Implementing Zero Trust in Government Agencies: How to Think Beyond Identity

As enterprise networks change to support remote users and cloud-based assets that are not located within an enterprise-owned network boundary, security has forever changed. Zero trust focuses on protecting resources, not network segments, as the network location is no longer seen as the prime component to the security posture of the resource. In 2020, the definitions and guidance for what zero trust is and how it should be implemented have been formally laid out in the pending NIST 800-207 publication. According to this guidance, users and their identities play a pivotal role in a zero trust framework, and organizations must ensure on a continuous basis that only authenticated and authorized users and devices can access applications and data. However, identity is just the beginning when designing a zero trust environment. This session will review the latest research on agency adoption of Zero trust, discuss the 7 basic tenets of a Zero Trust architecture that NIST has identified, and cover why evaluating behavioral attributes is also important to consider as you continually re-evaluate trust throughout the users interaction with your data.