Zero-trust has a branding problem

Zero trust has a branding problem –– one that could complicate federal efforts to implement the cybersecurity architecture across the federal government.

To the uninitiated, the term "zero trust" can have Orwellian overtones of surveillance and imply that users are not trustworthy, but in reality, it means that trust should not be assumed or bestowed on relative location inside or outside a network's perimeter.

A zero-trust approach to cybersecurity is intended to increase vigilance and minimize risk, but without the necessary context, the concept could raise discomfort or even hostility among federal workers who will ultimately play a key role in implementation. Users form a critical link in effective cybersecurity, and a concept that is misunderstood faces an additional hurdle —especially if zero trust is misconstrued to mean 'mistrust.'

Without the support of millions of federal workers, a strategy that relies on unprecedented alignment across government could deepen divisions –– between leadership and staff, between IT and non-IT professionals and between agencies at different levels of zero-trust maturity. To build zero-trust maturity across the federal government, agencies' implementation strategies should proactively address misconceptions and familiarize the workers with the term itself. In other words, implementation should have a marketing and education dimension as well as a technical one.

Workforce buy-in

The recently released OMB Federal Zero Trust Strategy and the NIST Maturity Model and Cloud Security Technical Reference Architecture (TRA) were intended to help guide agencies in meeting President Joe Biden's May 12 Executive Order on Improving the Nation's Cybersecurity's directive to produce strategies for implementing zero trust. But even with the powerful and automated capabilities for security that a zero trust architecture can bring to an enterprise, users remain the first line of defense. However, neither the OMB strategy nor the Maturity Model addresses this need to educate and generate buy-in from the federal workforce around the concept.

As a former ODNI cyber chief, I learned firsthand that cybersecurity infrastructure strategies and programs that failed consider the needs and perceptions of the workforce were significantly more difficult to roll out. Challenges to cyber and IT modernization can stem from governance and adoption issues every bit as much as they arise from problems with the technology itself. A confidence gap could delay zero-trust maturity by years, and with ransomware attacks increasing tenfold during the first half of 2021 alone, the federal government has no time to lose.

The 2011 move from Army Knowledge Online to enterprise email was made more difficult in part because members of the Armed Forces resisted the move to generalized .mil email addresses from the email addresses specific to the Army, Navy, Air Force or Marine Corps. Many users saw their email address as a digital analogue to their service uniform, and the cybersecurity benefits to DoD of the move to .mil were not well understood by the user population. The move happened, but the transition arguably would have been more rapid and embraced as a step towards better collective cyber defense had more attention been paid to explaining the rationale and the benefits to the users — the affected population.

Similarly, since 2013, intelligence community CIOs have faced challenges implementing ICITE, a cloud-based strategy for centralized intelligence sharing among the 17 intelligence agencies. In this case, both users and managers have been reluctant to work outside of their siloed agency data streams. More recently the Department of Defense's 2015 Joint Regional Security Stacks initiative stalled this year as confidence in the program deteriorated. A 2021 report from the Office of the Director, Operational Test and Evaluation recommending suspending classified JRSS operations "if the zero trust architectures prove viable," which adds urgency to explaining zero trust in a way that resonates with the workforce.

Correcting the record

Fundamentally, zero trust shifts the focus of cyber threat detection and defense from a location-centric model on based the network perimeter to one based on validating the identity and need for access of individual devices and users regardless of their location. Rather than prioritizing the 'moat and castle' approach to defending an increasingly outdated model of perimeter-based computing, a zero-trust strategy recognizes that users and devices may connect from anywhere, and computing resources and data may be located in the cloud, at the edge or someplace in between. Zero trust focuses on verifying every device and every user and providing only as much access as necessary to perform the task at hand. This is especially important in a world where the federal workforce has been working remotely and where agencies are accelerating their migration to the cloud and moving towards software defined networks filled with 'smart' devices.

The OMB Federal Zero Trust Strategy and the NIST Maturity Model are critical first steps to guiding agencies in laying out a clear path and benchmarks on the way to zero-trust maturity. However, agencies must also put forward a serious effort to communicate to their workforces that zero trust is a tool to support them, not surveil them. Federal workers often choose to work for the government for less money than they could make in the private sector and undergo a grueling and protracted hiring process because of their commitment to the mission and to serving their country. Without a clear understanding of zero trust, many within the federal workforce may be slow to adopt new protocols or to change how they use their devices if they feel that their employers do not trust them.

In short, zero trust has a branding problem. The term is so well-established that we should not try to change it, but any marketing professional would counsel accentuating the positive rather than leading with the negative. Agencies should act now to address a potential confidence gap before it risks delaying this essential shift in the federal cybersecurity paradigm.