The US Office of Management and Budget released a finalised federal strategy that establishes the initial details of the US government's move to a 'zero trust' security model. The release of the strategy comes after an executive order issued by President Joe Biden in May 2021 with the aim of securing the country's digital borders, as well as a draft strategy that the OMB released in September.
Biden's order initiated a sweeping government-wide effort to ensure that baseline security practices are in place, to migrate the federal government to a zero trust architecture, and to realise the security benefits of cloud-based infrastructure while mitigating associated risks.
This memorandum sets forth a federal zero trust architecture (ZTA) strategy, requiring agencies to meet specific cyber-security standards and objectives by the end of fiscal year 2024 in order to reinforce the government’s defenses against increasingly sophisticated and persistent threat campaigns. Those campaigns target federal technology infrastructure, threatening public safety and privacy, damaging the American economy, and weakening trust in government.
This strategy envisions several actions. First, federal staff have enterprise-managed accounts, allowing them to access everything they need to do their job while remaining reliably protected from even targeted, sophisticated phishing attacks. Second, the devices that federal staff use to do their jobs are consistently tracked and monitored, and the security posture of those devices is taken into account when granting access to internal resources.
Third, agency systems are isolated from each other, and the network traffic flowing between and within them is reliably encrypted. Fourth, enterprise applications are tested internally and externally, and can be made available to staff securely over the internet.
Last, federal security teams and data teams work together to develop data categories and security rules to automatically detect and ultimately block unauthorised access to sensitive information.
This strategy places significant emphasis on stronger enterprise identity and access controls, including multi-factor authentication. Tightening access controls will require agencies to leverage data from different sources to make intelligent decisions, such as analysing device and user information to assess the security posture of all activity on agency systems.
