Verifying identity is the foundation of cybersecurity, state CSO says
GettyImages/Westend61
Delaware’s security program aims to “walk alongside the user” as constituents access services and employees conduct business.
Verifying a user’s identity is one of the pillars of zero-trust frameworks, but the state of Delaware sees it as the foundation of its cybersecurity efforts.
“We characterize our security program as walking alongside the user,” Delaware Chief Security Officer Soloman Adote said in a recent GCN webcast. “At every step, assess the risk and make a decision: allow or deny? Not just at the beginning. Not just at the gateway. And that’s how we continue to fight this good fight.”
The state revamped its security strategy five years ago when the governor and other leaders pushed to expand digital services for constituents. Adote said the state “historically invested in these walls, these moats, these snipers on the roof, and these motion sensors,” but the new identity-driven approach focuses on how users—both the public and government employees—interact with data during their transactions and the associated risks.
The new approach employs adaptive multifactor authentication. Traditional MFA asks users for authentication—often via a text message—when they first log in. An adaptive approach allows continuous verification based on a variety of factors such as credentials, devices, locations and behaviors. For example, a state employee who usually logs in from Delaware may get an extra authentication request if they appear to be in California. A state employee who usually only edits a few fields may trigger an additional authentication request if they try to download a database. However, if the employee continues doing low-risk, expected behaviors, they wouldn’t encounter the request.
And with MFA, “the factors matter,” Adote said. While hard tokens may be the gold standard of security, Delaware officials opted to accept authentication by text, smartwatch and phone call to allow users some flexibility. Too many impediments can drive employees to find a workaround that could introduce new problems, like unauthorized use of USBs.
Removing some of the friction from the login process, “from a cybersecurity perspective, it’s one of those few times you can get users to actually appreciate you,” he said.
The focus on identity laid some groundwork for the shift to remote work necessitated by the pandemic, as did recent infrastructure upgrades that allowed the state to scale from 2,000 remote users to 15,000.
The state now operates a hybrid environment featuring virtualized machines, applications published directly to the internet and traditional tunnels for state devices to access some mainframes and legacy systems. There is no one-size-fits-all solution for the state’s diverse users. Instead, officials must understand the business process and then evaluate the risk surrounding it.
The state’s investment in endpoint detection and response has been effective in mitigating risk from remote workers. “Making sure they were coming from a secure device—that their device is void of malware and doesn’t have adversarial behavior on it—helps us in our risk decision-making,” Adote said.
EDR solutions also help security personnel execute their response playbooks. Adote explained that cloud-based solutions allow them to enact quarantine protocols and restore devices to a known-safe state in ransomware or other attacks. Turning the clock back to before a ransomware attack allows the employee to get back to work until the security team can wipe and rebuild a machine.
Delaware’s layered defenses aim to help teams spot anomalies in behavior rather than rely on known signatures. By the time a would-be hacker’s tactics are published, they’ve moved on or intentionally changed their methods when they realize they’ve been spotted. Others are able to write malware on the fly, and many are willing to work together to infiltrate systems. The rise of ransomware-as-a-service means that would-be hackers can pay for technical expertise and only focus on writing a convincing phishing email.
This puts government teams at a disadvantage as their attention is split between enabling the business and securing it, Adote said. “You definitely want to have your security awareness training up to par because [attackers] can be walked through the door by your users.”