Zero Trust Doesn’t Come in a Box

Enter "zero trust" into a Google Search and you’re bound to get more than 500 million results in less than a second. The top results will inevitably include promises of enterprise security transformation that’s quick, safe and easy. They’ll also include countless definitions, principles, models and architectures.

And almost every one of the links will point back to a specific product, each complete with its own version of a zero trust solution. Add the words ‘federal government’ to your zero trust search and you’ll get another 55 million results in under half a second—only this time, in addition to the vendor pages, you’ll also find a deluge of guidance, recommendations and frameworks from various agency authorities, as well as strategies and directives directly from the White House.

If the initial results aren’t enough to overwhelm you, the countless clicks and hours of research will inevitably leave you with far more questions than answers—the hardest of which to answer might simply be, “What exactly is it, and where do I start?”

While there are countless resources that are as helpful as they are good-intentioned, the ways in which zero trust may be approached are just as limitless. Below are three straightforward tips aimed to help federal agencies—operators, practitioners and decision-makers alike—wade through the noise that will inevitably accompany any agency journey to zero trust.

1. Stop looking for a “set it and forget it” solution

President Joe Biden’s May 2021 cybersecurity executive order and the subsequent Office of Management and Budget zero trust memorandum have imbued a sense of urgency across government agencies to adopt zero trust—requiring agencies to meet specific cybersecurity standards and objectives by the end of fiscal year 2024, in order to reinforce the government’s defenses against increasingly sophisticated and persistent threat campaigns. The magnitude of the task, coupled with often-lengthy procurement cycles, may tempt one to reach for the easy button—a well-marketed “zero trust solution” that can seemingly meet the lengthy list of requirements. 

The problem with that thinking is that zero trust isn’t a solution. If an agency procures a solution with overpromised benefits that have yet to be realized, they will inevitably come to realize the shortcomings instead, ultimately at a detriment to the already fleeting amount of time they have to meet the requirements. 

Instead, agencies should look for partner-driven offerings from vendors. The OMB memo follows the Cybersecurity and Infrastructure Security Agency’s Zero Trust Maturity Model, which includes five core zero trust pillars: Identity, Devices, Networks, Applications and Workloads, and Data. While it is nice to have a single solution, agencies should look for a balance of individual solutions that have engineered their technology to compliment other leading solutions across the industry. It’s that commitment and early investment in partners that will ultimately best serve agencies. It will also give agencies the added flexibility they’ll need to tailor zero trust to best meet their agency-specific needs over the long term.

2. Be okay with starting over and learn to let go 

In the words of Nicole Sobon, “Sometimes the hardest part isn't letting go but rather learning to start over.” Accept that successful adoption is just as much about cultural change as it is new technology. With many agencies having technology that’s decades old, it’s important for leadership to help their entire organization understand that legacy technology may as well be synonymous with vulnerable technology that puts the mission at risk. Put simply, successful zero trust adoption will require the often painstaking undertaking of sunsetting outdated tools, systems and processes. 

While the time required to evaluate new technologies will be substantial, the best technical decision may still result in failure if the whole of the organization has not culturally bought into the importance of the change. It’s critical that leadership invest just as much time and effort into coaching and preparing their organization—focusing on technical execution only will result in delays, distrust and doubt in the chosen path forward. 

3. Focus on your data and the rest will follow

While there are many components to zero trust, data is ultimately at the core of what government agencies must protect. The efforts to move towards zero trust are reminiscent of the federal efforts around data center consolidation over the last couple of decades. 

Although the number of data centers gradually decreased, the volume of data continued to rise, with much of it moving to the cloud. For a time, the cloud was still new, and, like most new innovations, it was not immediately wholly trusted. However, by way of the forcing function of the pandemic, federal government agencies have been compelled to fully reimagine where agency data resides. 

The reality is that data is everywhere, and security must be too. 

There is no shortage of distractions nor challenges with any zero trust implementation. Yet, despite the massive undertaking, federal agencies continue to charge ahead with their missions every single day. 

There is also no constant with zero trust—it’s a perpetual commitment to improving security through better technology, faster time to value and improved understanding of your attack surface and risk posture. Agencies that cultivate a “team sport” philosophy towards zero trust adoption will find success that much easier and faster.

Colby Proffitt is a cyber strategist at Netskope.