Page 45 - FCW, July 2020

“Nowhere in those dashboards does it say green equals zero trust.There’s no button that says zero trust to make it better. “
trust. And they stressed that this is just groundwork.
“All those things together help you get toward zero trust,” one official said, “but none of them allows you to just stand up and say, ‘We are zero trust now.’”
Zero trust doesn’t get you to green
The issues cited above would apply to any organization moving toward zero trust, but the roundtable participants said federal agencies face an additional hurdle: governmentwide mandates and the compliance culture that comes with them.
The Federal Information Security
Management Act “is very much not zero trust-friendly to me,” one official said. “CDM is not there yet either. They’re working that way, but it is very network- and on-premises-focused as well. We have to meet these mandates, and if they don’t change, it will be hard for us to move forward on zero trust because that’s a total shift in the concept.”
The Federal Acquisition Regulation and the Defense Federal Acquisition Regulation Supplement also pose challenges, another noted: “These things are too out of date to even begin to look at something like zero trust. It makes these things really, really difficult for us to move forward and implement the
right technology and the right security.” “We are incentivized to chase green on our dashboards,” a third official said and added the Federal IT Acquisition Reform Act report cards to the list of potential roadblocks. “Nowhere in those dashboards does it say green equals zero trust. There’s no button that says
zero trust to make it better. “
It’s important for vendors to
understand that chief information security officers won’t be sold on zero trust solutions just for the sake of zero trust, that official said.
“The question is: If I implement your solution, what can I get rid of from a competing product perspective on
July 2020 FCW.COM 41