A new draft memo seeks to build out the US federal government’s underlying zero-trust architecture to smooth the path for a coterie of recent cybersecurity-related executive orders, initiatives and mandates from the President’s office.
The memorandum, released by the Office of Management and Budget, requires major progress on the part of agencies over the next three years in the areas of identity management, device and asset tracking, encryption of federal network traffic and software testing.
Like every other organisation, the federal government “can no longer depend on perimeter-based defences to keep its critical systems and data safe,” the memo states. Indeed, while federal cybersecurity systems like Einstein and Continuous Diagnostics and Mitigation were busy scouring federal networks, hacks like the SolarWinds and Microsoft Exchange campaigns were able to bypass those defences by explicitly targeting the applications and servers that agencies already trusted.
While those systems aren’t going anywhere soon, the new strategy delineates a clear attempt to centre the government’s cybersecurity away from the perimeter and towards an environment where software, hardware and people are regularly validated and verified.
The goal: by the end of fiscal 2024, government agencies should have an enterprise identity system in place for staff, contractors and partners to access applications that include phishing-resistant multi-factor authentication, and a complete inventory of IT devices and hardware in place.
Plus the ability to conduct detection and incident response on them, network segmentation for internal systems and encryption of all DNS requests and HTTP traffic, routine testing of application code for security weaknesses in tandem with vulnerability disclosure programs, and enterprise-wide logging and information sharing practices around cybersecurity threats.
Zero trust privacy laws
The White House is also pushing for a raft of changes to identity management practices in government, including single sign-on schemes for different applications and cloud services. Agencies must also have secure password policies as well and use a CISA-approved solution to cross-check internal passwords against breached data released or leaked online.
The requirements around code testing, particularly the push to get agencies to use both automated testing tools in tandem with more targeted manual and human-directed reviews, reflect the Biden administration’s view that software security sits at the heart of many of the most damaging hacks in recent memory.
“For federal applications to withstand sophisticated probing and attack, agencies need to go beyond implementing and documenting security controls,” OMB warns. “To gain confidence in the security of their systems, agencies will need to analyze their software and its deployed functionality with a comprehensive and rigorous approach, whether their software is built internally or by a contracted vendor.”
The sprawling continuous diagnostics and mitigation program is still viewed as “foundational” to the government’s asset management goals but will be adjusted to incorporate more least access privilege features and better align with the security challenges posed by cloud infrastructure. Eventually, the government wants to ensure that “every human-operated enterprise-provisioned device has an agency-chosen endpoint detection and response (EDR) tool.”
It will have to incorporate more zero-trust functionality of its own to limit who has access to the tools and data. Similar to how experts sometimes worry about the security implications of giving antivirus programs and endpoint detection and response systems near complete control and access over your network, the government is worried that CDM’s visibility into federal networks and devices could be compromised or used as a vector for a broader hacking campaign.
A key argument from the U.S. government while defending their ban on agencies buying or using Kaspersky Labs software was that the exquisite control antivirus programs have provided over host systems and devices and local Russian laws around data storage made them too risky to leave in federal networks. The concern here is similar.
“CISA must assume that its monitoring infrastructure could become compromised and adjust the CDM program accordingly,” the memo warns.
It’s the latest shoe to drop from the Biden White House in a year where the administration has sought to put its stamp on federal cybersecurity operations and policy as it responds to a wave of damaging hacks against government, industry and critical infrastructure. That includes a massive cybersecurity executive order modernizing security practices for agencies and contractors, a raft of announcements with the private sector last month kicking off a range of initiatives to shore up cooperation on supply chain security and the cybersecurity workforce, enhanced requirements around data logging and others.
