DHS Achieves Zero Trust and Security Goals Through Automation

Automating data protection is putting the Department of Homeland Security (DHS) one step closer to achieving a zero trust architecture and improving overall cybersecurity.

DHS is also continuing to pursue microservices automation, which would allow the agency to share data with other federal agencies and local law enforcement more quickly and efficiently.

Eric Sanders, CISO for the Office of Intelligence and Analysis at DHS, said his office is using automation to securely assist U.S. Customs and Border Protection (CBP) operations.

“We helped create this national vetting center, where we’re able to automate the vetting of persons coming in to our borders. We also helped with the Afghan crisis, with folks that came in as a result of that,” Sanders said. “So, we rely a lot on automation. The theme is valid, it’s the most important thing that helps us achieve what we’re trying to get to from a security perspective.”

According to Sanders, there’s an obvious connection between automation and zero trust. Automation, for example, can streamline identity, credentials and access management (ICAM) solutions by automating data access decisions.

“Zero trust environment role-based access controls aren’t enough. We need to assign attributes to people and things to make sure that we’re making the right kinds of access decisions, so assigning attributes to data, making sure we have the right attributes in place, there’s room for automation there,” Sanders said.

Cyber leaders at U.S. Immigration and Customs Enforcement (ICE) and the Cybersecurity and Infrastructure Security Agency (CISA) believe it’s important to apply zero trust principles to enterprise mobility. Rob Thorne, CISO at ICE, said mobile devices are another great opportunity to leverage existing technologies.

ICE took a crawl, walk, run approach when it began its zero-trust journey three years ago.

“ICE sees zero trust as a strategy, as an enabler to modernize our network and get the latest and greatest technologies to our law enforcement officers,” Thorne said, “One of our strategic priorities is our accelerated and service delivery model. It delivers secure and reliable solutions out to our mission space at the speed of mission, moving away from inflexible and rigid capabilities towards more secure service edge capabilities.”

Vincent Sritapan, Chief, Quality Services Management Office at CISA, said mobile devices need special consideration when implementing zero trust.

“I believe mobile is a prime candidate to get us to zero trust faster because mobile devices run on networks we don’t control. Mobile itself does need special considerations for zero trust because of app isolation and the micro segmentation it’s inherently built with zero trust in mind,” Sritapan said. “Zero trust concepts built in already to the platforms, the architecture is different and capabilities actually bring you closer to zero trust.”

Thorne and Sritapan both feel that integrating disparate zero trust solutions with mobile applications and mobile cloud solutions will be challenging for some federal agencies.

“Integration pieces will be challenging. Vendors may provide one capability but not another. Integration with mobile threat defense,” Thorne said. “A big thing is user experience with mobile devices, everyone wants to have same experience on their laptops, the challenge for us is how do we get this same user experience without letting security get in the way.”

Sritapan and Sanders also advised starting to implement zero trust principles now and relying on automation to ease the shift.

“Vendors should understand automation is key but integrating automation that gets us to real time understanding is equally important,” Sanders said. “We’ve got to automate away the lower risks things that are in our way and take care of the higher risk activities.”