The Key to Zero Trust: Pick the Right Starting Point

Earlier this year, the U.S. federal government released its Federal Zero Trust Strategy to “adapt civilian agencies’ enterprise security architecture to be based on zero trust principles.” The strategy’s goal is to “accelerate agencies toward a shared baseline of early zero trust maturity” in two years so that all public sector agencies, staff, contractors, and partners can do their work efficiently and securely.

Moving to a completely Zero Trust-Based Architecture is a multi-year journey that will require flexibility and the ability to pivot as new technologies and best practices emerge. It’s a complex initiative for the public sector to consider all the devices, networks, and applications they use, their workloads, the data they collect and use, and the security needed. With the clock ticking and some deadlines fast approaching, there’s much work to be done.

When confronted with this mammoth task, where should the public sector start with Zero Trust? We might be biased, but we think unified identity data is a solid starting point for public sector organizations looking to implement Zero Trust Architecture. This post will explain why and how unifying all the underlying identity data lays the foundation for delivering successful Zero Trust for public sector organizations—and it can also keep them on track to meet the government’s deadlines.

Zero Trust Challenges in the Public Sector

Zero Trust (ZT) is hard for the public sector due to siloed identity and the challenges around getting a unified identity set that is flexible enough to support a variety of Zero Trust technologies and platforms. Identity-first security is a big trend for a reason, and the pressure to adopt Zero Trust leads to greater awareness of the role identity plays in securing access—and rightfully so.

Identity data in many public sector agencies is spread across siloed systems that don’t integrate easily with access platforms. Data like user information, credentials, attributes, real-time data like geolocation, and dynamic risk scores, are essential parts of any security strategy, yet are easily missed when scattered across various systems.

Further complicating things are the technology challenges the public sector faces. That includes the legacy tech still in place at many agencies and the technical debt it leaves behind. Many agencies use aging systems that often do not support Zero Trust or other security modernizations without extensive customization. These older systems typically use an “implicit trust” strategy where users log on to the network and have access to everything, which is extremely risky today.

Criminals can easily exploit an entry point and cause havoc throughout the entire agency network or infrastructure. Even if newer systems and infrastructure are deployed, they’re less secure in this type of network because of the flaws of implicit trust. They’d also need to be rebuilt or replaced entirely to implement Zero Trust.

Rebuilding or replacing infrastructure to implement more modern security strategies like Zero Trust can be expensive. It requires significant investments in infrastructure, IT, and expertise that many public sector agencies just don’t have.

Zero Trust relies less on perimeter security and employee training alone and more on identity security. The network is a key component of Zero Trust, but so are users, devices, systems, workflows, etc. A good starting point on the path to optimal Zero Trust Architecture for the public sector is unifying identity data.

We feel it’s the key to unlocking successful Zero Trust adoption across the public sector for several reasons.

Identity Data is the First Step Towards Zero Trust

The founding principle of Zero Trust is “never trust and always verify.” All users, devices, and services must be authenticated before gaining access to resources or data. This is contrary to most public sector setups, which grant access at a network level, otherwise known as the implicit trust model.

It’s essential to enforce trust and access at a more granular level, given how much we do online today and the creativity of cybercriminals. Identity data plays the foundational role in facilitating an optimal ZT architecture that keeps data, systems, and infrastructure safe while not impeding workflows.

Laying the Groundwork for ZT Success

An on-demand source of unified identity data—what we call the “Identity Data Fabric” approach—can help public sector agencies overcome many of their current technology and security challenges to Zero Trust adoption because it’s the foundation of a digital organization.

With an Identity Data Fabric, public sector agencies can:

1. Simplify IT and infrastructure management: An Identity Data Fabric delivers the always-on, always up-to-date unified identity data that an agency uses every day to drive its digital security architecture. With central access and visibility into complete user information, identity data can be centrally maintained and managed while allowing security systems to consistently authenticate and authorize users and devices everywhere.
2. Enable dynamic risk mitigation: One benefit of modern security platforms is continuously monitoring and assessing risk through machine learning and other automated processes. Risk-based security models enable you to detect, analyze, and respond to potentially harmful activity at any infrastructure level faster than any perimeter-based security approach. But these solutions need to be fed the information required to make such assessments—and an Identity Data Fabric can unify all that data identity information across a world of disparate sources (from AD and APIs to LDAP, SQL, and more!) so these dynamic assessments can be made actionable.
3. Simplify password management: The average business employee has 191 passwords to manage, making them a top security threat. An Intelligent Identity Data Platform makes it much easier to enable measures such as single sign-on (SSO) to streamline the number of passwords in use, as well as multi-factor authentication (MFA) that adds another layer of verification to every touchpoint. In fact, enabling MFA is called out specifically in the government’s ZT mandate.
4. Improve and secure the user experience: Unifying the digital experience for users and adding secure SSO across all digital touchpoints, you improve their user experience with the digital tools they use every day. Public sector agencies are wary of locking systems down too much since it can impact employee productivity. When done right, identity data security removes those roadblocks and ensures seamless access, so employees stay efficient—and agencies become more secure.

Simplify Your Path to Zero Trust 

Radiant Logic has worked with numerous public sector organizations to develop solutions that meet their unique use cases, from university healthcare networks to branches of the U.S. military and several federal government departments, including the Department of Homeland Security. We help public sector organizations achieve a true Zero Trust Architecture across distributed environments while maintaining security for forward-looking organizations dealing with aging systems that can’t easily be replaced.

Our integration professional services team has the expertise to sort out your identity mess and align everything with your use cases. You’ll have granular access control and interoperability across systems, applications, departments, and more. Our solution modernizes systems with low-connectivity issues and decades-old design patterns, without wholesale replacement of technology and infrastructure.

Implementing a Zero Trust Architecture is a complex undertaking. With the new OMB ZT mandate and Presidential Executive Order to modernize public sector identity management and security, it’s critical that agencies start somewhere—and the smartest place to start is with your identity data. It’ll make all your future efforts more efficient to start at the beginning.

Defining use cases for all levels of users is beneficial for several reasons, including highlighting affected systems, employees, and workflows; identifying gaps and areas for improvement; and encouraging collaboration across previously siloed teams.

Transitioning to a ZTA is a long-term project, so identifying all your use cases can help ease the public sector into the work. Certain items should be done first, and quickly, as outlined in the EO mandate and the 180-day deadline. An Identity Data Fabric gives you a solid unified identity data foundation, making later transitions faster and more efficient. And it can accomplish all that identity unification really quickly—think days or weeks instead of months, years, or never.