Implementing zero trust may seem daunting, but it is also an opportunity to integrate more secure coding practices into your software applications from the start. Zero-trust security assumes that all traffic on your internal network is potentially malicious. Consequently, it requires taking measures to:

In a recent webinar produced by Federal News Network, the Director of the Environmental Protection Agency (EPA)’s Office of Information Security and Privacy, Tonya Manning, detailed the state of the agency’s zero trust and data handling postures, as well as its latest priorities. We’ll spotlight several takeaways and look at what’s to likely come down the pike for the EPA in the coming months and years.

Zero Trust Architecture

Over the last few years, the federal government has begun to embrace a zero trust approach as the new cybersecurity standard for agencies. Utilizing the latest solutions and best practices, the hope is to bolster federal cybersecurity and create a robust and resilient IT infrastructure that can protect and secure networks from attacks and breaches.

As organizations adapt to hybrid work and more and more cloud services are deployed, new service entities that collaborate and exchange data without human interaction, such as virtual machines and containers, are proliferating. The growth of these service accounts and identities and their increasing volumes of permissions, privileges, and entitlements expose organizations to new attack vectors. 

"Zero Trust is a cybersecurity strategy and framework that embeds IT security mechanisms throughout an architecture that generate metadata used to secure, manage, and monitor every device user, application, and network transaction at the perimeter and within every network enclave."

From the Department of Defense (DoD) Zero Trust Reference Architecture v1.0

Zero Trust is a concept gaining significant attention across the federal landscape. The idea isn’t new, and yet the notion of "never trust, always verify" is appearing more and more in memos, solicitations and other federal government announcements. For example, the Office of Management and Budget (OMB) released memo M-22-09, "Moving the U.S. Government Toward Zero Trust Cybersecurity Principles," in late January 2022.

President Joe Biden signed the National Defense Authorization Act (NDAA) for fiscal year 2022 (FY22) into law on December 27, 2021. It authorizes $770 billion in defense spending which is a 5% increase over last year. This marks 61 consecutive years that a bill received bipartisan support from congress (a display of agreement that has become increasingly rare for DC politics).

With another busy year behind us, it’s time to look ahead to fiscal year (FY) 2022. The official information technology (IT) budget request is $97B, a 4% increase over FY21, which would be a new record. Of course, those numbers undercount all the IT spending that goes unreported. Furthermore, remaining provisions in the American Rescue Plan, the Technology Modernization Fund and IT provisions in the Infrastructure Bill will represent additional pockets of opportunity worth billions for channel partners and technology vendors.

Zero Trust is an approach to network security which assumes that just because something is on your network, doesn’t necessarily mean it is trustworthy. Zero Trust allows organizations to apply security controls to network traffic within the perimeter, not just at the edge.

Current IT modernization initiatives are challenging federal agencies to implement significant changes to their infrastructure at a breakneck pace. As they look to keep pace with an increasingly sophisticated cyber threat environment and accommodate workflows shifting to the cloud, the federal government is looking to zero trust as a solution. Zero trust is a security model that maintains secure access to data and applications based on dynamic security policies reacting to access request specifics, as opposed to the network from where access originates.