Moving to a zero-trust model for cybersecurity is dependent on understanding who and what needs access to your network. While simple to say, it is not as simple to do. Government agencies are currently focused on ensuring they have the full picture of what is on the network and who they need to support securing those assets.

Defining the Ecosystem

As agencies progress on their zero-trust journey, understanding every piece that touches networks becomes critical. These touchpoints often extend beyond traditional technology solutions. The growth of Internet of Things (IoT) devices introduces operational technology into the IT architecture.

Edge computing devices being used by field staff, sensors, and cameras all provide valuable data and efficiency, but they also provide an entry point for bad actors. Because of this, the Office of Management and Budget has tasked agencies with creating an IoT Inventory by the end of fiscal 2024. The memo details the breadth of devices to be inventoried, including building maintenance systems, environmental sensors, specialized equipment in hospitals and laboratories, and more. With this inventory in place, agencies will be able to take advantage of a new working group on the CISO Council, which will define IoT and OT security best practices.

New Approach = New Talent

With cybersecurity permeating every aspect of government operations - from traditional IT to the operational systems mentioned above - we need to take a look at how we train the federal workforce. With a recognized cybersecurity skills gap, new efforts are underway to grow a workforce trained and able to take on cybersecurity challenges.

• The Federal Cybersecurity Workforce Expansion Act has been introduced to grow the federal cybersecurity workforce through the creation of several programs including a focus on providing cybersecurity training to veterans.
• Keeping cyber talent in government is just as critical as training new talent. The Office of Personnel Management has created the cyber rotational program to allow federal employees to move to details at other agencies, providing the opportunity for growth within the federal government.
• The National Geospatial-Intelligence Agency is building its cyber ranks with the next generation. It created a program to hire high school students as interns and give them top-secret security clearances to work on mission-critical work.

GovEvents and GovWhitePapers have a host of resources that detail how agencies can get a handle on the things they need to secure and the people they need to do that work.

• Identify, Evaluate & Prioritize Industrial Cyber Risk (January 10, 2024; webcast) - Industrial control system (ICS) security represents one of the more challenging areas for security professionals. It's often a legacy system that wasn't designed with security in mind and, because it's different from traditional IT assets, it has very different security requirements. And no surprise--such systems are increasingly targeted by sophisticated cyberattackers, including ransomware gangs and nation-state actors. Learn how to harden OT assets against cyber-threats, identify critical endpoint vulnerabilities and risks, enable rapid recovery, and more.
• Bridging the Cybersecurity Talent Gap in Government (January 11, 2024; webcast) - Navigating the unique challenges of the government and public sector demands a specialized approach to cybersecurity talent. This session will unveil groundbreaking methods, from upskilling your current team to leveraging a pre-vetted cybersecurity talent pool. It will also explore government-funded cybersecurity training programs to enhance your workforce.
• Federal News Network's Industry Exchange Cyber (January 22, 2024; webcast) - Gain a perspective on cybersecurity issues critical to government: intelligence, endpoint management and remediation, identity security, cybersecurity asset management, and security orchestration and response.
• CyberSmart 2024: Cybersecurity Faces a Rapidly Changing Landscape (January 25, 2024; Reston, VA) - Just as agencies are implementing zero-trust architecture to help with this wave, other IT developments are threatening to upend cybersecurity even more. Artificial intelligence is being incorporated into software, even as elected officials and regulatory agencies are trying to develop new rules of the road for its use. At the same time, historically offline operations technology is beginning to be integrated with IT systems, opening up the OT to attacks that previously weren't feasible.
• Cybersecurity (white paper) - The increasing use of communication technologies relying on complex data, technology, communication, and interconnectivity has expanded attack surfaces and increased the potential risk of malicious exploitation. The Department of Homeland Security Science & Technology's Cybersecurity Program leverages multidisciplinary expertise to research, analyze, and develop cutting-edge cybersecurity technologies and capabilities to improve the protection and resilience of our national critical infrastructure and federal and state departments and agencies.
• Accelerate Cybersecurity Mandate Compliance (white paper) - In the push to comply with a multitude of cybersecurity mandates, federal agencies are faced with challenges of cost, complexity, and delays to achieve full compliance. Failure to fully implement the requirements of these mandates, however, is not an option when critical infrastructure, public services, and national security are at risk from an ever-expanding threat landscape.
• Building the Cybersecurity Workforce Pipeline (white paper) - This report analyzes the National Centers of Academic Excellence in Cyber (NCAE-C), a consortium of institutions designated as centers of excellence by the National Security Agency, to determine how NCAE-C designated institutions fare compared to other schools in graduating students with cyber-related degrees and credentials.

For more on the government's path to zero trust, explore the resources available on GovEvents and GovWhitePapers.