Real Work on TIC 3 Begins After Draft Guidance Is Finalized, Says Lead Official

The program office managing the rollout of the government’s Trusted Internet Connection 3.0 policy is getting ready to finalize the guidance and first two use cases this spring. But that work is only the beginning, according to the TIC program manager.

“The important thing for agencies to understand: This is just the beginning of TIC 3,” Sean Connelly, TIC program manager and senior cybersecurity architect in CISA’s Office of the Chief Technology Officer, told Nextgov in an interview.

The first iteration of TIC was released in 2008, requiring federal agencies to ensure their internet connections were secure from things like man-in-the-middle attacks and other network intrusions. The first policy release and the subsequent TIC 2.0 issued in 2012 focused on agencies’ headquarters and didn’t give sufficient guidance for emerging technologies like cloud computing and mobile devices.

The Office of Management and Budget and Homeland Security Department sought to fix this issue with the new TIC 3.0. Rather than give proscriptive guidance, the new policy would offer broad definitions of security concepts and a set of real-world agency use cases for others to emulate.

Homeland Security’s Cybersecurity and Infrastructure Security Agency released a draft of the strategic documents and use cases for agency headquarters and remote offices in December. But even once those documents are finalized this spring, there is still a long road ahead for the latest TIC.

“We have the guidebook and the reference architecture documents—we consider those more of the strategic documents, the ones agencies use to build out their understanding of TIC 3 in general,” Connelly said. “And then what we call the operational, the more technical documents: the use cases, the security capabilities and the overlays. We think those are the ones that will be used more by agencies as they build out and secure their environments.”

While there is no hard timeline, Connelly said his office plans to have the current draft documents finalized by springtime, then shift to the bigger lift of finalizing and releasing individual use cases.

“The immediate timeline is we want to get this TIC guidance finalized as quickly as possible. We are working to adjudicate all the comments,” he said. “TIC 2 took about a year to go from draft to final. Nobody from OMB, GSA, CISA has the intention to let that take a year.”

After the headquarters and branch office use cases, CISA will focus on two others called out in OMB’s September 2019 memo: cloud services and remote users, such as teleworkers.

“Ultimately, there are a number of other use cases that we’re on the hook for: the Infrastructure-as-a-Service use case, the [Platform-as-a-Service], [Software-as-a-Service] use case, Email-as-a-Service and also the remote user. Those are the alternative use cases that are already embedded in the OMB memo,” Connelly said. “At the same time, we’ve heard a lot of interest for a number of other use cases.”

Some of those other potential use cases include zero trust, unified communications, the internet of things and connecting with agency partner’s networks.

“In terms of partner networks, if an agency has a relationship with a bank or research development, what are those types of connections and how should they be [secured]?” Connelly said. “Also, internet of things—as agencies place a lot more sensors on the internet that they need for their telemetry, how do you secure those devices? How do you secure that telemetry coming back to the agency itself?”

Going forward, a subcommittee embedded within the Federal Chief Information Security Officers Council will accept use case proposals from federal agencies with a specific connection security need. Based on feedback from the federal community, the subcommittee will issue data calls to agencies around specific potential use cases and ask for proposals in return.

“From those different proposals, we’ll pick out the ones we think best reflect the possible use case,” Connelly said. “Then, the agency will implement that pilot itself. In the background, CISA will be observing the whole time.”

As those pilots wrap up, the agency CISO will be expected to “distill the lessons-learned into the use case,” which the subcommittee will then turn into a draft to disseminate for public comment and, ultimately, finalized as a best practice.

Connelly said some of these pilots have already started, such as at the Small Business Administration and Energy Department. However, he declined to name other active agency pilots, leaving it up to those agencies to decide if they want to be vocal about their work, as SBA and Energy have.

“Our expectation is we’ll release the first two use cases—the traditional TIC and the remote office—with this final release,” he said. “Then, soon after, we’ll start, hopefully, being able to map some of those pilots we’re working with in the background to build out those use cases.”

That work will begin in earnest this summer, Connelly said, and will continue on a rolling basis into the foreseeable future as new use cases are proposed and added.

“These are the foundational documents. It was so key to us to make sure that these are right at the outset,” he said of the reference architecture and first two use cases. “Between the ones in the memo and the others that are speculative, we expect about 10 use cases. Those will, at least, take over the next year or so. Then, we’ll hear from agencies about where they want to go next.”