An analysis by Bloomberg Government from last summer showed agencies have spent only $500,000 on zero trust architecture tools and services since fiscal 2017.
To be clear, that research only looked for specific mentions of what has become a buzzword mentioned at every conference and vendor white paper over the last two years.
BGov readily acknowledges that there are hundreds of millions, if not billions, of dollars spent on components that would go into a zero trust architecture.
The evidence of that spending and push toward modernizing the federal approach to cybersecurity seems to be everywhere, especially over the past year as agency chief information officers and others have realized the value and potential of changing their approach to network defenses. The COVID-19 pandemic reminded and reinforced the power of identity and access management as a key piece to defend against cyber attacks.
The National Institute of Standards and Technology is reviewing concept papers for how to implement a zero trust architecture across six scenarios.
This project will focus primarily on access to enterprise resources. More specifically, the focus will be on behaviors of enterprise employees, contractors and guests accessing enterprise resources while connected from the corporate (or enterprise headquarters) network, a branch office, or the public internet, NISTs National Cybersecurity Center of Excellence wrote in the project description. Access requests can occur over both the enterprise-owned part of the infrastructure as well as the public/non-enterprise-owned part of the infrastructure. This requires that all access requests be secure, authorized, and verified before access is enforced, regardless of where the request is initiated or where the resources are located.
NIST said based on its review of the white papers, it plans to issue a cooperative research and development agreement (CRADA) to demonstrate different approaches to zero trust.
The Department of Homeland Security and the National Security Agency are among two of the agencies on the leading edge to do more than test these concepts.
Beth Cappello, the DHS deputy CIO, said the agency is using its target architecture initiative, which sets a common technology baseline to let programs adopt new technologies quickly, to implement zero trust components.
By rapidly implementing IT and security improvements to reduce risk, it will help the Office of the CIO address the remote work posture of our employees. Components have been able to take our target zero trust architecture and quickly customize or tailor it to field similar capabilities within their respective environments, Cappello said at the recent MicroStrategy World 2021 conference on Feb. 4. From a technology perspective, the zero trust architecture approach allow us to ensure we have a dynamic, on-demand chain of trust that is continually reassessed at each access point. Frankly, in our continued remote environment, this is incredibly important.
Homeland Securitys approach to zero trust is all about reusable architecture guides that are focused on user needs and developed with the components in mind.
Cappello said policy templates, pattern libraries and reference implementations also help to ensure DHS is implementing zero trust concepts in a standard way. The DHS zero trust action group which is made up of experts from across the agency is leading the coordinating, developing and sharing of these documents and individual experiences.
Thus far, we have fielded seven zero trust use cases to enhance access to IT assets and systems, she said. These use cases augment security while also reducing the load on our VPN connection points. This zero trust architecture approach also increases our network performance by leveraging a cloud access security broker and cloud security gateway capabilities to give users secure, direct access to cloud managed applications thereby reducing traffic on that Homeland Security enterprise network.
NSA is taking a similar approach as DHS, providing policies and reusable components as part of its zero trust approach.
Timothy Clyde, the lead systems engineer for NSAs external identity solutions and service offerings, said at the recent SailPoint Evolution of Identity conference that the agency launched a zero trust pilot just over a year ago with the goal of figuring out how to get users the data they need when they need it no matter the current set of policies and rules.
What is the level of trust that needs to go with that identity? Clyde asked. Depending on what the level of trust is that needs to be with that identity, comes the governance above that identity. Weve used policy engines. We tag our data and have been doing it successfully now for well over a decade. Some people would argue once you have a solid identity for the person, the device and the data, the policy then becomes probably the most important piece of it. It does need to be dynamic enough, that depending on the environment, you may have two policies that are almost identical. But if you are in Environment A, you may have access, but if you are in Environment B, you may not.
Clyde said the initial phase and roll out of the zero trust pilot includes a lab to test technology components for DoD partners and NSA also is making its policy engines available for others to use in their environments.
Neal Ziring, the technical director for NSAs Cybersecurity directorate, said the agencies can use policy engines to underpin the process to decide who is granted access to information. He said the policy is at the heart of access control.
Policy administrators create the rules that allow (or not allow) people and systems to access data. In a zero trust architecture, when a user makes a request to access data, the request is sent to a policy information point (PIP). The PIP provides the user information (such as attributes, clearance level, where they are located, etc.) to a policy decision point (PDP). The PDP analyzes this information along with additional policy rules regarding who can access that data, and determines if that user on that device is allowed to access that data. The PDP then delivers this decision to a policy enforcement point (PEP) who is the final authority on whether or not that user or device gets access to that data and either allows or disallows access, Ziring said in an email to Federal News Network. These PIP, PDP and PEP sub processes, when combined, are commonly referred to as the zero trust policy engine.
The zero trust pilot is a joint effort amongst U.S. Cyber Command, the Defense Information Systems Agency and NSA where they are researching, developing, piloting and lab testing technologies.
The team has been able to demonstrate the effectiveness of zero trust at preventing, detecting, responding and recovering from cyberattacks, Ziring said. NSA is part of the joint team developing the DoD zero trust reference architecture. NSA is developing zero trust best practices and guidance to share with a broader set of US critical network owners, such as National Security System owners. NSA is working with the DoD CIO and DISA to update any existing cybersecurity policies as applicable to include zero trust principles to ensure that all of DoD is synchronized on zero trust, and implements zero trust in a secure and standard way across the department to protect critical information.
He added the DoDwide working group is partnering with NIST to ensure the guidance on zero trust are in alignment across government.
Under the pilot, NSA and U.S. Cyber Command established an unclassified lab at DreamPort, a public-private innovation partnership that hosts zero trust equipment and simulates customer environments where they test diverse configurations of zero trust implementations.
Ziring said it also serves as a location to hold unclassified discussions with zero trust stakeholders, such as government customers and vendors.
The ability to engage with our stakeholders at the lowest possible classification level allows for broader engagements across the community and an increased understanding of cybersecurity as it evolves, he said. We have a separate testbed with DISA that will host any anticipated classified information.
Originally posted here:
DHS, NSA creating reusable pieces to zero trust foundation - Federal News Network
- NSA fears quantum computing surprise: 'If this black swan event happens, then we're really screwed' - Washington Times - March 27th, 2024 [March 27th, 2024]
- The NSA Warns That US Adversaries Free to Mine Private Data May Have an AI Edge - WIRED - March 27th, 2024 [March 27th, 2024]
- Five ways to implement zero-trust based on NSA's latest guidance - SC Media - March 27th, 2024 [March 27th, 2024]
- Intel analyst shared classified information on Discord, investigators say - The Washington Post - March 27th, 2024 [March 27th, 2024]
- Water Systems Vulnerable To Cyber Attacks, NSA And EPA Warn Governors - Forbes - March 27th, 2024 [March 27th, 2024]
- Amritpal Singhs mother, kin of other NSA detainees go on hunger strike, want them to be shifted to Punjab jail - The Tribune India - February 24th, 2024 [February 24th, 2024]
- Rob Joyce leaving NSA at the end of March - CyberScoop - February 24th, 2024 [February 24th, 2024]
- NSA cyber director to step down after 34 years of service - Nextgov/FCW - February 24th, 2024 [February 24th, 2024]
- Behind Khattar govts U-turn on NSA against farm leaders, fear of rural blowback, Congress gain - The Indian Express - February 24th, 2024 [February 24th, 2024]
- Payday dispute prompts maintenance worker walkout at NSA Naples - Stars and Stripes - February 24th, 2024 [February 24th, 2024]
- CISA, NSA, and FBI Warn of Chinese Cyber Hacking Army The Presidential Prayer Team - The Presidential Prayer Team - February 24th, 2024 [February 24th, 2024]
- Cyber Security Headlines: Microsoft takes another hit, Energy giant hit by ransomware, the NSA is secretly buying your ... - CISO Series - January 30th, 2024 [January 30th, 2024]
- India now cooperating with Nijjar probe: Canada's NSA - IndiaTimes - January 30th, 2024 [January 30th, 2024]
- Google, WhiteSnake, Outlook, NSA, Juniper, Jason Wood, and More SWN #358 - SC Media - January 30th, 2024 [January 30th, 2024]
- Readout of NSA Jake Sullivan's Meetings with PM Srettha and DPM/FM Parnpree - US Embassy in Thailand - USEmbassy.gov - January 30th, 2024 [January 30th, 2024]
- NSA Admits Secretly Buying Your Internet Browsing Data without Warrants - The Hacker News - January 30th, 2024 [January 30th, 2024]
- Readout of NSA Jake Sullivan's Meeting with CCP Politburo Member, Director of the Office of the Foreign Affairs ... - US Embassy & Consulates in... - January 30th, 2024 [January 30th, 2024]
- Former NSA Saint has a chance to become repeat Super Bowl champion - The Suffolk News-Herald - Suffolk News-Herald - January 30th, 2024 [January 30th, 2024]
- NSA is buying Americans internet browsing records without a warrant - TechCrunch - January 30th, 2024 [January 30th, 2024]
- As NSA buys up Americans' browser records, Uncle Sam is asked to simply knock it off - The Register - January 30th, 2024 [January 30th, 2024]
- NSA buys sensitive data on Americans without any court order - KJZZ - January 30th, 2024 [January 30th, 2024]
- NSA Veteran Teresa Shea Joins Board of Directors of Two Six Technologies - ExecutiveBiz - January 30th, 2024 [January 30th, 2024]
- How the FBI, NSA are preparing for deepfakes and misinformation issue ahead of 2024 elections - CNBC - January 14th, 2024 [January 14th, 2024]
- AI is helping US spies catch stealthy Chinese hacking ops, NSA official says - CyberScoop - January 14th, 2024 [January 14th, 2024]
- AI aids nation-state hackers but also helps US spies to find them, says NSA cyber director - TechCrunch - January 14th, 2024 [January 14th, 2024]
- NSA Director Paul Nakasone to Step Down in Early February - Bloomberg - January 14th, 2024 [January 14th, 2024]
- NSA says cybersecurity will gain many benefits with generative AI - ReadWrite - January 14th, 2024 [January 14th, 2024]
- FBI and NSA directors discuss their concerns about AI - WCBE 90.5 FM - January 14th, 2024 [January 14th, 2024]
- Looking back at 2023 with the NSA's Rob Joyce and Morgan Adamski - CyberScoop - January 14th, 2024 [January 14th, 2024]
- NSA: Benefits of generative AI in cyber security will outweigh the bad - ITPro - January 14th, 2024 [January 14th, 2024]
- AI Identified as Emerging Threat in Cyber Crime by NSA Director - CoinGape - January 14th, 2024 [January 14th, 2024]
- AI is helping China-backed hackers but it's also helping to hunt them down, NSA says - TechRadar - January 14th, 2024 [January 14th, 2024]
- Top 10 misconfigurations: An NSA checklist for CISOs - The Stack - October 20th, 2023 [October 20th, 2023]
- CISA and NSA Issues New Identity and Access Management Guidance for Vendors - TechRepublic - October 20th, 2023 [October 20th, 2023]
- How to Protect Against Evolving Phishing Attacks - National Security Agency - October 20th, 2023 [October 20th, 2023]
- NSA Shares Recommendations to Advance Device Security Within ... - National Security Agency - October 20th, 2023 [October 20th, 2023]
- Nansemond-Suffolk tennis falls to Norfolk Academy Thursday - The ... - Suffolk News-Herald - October 20th, 2023 [October 20th, 2023]
- NSA calls for a 'root and branch' review of Red Tractor - Farmers Guardian - October 20th, 2023 [October 20th, 2023]
- Israel's NSA warns of US intervention as Gaza conflict escalates - IndiaTimes - October 20th, 2023 [October 20th, 2023]
- The U.S. government is still in its Tumblr era. - Slate - October 20th, 2023 [October 20th, 2023]
- Biden's Cyber Command and NSA nominee seen as a pick for continuity - The Record from Recorded Future News - July 17th, 2023 [July 17th, 2023]
- 5 Reasons to Work for the NSA - ClearanceJobs - ClearanceJobs - July 17th, 2023 [July 17th, 2023]
- I will do my best as NSA: Ribadu promises - FRCN HQ - Federal Radio Corporation of Nigeria - July 17th, 2023 [July 17th, 2023]
- Plateau killings: Reps ask NSA to declare national emergency - TheCable - July 17th, 2023 [July 17th, 2023]
- 7th Deputy NSA Meeting of Colombo Security Conclave held in ... - ANI News - July 17th, 2023 [July 17th, 2023]
- Young shepherd from region wins NSA North Sheep trophy ... - Darlington and Stockton Times - July 17th, 2023 [July 17th, 2023]
- HBO film based on NSA leaker Reality Winner slated for May 29 ... - Military Times - May 18th, 2023 [May 18th, 2023]
- Tina Satter on why her NSA whistleblower film Reality is stranger than fiction - Financial Times - May 18th, 2023 [May 18th, 2023]
- Gen. Paul Nakasone Plans to Step Down as NSA Director ... - Executive Gov - May 18th, 2023 [May 18th, 2023]
- Readout of NSA Jake Sullivan's Meeting with CCP Politburo ... - US Embassy & Consulates in China - May 18th, 2023 [May 18th, 2023]
- Young sheep farmers to be given genetic boost by new NSA giveaway - The Scottish Farmer - May 18th, 2023 [May 18th, 2023]
- Sydney Sweeney wanted to be challenged by Reality: Its a different muscle playing someone who is real [Exclusive Video Interview] - Yahoo... - May 18th, 2023 [May 18th, 2023]
- Intercepted: The Biggest Whodunnit of the Century - The Intercept - May 18th, 2023 [May 18th, 2023]
- Personal injury + the No Surprises Act - Chiropractic Economics - May 18th, 2023 [May 18th, 2023]
- PM Narendra Modi e-inaugurating new office complexes of CBI at Shilong, Pune and Nagpur, commemorating the CBI diamond jubilee on Monday. Also seen... - April 4th, 2023 [April 4th, 2023]
- Special Collection Service - Wikipedia - March 31st, 2023 [March 31st, 2023]
- What is the NSA and how does it work? - SearchSecurity - February 5th, 2023 [February 5th, 2023]
- Watch: NSA Ajit Doval is Ambitious, Very Good at Sniffing Power and Being on the Right Side of itAS Dulat - The Wire - December 21st, 2022 [December 21st, 2022]
- Shockwaves win another championship, this time at the NSA Fresno Pilgrimfest - Lompoc Record - December 12th, 2022 [December 12th, 2022]
- EFCC secures forfeiture of N755m, luxury assets from ex-AGF, former aide to NSA The Nation Newspaper - The Nation Newspaper - November 23rd, 2022 [November 23rd, 2022]
- What is the National Security Agency? - Norwich University - October 25th, 2022 [October 25th, 2022]
- Cyber Security Today, Oct. 19, 2022 A warning from the NSA about nation-state attacks, and more - IT World Canada - October 21st, 2022 [October 21st, 2022]
- In the Alphabet Soup of Regulations, the NSA, GFE and AEOB Have Yet to Coalesce - RACmonitor - October 6th, 2022 [October 6th, 2022]
- Do not ignore any communication shared by NSCS, NSA: PM Modi to ministers - The Hindu - October 6th, 2022 [October 6th, 2022]
- NSA Announces Date of the National Cryptologic Museum Grand Opening - National Security Agency - October 2nd, 2022 [October 2nd, 2022]
- NSA and ACLU may face off in the Supreme Court over Wikipedia - Grid - October 2nd, 2022 [October 2nd, 2022]
- The NSA is Here to Help | Decipher - Duo Security - September 27th, 2022 [September 27th, 2022]
- Hollen, Raskin Join with NSA Bethesda Fire Fighters, IAFF Leaders to Highlight Progress on Efforts to Improve Base Conditions, Build New Facility |... - September 27th, 2022 [September 27th, 2022]
- CISA, FBI, NSA, Treasury, Cyber Command, and International Partners Release Advisory on Malicious Cyber Actors Affiliated with Iranian Government... - September 20th, 2022 [September 20th, 2022]
- NATFORCE: Buhari Finally Disbands Security Outfit After Senate Ignored NSA To Recognize Body The Whistler Newspaper - The Whistler Nigeria - September 20th, 2022 [September 20th, 2022]
- China Accuses NSA of Hacking Its Military Research University - VICE - September 9th, 2022 [September 9th, 2022]
- Behind the Toque: An Interview with NSA Noodle Bar Executive Chef Brooke Apfelbaum - greenpointers.com - September 9th, 2022 [September 9th, 2022]
- In the Garden: Tour gives Omahans a chance to see how a 'Bloom Box' works - Omaha World-Herald - September 9th, 2022 [September 9th, 2022]
- Three area teams pickup wins to start football season - The Suffolk News-Herald - Suffolk News-Herald - September 9th, 2022 [September 9th, 2022]
- NSA to reveal identities of big men behind oil theft in Nigeria Presidency - Daily Post Nigeria - August 22nd, 2022 [August 22nd, 2022]
- Former US Cyber Command and NSA chief makes the case for a cyber competition strategy | The Strategist - The Strategist - August 22nd, 2022 [August 22nd, 2022]
- Inaugural India-Central Asia NSA meeting to be held in December - WION - August 22nd, 2022 [August 22nd, 2022]
- Home | Open Source @ NSA - August 8th, 2022 [August 8th, 2022]
- Kennesaw State named top institution for cybersecurity outreach - Kennesaw State University - August 8th, 2022 [August 8th, 2022]
- US city of Boston to mark 75th anniversary of India's Independence with two-day extravaganza - NewsDrum - August 8th, 2022 [August 8th, 2022]