Decoding the cyber executive order

As the administration and the security community have been closely monitoring the potential threat of nation-state cyberattacks from Russia and advising organizations to bolster their cyber defenses, it's important to remember that President Joe Biden's Executive Order on Improving the Nation's Cybersecurity provides an excellent framework for shoring up federal security systems. The EO establishes new cybersecurity directives that when successful will radically change the security architecture and IT culture across the federal government. 

By mandating the adoption of zero trust principles, the White House has mandated government IT organizations to make wholesale changes to their culture and approach to cybersecurity. Simply put, compliance and network-centric security models must give way to risk and data-centric models. Organizations will no longer be able to segment security teams, but instead will have to view their security solution as one system. Interestingly, these requirements look a lot like the purpose of extended detection and response (XDR).

While the expectation of the EO is for the federal government to meet specific objectives toward eventual adoption of a mature zero trust architecture by 2024, the real ask is that agencies make significant changes to how they view, manage and report on their cybersecurity programs. For over three decades, the government has operated on "check box"-based security—setting minimum security standards and benchmarks and then scoring the ability to stay compliant. Zero trust cannot succeed in a compliance-centric security model. In a zero trust architecture, compliance is a telemetry point to assess risk, but simply being compliant doesn't eliminate risk. The challenge before many federal agencies is transforming a security platform that continuously evaluates risk for every resource request, while at the same time avoiding throwing everything out and starting over.

A zero trust architecture relies on collecting data from a unified security platform to surface risk and properly assign user and entity trust. That trust is then used to adjust authorizations at enforcement points to ensure resources are protected. In most cases, enterprises currently employ a considerable amount of the technical controls necessary to enforce, but they are missing the risk intelligence and automation necessary to dynamically adjust trust and subsequently authorization. 

It's clear that the White House recognizes this risk intelligence challenge. The Office of Management and Budget (OMB) Memorandum 21-30 defines a required maturity model for centralizing the collection and access to log data across devices and security tools to power user and entity behavioral analytics (UEBA) and security, orchestration, automation and response capabilities. UEBA will help find risky devices and users, while orchestration will coordinate the necessary changes to enforcement points. What the federal government is building, without the label, is essentially an extended detection and response architecture. 

The goal of an XDR architecture is to collect telemetry data across devices and security tools. Telemetry data is then used to surface cross-platform threats and identify risk by combining rule correlation, machine learning and contextual threat intelligence. Once contextual risks and threats are identified, XDR architectures coordinate and automate responses to include changes to enforcement point authorization decisions.

A successful XDR architecture is built around a central security operation center (SOC) platform that can tie into a native ecosystem of tools but is also open and can consume data and coordinate responses, regardless of the ecosystem. In order to keep pace with the rapidly evolving IT enterprise and the rapid expansion of cloud adoption and telework initiatives, the SOC platform shouldn't simply focus on the traditional workplace but should be able to collect data across the entire attack surface and quickly adapt as the enterprise continues to change. As data is collected, it should be analyzed using rule correlation, threat intelligence and machine learning to drive risk scores, quickly surface threats and drive response workflows. Lastly, the platform should be able to accelerate responses through artificial intelligence assisted investigations, empowering SOC analysts to increase efficiency and response accuracy. 

As agencies examine their current architectures and work to chart a path toward zero Trust, human capital and funding resources will dictate a need to repurpose what is already being used by the agencies as much as possible. To this end, a SOC platform that can take advantage of existing investments in security information and event management, edge, endpoint protection platforms, EDR and cloud security solutions will be essential to meet the tight timelines required by the White House EO. This will not only prove the most resource-efficient, but it will also ease the cultural changes that will be required for zero trust to succeed by allowing current technology operators to maintain domain over their solutions while participating in an integrated architecture.

As the federal government works towards achieving zero trust, it's clear that an XDR approach aligns directly with what they are working so hard to accomplish without forcing wholesale technology and culture changes.