The Cyber Defense eMagazine November Edition for 2023

which helped feed the development of the updated model agencies are in “dramatically different phases”
of their respective zero trust journeys. Burdened by legacy infrastructure, some federal entities lack the
resources necessary to meet the proposed Zero Trust guidelines in the near-term future.
Getting Zero Trust on Track
Though the federal government has historically been a breeding ground for top cybersecurity
professionals, it may be time for the government to borrow a few lessons from industry pros in the private
sector. The public sector must adopt some of the agility and flexibility of the business world to streamline
the progress of zero trust projects, especially with federal implementation deadlines looming.
Assessing the Situation
When planning to build out a Zero Trust program, government agencies should look to model their
implementations based on the steps that enterprises use for their own transitions. This starts with an
initial assessment of the organization’s security posture. While it may sound obvious, agencies must first
assess the mechanisms they currently have in place to understand where potential gaps may lie.
Identifying potential threats is an important first step in laying the groundwork for Zero Trust.
Planning the Transition
Once a comprehensive assessment has been completed, agency leaders can begin to plan the transition
itself. Zero Trust can be extremely complicated, which makes it important for leadership to define goals
up front and set expectations for the project's outcome. Given the guidance already issued by CISA,
agencies have a baseline for defining goals and a timeline for achieving them. This is also the stage of
the process where resources are allocated for implementation. While budgets can vary from institution to
institution – and especially when comparing a federal agency to a local department – organizations must
understand the resources available to them. Agency leaders at all levels must advocate for support of
security projects to protect the infrastructure that serves the public.
Executing the Strategy
After an action plan has been presented, agencies can begin to make headway on the actual
implementation phase. The execution of Zero Trust is the most intricate, most important piece of the
puzzle. Not to be overlooked in the deployment of Zero Trust technologies is the importance of training
employees. Zero Trust principles may be new to agency personnel, requiring dedicated training sessions
to educate team members on how to work within the newly deployed architecture. Individual contributors
must know the common warning signs of suspicious activity to avoid falling victim to social engineering
attacks that can help malicious actors penetrate Zero Trust defenses.
Cyber Defense eMagazine – November 2023 Edition 135
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.