Zero trust – a security strategy based on the continuous authentication of all users within and outside an organization’s network – has gained momentum within the federal government in recent years, but making this vision a reality is not without its challenges.
According to expert panelists, who shared their thoughts during the Potomac Officers Club’s 2024 Cyber Summit last week, cultural change is a must in moving the zero trust journey forward.
For the Intelligence Community, this means taking an “all-means-all” approach to zero trust implementation. Kathryn Knerler, IC chief information security officer and director of the Cyber Security Group, explained that this means “getting people on the journey, making it a part of everybody’s job, and working on attitudes of leaders across everything we’re doing.”
She views zero trust as a “learning process” in which she aims to “bring people along.”
Dr. Curtis Arnold, chief scientist for cyber at Core4ce, noted that zero trust is a next step in the long evolution of network security methods. Zero trust, he said, is a pivot to a data-centric approach, and as new technologies are folded in, it is important to make sure that users are properly trained on both technologies and this strategy shift.
“Historically, all of our training has been on a specific tool. Right now, we have to work on focusing on how we train someone on all the data we have available,” he said.
If a user comes in with training in a particular area, he continued, the issue to consider is “how do you actually train them to understand the data that’s there and actually bring in the frameworks.”
The zero trust push coincides with the Department of Defense’s monumental Combined Joint All-Domain Command and Control initiative, which aims to enhance connectivity between U.S. military components, allies and partners.
Building ZT into this developing warfighting strategy presents a “puzzle” as forces work to implement the new tools that come with both of these approaches, said Lt. Col. Frank Jamerson, chief of Program Executive Office C3BM Enterprise Information Technology and cyber integration chief for the Air Force.
Training is one way the DOD is working to solve the puzzle, and Jamerson aims to sharpen this focus moving forward to address the challenges that come with understanding new technologies. He also hopes to streamline all the different tools currently available.
“Knowing that in the DOD, we’re going to have to raise a defender to use these tools, it would be helpful to see a little bit more suites of tools,” he said.
He also noted that since CJADC2 includes coalition partners, it is important to entrench the ZT concept across the board early on.
Don’t miss out on the Potomac Officers Club’s next event, the 2024 Air Force Summit on July 23! The event will bring together top Air Force officials and industry leaders to share their insights on the service branch’s most important challenges and priorities. To learn more and register to attend the event, click here.
