Updated Trusted Internet Connection Draft Lays Framework For Flexible Policy

The White House released a draft Friday of its revamped Trusted Internet Connection policy—the last of the administration’s 2018 IT management updates. The policy directs the Homeland Security Department to create a set of case studies for how agencies can establish safe connections to various networks, though the draft offers little insight into what that guidance will look like.

Among a slew of IT management policy updates this fall, TIC 3.0 is one of the more nuanced and complicated, as the administration tries to rectify the dissonance of protecting the network perimeter at a time when the idea of a network boundary is becoming less tangible.

The policy update focuses on helping “us streamline agency efforts to move to multicloud environments where we need to look at a different approach to security and storage,” Federal Chief Information Officer Suzette Kent said during an event Thursday hosted by the Center for Strategy and International Studies.

The draft issued Friday is less an actual policy for agencies to follow and more of a roadmap for the Homeland Security’s guidance, which is forthcoming.

The OMB policy requires Homeland Security to create and continually update a set of use cases outlining “proven, secure scenarios, where agencies are not required to route traffic through” preapproved network connections, such as those monitored under Homeland Security’s Einstein program.

While the full initial set of use cases is still in the works, the draft policy offers a few examples, such as teleworkers using home or public internet, field offices that use headquarters’ infrastructure and agency connections through cloud services. All instances that aren’t covered under the use cases should defer to past guidance and use a Trusted Internet Connection Access Provider, or TICAP, or Managed Trusted Internet Protocol Services, or MTIPS, as defined by Homeland Security.

Instead of further prescribing what guidance should look like, the draft policy calls for Homeland Security to remain agile and iterative, with mandates for regular updates to the use cases and ongoing pilot programs coordinated by the Chief Information Security Officer Council, along with Homeland Security, OMB and General Services Administration.

The policy also gives Homeland Security and GSA three months to develop an automated verification process to ensure agencies are complying with the directive.

When TIC was originally established, the goal was to mirror efforts at the Defense Department to ensure desktop computers and other devices connecting to internal servers were secure, Ryan Gillis, vice president of cybersecurity strategy and global policy for Palo Alto Networks, said during a panel discussion at the CSIS event. However, these frameworks don’t apply in the same way in the age of cloud, the internet of things and bring-your-own-device.

“There was utility to that at the time,” Gillis said. “If those access points are still being used, that’s great. But we need to holistically look, not just at this wall and node kind of deal, but every access point regardless of your infrastructure should be a place to collect data and to enforce security.”

“The perimeter is both nowhere and everywhere,” he added.

Gillis suggested the new TIC guidance should include segmenting agency networks using software-defined networking and layers of security tools that extend from the server—whether local or in the cloud—all the way to the endpoint device.

Once OMB’s policy is finalized, Homeland Security will be able to start the real work on its guidance, as well. Officials have been working on the issue throughout the year, going on a sort of listening tour of agencies to discover what their modern networks actually look like, Mark Bunn, program manager for Homeland Security’s TIC initiative, told Nextgov in September.  

As with Gillis, Bunn noted the modern network does not look like the networks of 2008, when the last TIC update was completed.

“Now we have technologies that don’t have boundaries. How do you apply a boundary program to try to leverage data and use data when there’s no such thing as a boundary anymore?” he said.

The goal for TIC 3 will be flexibility, Bunn said.

“Technology always outpaces our ability to protect ourselves from that technology. The first time we invented fire, we got burned by that fire. We know that’s going to happen with future technologies, as well,” Bunn said, citing emerging tech like artificial intelligence and neural nets. “How do I compensate for that or how do I recognize that? And now, how do I make sure I have some kind of risk management, some kind of threat management in place where when that happens, I can be resilient to that?”