Adapting to Emerging Threats: The Need for Zero Trust in Government Networks

One thing that government leaders can never do is let down their guards when it comes to information security and online threats. The enemy is constantly probing for weaknesses, and even if defenses improve, so do the attackers.

Due to the ever-evolving threat environment, contracting officers, program managers, and nearly everyone else in sensitive information-sharing positions need to adopt a wholesale shift in viewpoint. This is even more critical now as agencies seek to invest in modernizing government networks. The shift has been given a name: zero trust architecture (ZTA). Taken literally, it means trusting no one and verifying everything.

This mindset requires leaving behind the perimeter-based mindset of the past in the acquisition of new technology. Decisions must be grounded in systems that can support ZTA as they take shape across newly modernized government networks.

This shift will not happen overnight. ZTA in the government represents a multi-year journey, requiring IT, cybersecurity, and agency leaders to make smart decisions in policy, programming, budgeting, and acquisition.

The Evolving Cybersecurity Threat Landscape in Government Networks

The modernization of government networks for military and civilian purposes doesn’t happen in a vacuum. Technology changes trigger other shifts that require overall systems, technological and human, to adapt. As technology improves, cyber threats to those systems also escalate and create new challenges.

These threats are pushing existing systems to their limits, and the legacy networks of old are less equipped than they need to be to address evolving cyber defense standards and protocols. It’s forced a significant change in defense, intelligence, and government leaders in how they think about protecting confidential, sensitive, and top-secret information.

Two trends are driving the urgent need for change. The first is intruders learning and growing as technology improves; they develop new tactics and procedures just as a virus mutates to avoid efforts at treatment. Basically, electronic warfare and hacking threats are never static. The second trend is that the effectiveness of traditional perimeter security evolves along with networks.

Noting that today’s organizations consist of centralized and cloud-based networks, the National Institute of Standards and Technology observes that “this complexity has outstripped legacy methods of perimeter-based network security as there is no single, easily identified perimeter for the enterprise.”

As a result, government networks are dealing with new and different types of attacks, such as:

• Advanced persistent threats, in which attackers seek access to networks for extended periods using phishing, malware, or other types of cutting-edge threats. According to Excelsior University, intruders often gain access to networks and wait for moments to attack. Given that these advanced threats require immense resources, they typically have national state or organized crime sponsors.
• Insider threats, which are on the rise in the government and private sectors. Positive Technologies reported that the number of insider threats grew 47% from 2017 to 2018, and the number keeps increasing. Insider threats stem from individuals in an organization who have legitimate access to information.

Both government and industry have identified the zero trust framework as the right solution for such a dynamic and dangerous time for cybersecurity.

What Is Zero Trust Architecture?

Zero trust rests on the doctrine of constant vigilance, assuming a “never trust, always verify” approach, no matter who is accessing the network. Essentially, the goal is to act as if every access request requires verification. It also calls for continuous authentication and authorization to address advanced persistent threats. The idea is to decrease the risk of hackers or other intruders operating undetected for months or even years.

Another principle of zero trust in government networks is the idea of “least privileged access”; only unlocking certain resources is absolutely necessary for a particular user.

Adoption of zero trust requires a mindset shift across the DoD enterprise, particularly in the procurement phase. Cybersecurity is no longer a phase added separately during acquisition; instead, it’s a primary consideration from initiation to fielding. The goal is to ensure that security is built in by design rather than bolted on as an afterthought or added as networks evolve.

Zero trust is crucial to the future of modernized government networks.

Implementing Zero Trust in Government Networks in the DoD

The main challenge for the military in adopting ZTA in government networks is a new emphasis on resource allocation. The shift from legacy to modernized IT networks requires acquisition and procurement officers to consider integrating cyber defenses from the ground up. It’s no longer about buying hardware; it’s about buying a complete system designed to defend networks from malicious parties. That requires understanding methods for providing protection up to the top secret classifications.

Broadly speaking, government and intelligence program managers must consider two distinct stages of work in implementing zero trust in modernized networks.

• The first involves answering questions about identity and access management—basically, understanding who will be seeking entry to the networks and what levels of access they can be provided.
• The second stage of work is device verification. In a world where smartphones, tablets, and laptops make computing ubiquitous, program managers must figure out how to extend network protections to a broader population of digital devices.

We’ve entered a new era where zero trust principles guide technology acquisition.

Leverage Sumaria Systems in the Zero Trust Architecture Shift

Partnering with an experienced vendor like Sumaria can ease the transition. It specializes in systems integration, deploying hardware and software to government requirements.

The Sumaria team also has expertise with identity and access management complexity by focusing on network engineering and configuration management. Their advisory assistance can help with strategic planning support for optimizing resource allocation.

Future-ready networks. Mission-ready operations. Modernizing your base network infrastructure is critical for increasing mission readiness, scalability, and security. Sumaria Systems provides the expertise and innovative solutions to integrate, protect, and optimize your network for peak performance. Discover how Sumaria can help you build a resilient, future-ready infrastructure.