Zero-trust architecture demands a new view on data security

The increase in cyberattacks across state and local government agencies is undeniable and well documented. Hospitals, schools, police departments, transportation agencies and other organizations that are essential to everyday life have been victimized by malicious cyber actors. With over 90,000 local government organizations and dozens of agencies and offices per state, each housing troves of sensitive data, the attack surface is enormous.

Notably, the methods cybercriminals employ to carry out these attacks have changed dramatically in recent years, largely because of the national shift to telework. Therefore, defenses against such attacks must shift to fit the new threat landscape.

Since the onset of the pandemic, the Washington, D.C., police force, the city of Minneapolis, Chatham County, N.C., the Hampton Roads, Va., Sanitation District, the Rhode Island Public Transit Authority and the Alaska Health and Social Services Department are among the hundreds of state and local agencies that have been victims of cybercrime. The variety and breadth of organizations attacked underscores that no one is immune to these financially disastrous attacks, and recent government initiatives are finally acknowledging that reality.

The White House’s Executive Order on Improving the Nation’s Cybersecurity recognizes the need to adopt a zero trust model in the face of current cyber threats at the federal level. However, for state and local agencies to continually interface with federal agencies, they must make similar moves toward zero trust. Given the frequency and severity of cyberattacks against state and local government organizations, a shift to zero trust offers much more than interoperability.

Zero trust has become somewhat of a buzzword of late, but it is imperative to highlight that zero trust is not a tangible product or service, but an evolving collection of cybersecurity paradigms and concepts: an architecture. Central principles of a zero trust architecture include continuous validation and authentication and simplified access control enforcement.

State and local agencies are as valuable a target as federal agencies to most threat actors, and if the federal government is struggling to keep pace with bad actors, state and local governments’ limited resources only compounds their vulnerabilities, especially with the shift to remote work.

A BeyondTrust survey of federal, state and local government security professionals found remote worker or contractor vulnerabilities to be the No. 1 reported security risk, with 65% of respondents ranking it as their top priority. Today’s remote or hybrid workplace has increased the potential attack surface with the exponentially greater number of devices, apps, cloud environments and access points.

The survey also found that 80% of IT security professionals say that the shift to remote work is increasing the focus on identity security. It is apparent that controlling identity is the critical first step to constructing a zero trust architecture that meets the requirements of hybrid, cloud and multicloud network infrastructures.

One of the first actions state and local agencies can take is to contextualize network activity. If organizations can accurately understand how their users typically behave, they can defend themselves accordingly. To obtain this level of insight, access must be tied to a master concept of identity. Because a single user could theoretically access data in multiple roles or locations, the network must carry that user’s master identity with them, while simultaneously shedding access permissions for the data that identity no longer needs.

Privileged access management is the keystone of any zero trust architecture. PAM encompasses the strategies and technologies used to control privileged access and permissions for users, accounts, processes and systems across an IT environment.

Malicious actors seek to acquire privileged credentials via phishing or malware attacks because such credentials allow them to move laterally in an IT environment and obtain the most sensitive information. As such, privileged password management, endpoint privilege management and secure remote access are three core solutions PAM platforms that can help state and local agencies prevent these types of attacks and enforce zero trust.

The shift to zero trust necessitates a new mindset. The days of merely updating antivirus software and using castle-and-moat defenses are long gone. As cybercriminals grow increasingly sophisticated, so too must cybersecurity defenses. That is why zero trust architectures are the product of several interlocking technologies and policies, which no single vendor can provide.

Ironically, if state and local government agencies hope to maintain the trust of their employees and citizens, they must work toward achieving a zero trust security architecture.

Josh Brodbent is regional vice president, public sector solutions engineering, with BeyondTrust.