Cyber Defense eMagazine February Edition for 2023

A linchpin of Biden’s cyber-defense plan is zero trust — the “Never trust, always verify” security
framework generating a lot of attention. For more than a year, Biden has called for the accelerated
adoption of secure cloud infrastructure and zero-trust architecture.
Zero trust represents an important step forward, but it’s no panacea. Before the federal government sees
broad adoption of zero-trust principles, there are several significant challenges to overcome.
The time is now for a zero-trust security approach.
Zero trust is not a single product, technology. Nor is it a turnkey solution. It’s a methodology.
The main principles of zero trust include the following:
• Denying access to an organization’s data by default.
• Never trust any device by default.
• Isolate workloads and data as part of a granular authentication process.
Verified users are given access to only the data, applications, and other resources needed to complete
their work.
While zero trust has been around for over a decade, its popularity has spiked with the rise of hybrid cloud
and hyperconnected environments. In a world in which resources sprawl across a massive attack surface,
new security practices are necessary.
But implementing zero trust can be tricky.
Not every federal agency has access to mature security systems or operates computer systems that are
compatible with zero-trust services. And not every government agency or entity can allocate the labor
and funds necessary to undertake a major technology and operational overhaul.
Weighing the challenges of zero-trust implementation
Implementing zero trust requires agencies to reorganize and redesign IT infrastructure. Laptops are
stolen frequently, for instance. Therefore, if zero trust is to extend to all endpoints, organizations need to
secure all devices. This requires patching and securing all hardware assets and could mean issuing
completely new devices.
Isolating workloads and information via authentication processes is complex. Creating specific access
policies for different workloads and resources requires enormous effort. Additionally, these policies
typically need continuous updating.
Cyber Defense eMagazine – February 2023 Edition 103
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.