trust security model is that no one technology tool, or policy change or process shift will make an agency a “zero trust organization.” It requires a dramatic change in thinking about security at all levels of the organization.

“They can’t just go and buy another piece of hardware or software,” Smith said. “Zero trust is a holistic solution that needs to encompass all of the facets of their networks, governance, policies etc.”

Many government agencies might already have 60 per cent to 80 per cent of the technology that’s required to implement zero trust, Smith said. It’s just a matter of realigning existing tools with other pieces that might be missing and creating new policies to enforce the zero trust model. But even if an organization already has most of the tools it needs, that doesn’t mean getting to a full zero-trust state will be simple.

“Zero trust is not convenient; it is going to take time and it’s going to take effort,” Smith said. “You have to evaluate how everything is going to interact with everything else.”