Why the network compass is obsolete

As agencies modernize networks in the work-from-anywhere world, they must eliminate traditional on-premise "castle and moat" security models. Modern security approaches are needed to protect hybrid and multi-cloud architectures -- and modern networks.

We've traditionally labelled network traffic as east to west or north to south. This is no longer relevant as more and more government users connect from devices outside the network perimeter. The network traffic compass used for the last 20 years is now broken.

To support this shift in managing and securing traffic in any direction, the TIC guidance provides the necessary flexibility for agencies to move from traditional remote work security solutions, such as virtual private networks, to a scalable network infrastructure that supports complex hybrid or multi-cloud environments.

As federal IT and cybersecurity leaders adjust their network architecture, they should follow TIC 3.0 guidance, and realign their security posture to focus on securing user and data traffic in any location, rather than securing the network location.

Security: Zero Trust to mitigate threat

To protect infrastructures as employees work in any location, agencies need a zero trust model. Zero trust means agencies do not inherently trust any user. IT teams can grant secure access for users on any device, in any location.

"It's always important to recognize that zero trust is more than an architecture. Zero trust is a philosophy and a change in culture that needs to be embraced by the entire organization," said Sean Connelly, TIC Program Manager and Senior Cybersecurity Architect, CISA at an event in December.

Keep in mind that this must also be continually reassessed through algorithms and models as trust starts to decompose over time. To do this, agencies can apply a robust identity and access management solution. Then, establish access controls through network analysis, telemetry, and foreign intelligence.

Agencies should continue to consult the TIC 3.0 and NIST zero trust architecture guidance as they develop zero trust use cases. The TIC 3.0 guidance helps agencies develop trust zones, to secure network components with similar protection requirements. For example, this can be a cloud container, an office location, an application, an endpoint, or the user identity.

Through trust zones, agencies can prevent lateral traffic, while zero trust works to secure access within and between trust zones. This combination will be crucial for agencies to limit their attack surface by verifying users before granting access through zero trust and decreasing trust zones' size to ensure proper security of the embedded computing resources.

There is no one-size-fits all solution for agencies' trust zones and zero trust solutions, but federal IT leaders should consider their trust zone size, quantity, categorization, composition, and communication to develop a customized security approach to meet their agency's mission needs.

Flexibility: modern security for complex architectures

TIC previously needed additional enterprise firewalls, web proxies, detection sensors, and other boundary protection mechanisms placed to provide the necessary flexibility for agencies. Now, as employees work in remote or hybrid environments and agencies follow modern TIC 3.0 guidance, agencies can position the security closer to the resources themselves to have everything at one access point.

In addition, as data is generated in the cloud, unless the data is moved from where it was created, the data accumulates mass and gravity. To secure access points and accommodate this "Data Gravity," agencies should adopt a Secure Access Service Edge (SASE) security model.

Following the SASE model, agencies can reduce data gravity and invert the traditional security model to move essential security functions to the cloud so users can access data and networks from any location, while security is pushed as close to the user/device/data as possible. With the SASE model, CISA has inverted their services, such as the Continuous Diagnostics and Mitigation program to secure data where it is generated, and Government Services Administration has likewise adjusted their model of Enterprise Infrastructure Solutions in this way.

Moving forward

This year, CISA plans to release further use cases – including the Office of Management and Budget M-19-26 use cases and potential use cases on zero trust, Internet of Things, partner network, and GSA's EIS. As well as, guidance on Web Application Program Interface (API).

Going forward, government network managers should continue to align security to users and data. To innovate, and make real progress, agencies need pilot programs and they need funding.

Adversaries are getting smarter and more cunning with every attack. The supply-chain attack that targeted vulnerabilities in SolarWinds IT management software has impacted more than 18,000 organizations across the public and private sectors -- highlighting the risks associated with relying on traditional security approaches as your organization deploys modern digital services. The only way to protect is defense in depth that includes zero trust, secure access service edge, and cloud workload protection. Make sure your partners are nimble and can react immediately to leverage countermeasures to enhance coverage wherever required across the multiple layers of your security platform.

As a community, if we want to be ready for whatever comes next, keeping the focus on the need to modernize is priority number one.