How to implement zero trust without impacting productivity

In the early days of cybersecurity, agency IT leaders were protecting an environment where federal employees worked in a physical location and accessed a network protected by firewalls. Today, these defenses are outdated and insufficient. Remote access has increased gradually over the past decade, and the pandemic rapidly pushed agencies to shift to telework and accommodate a wide range of devices. Expanded perimeters mean identities are now user- and device-based, rather than linked to a location.

To address this expanding perimeter, zero trust has grown from a buzzword to a mentality to a reality as agencies begin to adopt its architecture. This past summer, the Defense Information Systems Agency and the Navy announced their move to a zero trust architecture. Around the same time, the National Institute of Standards and Technology published a report on ZTA, defining what agencies are talking about when they refer to zero trust -- the need to continuously verify access and identity.

Zero trust means reducing users’ and devices’ unnecessary access to data. “Just-in-time” access goes a step further by granting the correct access to the right user when needed. Especially now, with a majority of the workforce accessing federal networks from home, many organizations need a ZTA, but it’s critical that this approach is implemented in a way that doesn’t impact an agency’s ability to achieve its mission.

Here are the steps needed to implement zero trust and go a step further with “just-in-time” access:

Shift the mentality

One important and easily overlooked first step to ensure there’s little or no interruption to the workforce and workflow is to announce plans to move to a ZTA, setting both an external expectation and an internal one. Federal employees should understand the value of their identity in order to build user resiliency and support a stronger overall cybersecurity posture.

This is also an opportunity to address any employee privacy concerns. It’s a good idea to establish that zero trust is not meant to tattle on employees; it’s meant to flag someone using their identity, protect that identity and the data and resources it accesses.

Determine a baseline

Ensuring that a ZTA-based approach doesn’t impact a team’s ability to get work done requires a strong foundation for access based on what, when and how users are accessing the network. A crucial initial step is to establish an accurate and up-to-date database of all accounts and access, including privileged access. A list of employees and their access levels as well as that of contractors or third-party workers should be available and up-to-date. This is a basic principle of identity governance and administration.

This baseline should track whether users are accessing the network in the morning or at night, via personal or work device, laptop or tablet, as well as the programs or files they are accessing. Awareness of this activity helps detect variations or anomalies more quickly.

Behavioral biometrics can also play a role by providing data on when user accounts log on, how long they access certain documents or networks as well as typing and mouse speeds and more to authenticate the user.

Automated systems can continuously verify access and identity without relying heavily on workforce resources. They can also flag and, if appropriate, freeze any accounts that cannot be verified. An employee can then follow up and determine whether the account should be granted access or investigated as a threat.

Review and include just-in-time access

Continuous review of accounts and removal of accounts that no longer need access is important ongoing maintenance that becomes even more necessary with ZTA. Agencies should also assess users’ account access and increase or decrease it to only what they need to accomplish their daily work.

Especially with privileged accounts in use less than 5% of the time, removing roles and permissions when they’re not in use reduces enterprise attack surface by 95%. That’s where just-in-time access comes in. At its core, it’s granting a user access to the privileged data as needed, then revoking that access once the task is complete or the user's role has changed.

The concept of just-in-time around privileged access embraces ZTA and is less likely to impede productivity by quickly adjusting permissions to meet the need of the process to ensure privileges are not persistent and vulnerable to exploitation.

Finally, agencies should only buy or add systems that follow the principles of zero trust. Network changes should build upon each other to ensure zero trust is implemented with every step moving forward.

With the workforce more dispersed than ever and network perimeters almost non-existent, now is a prime time to adopt a ZTA. Even when federal workers return to the office, ZTA will support a strong federal cybersecurity posture. The key will be to adapt ZTA to each agency and include just-in-time access to ensure that agencies’ missions continue forward without disruptions.