The cat-and-mouse game between threat actors and cybersecurity professionals continued unabated in 2023, with new threats designed to avoid detection. Many of these threats are new takes on old ones, such as “leveling up” invoice fraud. And ransomware attacks are evolving; rather than encrypting victims’ data, they are straightforwardly stealing the information and extorting payment by threatening to post the info online or t...

Cybersecurity has always contended with evolving threats. As the internet has become more embedded into social and economic life and smart phones, tablets and other handheld devices become ubiquitous, bad actors have devised new attacks to capitalize on new vulnerabilities. And just as agencies are implementing zero trust architecture to help with this wave, other IT developments are threatening to upend cybersecurity even more. For instance,...

Zero trust revolutionizes network security architecture because it is data-centric and designed to stop data breaches. While that is its primary purpose for government, it also increases agility for modern networks that traditional network designs can’t emulate. It has been almost two years since the Office of Management and Budget issued its federal zero trust architecture strategy, which set out specific goals for agencies to achieve b...

Cybersecurity professionals working for state and local agencies and educational systems are likely already aware that cyber attacks targeting their organizations are increasing sharply – the second quarter of 2023 saw a 40% increase over the first quarter of the year. System defenders face the ongoing challenges of resource constraints, increasingly complex networks, and data overload. Add in emerging cyber threats from the accelerating...

Ransomware, malware, phishing, DDoS, social engineering, zero-day exploit, botnets – the list of types of attacks out there is long enough to keep even the most seasoned cybersecurity expert awake at night. And with the increased use of remote computing, the cyber attack surface grows as more edge devices are added to networks. Creating a zero trust environment holds a lot of promise to provide significantly improved cybersecurity. In th...

Government at all levels is moving as quickly as possible to integrate new solutions and overhaul processes that need streamlining. At the same time, officials are keeping close watch on AI and other emerging technologies, wary of the law of unintended consequences. For instance, in early September California Gov. Gavin Newsom signed an executive order directing state agencies to study the development, use and risks of generative artificial in...

The cybersecurity slogan for zero trust is a simple one: Never trust, always verify. This slogan fits into the Department of Defense mindset, which is always focused on how to reduce risk, but it’s a challenge to apply it to the federal government’s largest agency. An important tool in pursuing zero trust is to implement microsegmentation – partitioning a network into small, isolated sections to reduce the attack surface in e...

Advances in telecommunications capabilities are a major driver in Department of Defense programs. From creating secure private networks that U.S. military forces and their partners can use in conflicts to integrating 5G capabilities to create “smart” warehouses to significant improvements in supply chain logistics, DoD has been committed to investing in rethinking the meaning and applications of communications. One of the next step...

Communications security is one of the foremost priorities in any battlespace. This is one reason the Department of Defense is keen on building out 5G capabilities, because of its ability to create secure private networks anywhere it is deployed. But 5G’s capabilities extend beyond creating private networks on the fly. Its ability to handle massive amounts of data makes it a crucial component in real-time data collection from all sources,...

The central premise of Office of Management and Budget Memo 22-09 laying out the Federal Zero Trust Strategy is that no actor, system, network, or service operating outside or within the security perimeter is trusted. Controlling access is everything. This makes defining identity crucial – not just for people, but for every device of any kind that tries to access an agency system. The strongest form of identity management is attribute-ba...