The pandemic has revealed two important factors for federal agencies. First, agencies need a more robust IT architecture to provide citizen services efficiently and quickly with a decentralized workforce. Second, cyber threats are increasing and the need for stronger defenses is increasing.
Extensive telecommuting underscores the need for institutions to give staff access to the data they need from anywhere, on any device. In addition, the increasing use of mobile and personal devices, cloud computing, and the Internet of Things (IoT) is complicating the environment. To ensure operational security, many IT teams use a zero trust approach.
Real-time data for real-time decision making
Network boundaries are collapsing and employees are no longer working exclusively within a secure office environment. This was true before the pandemic – and it remains true. The Zero Trust architecture allows distributors to provide accurate access to users and devices. The basic premise of Zero Trust is that no one trusts. Trust must be continually evaluated and finely tuned. Authorized users can access the application regardless of whether the user is onsite or remote, an agency worker, or a third party.
This approach results in risk-based decisions. And appropriate risk-based decisions need to be based on real-time data. For example, power users have access to many features, but at the risk of trying to access the network through an older computer with older software. To accurately assess risk, agencies need up-to-date data on who their users are, where they are coming from, and what they are trying to connect to.
Not a silver bullet
Zero Trust offers a comprehensive approach to protecting access to your network infrastructure, but it presents challenges. Many institutions do not have the required policy control technology architecture. Staff and small agencies with low bandwidth are struggling. Working from home forced us to hire BYOD (Bring-Your-Own-Devices). Unfortunately, the risk of cybersecurity is further increased as the agency decides how to control, measure, and manage these devices.
In addition, many institutions struggled with basic cyber hygiene. Previous The surge in telecommuting – and most of the security tools implemented were designed for local businesses. If employees are dispersed, this means that the security tools in place are even less effective, increasing cyber risk.
Working from home is not going away, and the need for secure access is more important than ever as cyber threats increase. The Office of Management and Budget (OMB) needs to establish a minimum defense management standard for assets to connect to government networks. This guidance benefits especially small institutions and lays the foundation for a zero trust approach.
Other challenges include a variety of data access and storage options, a variety of applications and devices, government virtual private networks, home routers, and even networks using public Wi-Fi over personal devices. Includes employees to connect.
All of these factors add complexity and require endpoint analysis (and real-time data) to grant access.
How will the agency move forward?
OMB is working with the National Institute of Standards and Technology (NIST) to emphasize the importance of protecting sensitive information stored on telecommuting devices and transmitted over external networks, enterprise telework and remote access. We publish guidelines such as security guides. This guidance also provides recommendations for selecting, implementing, and maintaining the security controls you need.
In addition to Zero Trust, there are many cloud security architectures that government agencies can implement. For example, Trusted Internet Connections (TIC) 3.0 recognizes the latest cybersecurity changes and offers agencies a variety of connectivity options. Although the TIC is described in detail from a security and telecommunications perspective, it lacks some of the risk assessments related to who is trying to connect to the network.
Security concerns cannot be resolved by disjointed solutions, following policies and procedures that have worked in the past, or simply asking an overgrown internal team to do more. Leverage a single platform that integrates endpoint management and security to integrate teams, effectively disassemble data silos, and accountability, visibility, and recovery that often exists between IT operations and security teams. Fill the power gap.
With a platform approach, agencies provide end-to-end visibility across end users, servers, and cloud endpoints for asset identification, system protection, threat detection, attack response, and massive recovery. I can. Zero Trust provides a way to keep agency data safe and employee productivity when implemented with accurate real-time data.
Brian McKee is Senior Director of Technical Account Management at Tanium.
Without real-time data, zero trust is zero profit
Source link Without real-time data, zero trust is zero profit