U.S. Government Eyes Zero Trust for Cybersecurity Protections
Date: 2022-01-28
Author: Anders Adolfsson, Global Product Manager
The United States government is gearing up to adopt a “zero trust” security model in the next 24 months within federal agencies as a means of increasing its cyber protections and thwarting cybersecurity risks in federal government agencies.
The strategy, which comes from the White House Office of Management and Budget (OMB), comes on the heels of an initial draft of the strategy from last fall which came about because of President Biden’s Executive Order 14028 (EO 14028). The updated report issued this week stated, “In the current threat environment, the Federal Government can no longer depend on conventional perimeter-based defenses to protect critical systems and data.”
The report citing EO 14028 also noted that incremental cybersecurity improvements are not enough. Rather, it says, “the Federal Government needs to make bold changes and significant investments … to defend the vital institutions that underpin the American way of life.” The proposal is to move to a zero-trust approach to security, providing a defensible architecture for this new environment.
We applaud these efforts. We look at the zero-trust model this way: agencies only trust people, networks, systems, contractors and others both outside and inside the security perimeter if they are verified. It provides extra vigilance on everything, from users and devices to applications and transactions.
While this news emanates from the U.S., the zero-trust model is being implemented or considered in many enterprises and governments around the world. And why not? By placing an emphasis on stronger enterprise identity and access controls, including multi-factor authentication (MFA), strategies like this are in line with what Versasec has been promoting for years. We also agree that hardware credentials and Public Key Infrastructure (PKI) offer the highest levels of MFA security, as the U.S. government says. While the strategy recommends that hardware-based PKI (PIV) is used, it also notes that when these are not possible or practical, FIDO (fast ID online) is a good alternative. FIDO is a technology-agnostic security specification for strong authentication.
To learn more about zero trust, PKI, MFA and the role of Versasec in all of these, please reach out for a conversation by clicking here.
vSEC:CMS
Our product suite provides all the software tools to administrate and manage credentials in a secure and convenient way.
Free Product Trial
Versasec provides enabling IT security products centered on the usage of security devices such as smart cards. Our solutions enable customers to securely authenticate, issue and manage user credentials more cost effectively. Get a free product trial.
Job Openings
We are always looking for new exceptional persons to join our team! Find out more about our job openings.
Versasec Support
Versasec customers with an existing support and maintenance contract can access the Versasec Support Portal, offering extensive professional support and maintenance services. The Versasec Support Portal offers a variety of services, allowing for customers and any site visitor to communicate directly with support engineers.
Company Blog
Our blog addresses the latest security trends and stories. The posts discuss how identity and access management are playing a larger role in keeping corporate data safe as well as brand reputations intact.