Zero Trust Architecture (ZTA) is a cybersecurity framework based on a “never trust, always verify” approach to network, application, data, and IT infrastructure access. ZTA has become a top priority for federal health agencies as they contend with the always present and increasing risk of cyber attacks. Yet implementing ZTA across the IT infrastructure remains a challenge for many agencies even as they work to comply with ZTA plans mandated by the 2021 Executive Order on Improving the Nation’s Cybersecurity. A great deal of the challenge in achieving ZTA across health agencies is in its complexity. No one product delivers ZTA. Instead, zero trust involves a layered approach that builds security across five interrelated pillars: identity, device, network, application, and data. However, securing the data pillar is often considered the most challenging because it requires more innovation and investment to implement successfully.
To help federal health agencies on their Zero Trust journey, here are key strategies to guide agencies in securing the data pillar, making sure data is available when and where it is needed to drive decision advantage, improving total user experiences and supporting mission outcomes.
Protect Data from the Network to the Edge
An explosion of data from modern workloads, new technologies, and Internet of Things interconnected devices means that health agencies have more data than ever (some of it considered Protected Health Information, or PHI) to manage and secure, both at rest and in motion. Users are also generating data and requiring access not only inside the agency, but also from the edge of agency networks – from remote offices, patient or beneficiary devices and portals, and other federal agencies, contractors, or health organizations that share data with or collect data for the agency.
Agencies will be positioned to protect these access points by:
- Striking a balance between security and administrator access
Utilize tools including Privileged Access Management (PAM) to provide just-in-time/just-enough access to strengthen security posture while enabling administrators to keep servers and data available. - Facilitating a cultural shift for user access
Mitigate the potential frustration of stringent login, authentication, and user provisioning requirements through awareness training to improve understanding of the importance of added steps to improve cybersecurity. - Understanding security needs for different personnel
Help security administrators gain a clear picture of the full identity environment, identify gaps, and inform the creation of security configuration requirements for different personnel (e.g., session lockout durations). - Securing and maintaining access to interconnected devices
Design security policies for account and device registration that address the risk of medical device data breaches while maintaining critical health data availability.
Categorize and Classify Data
While each user is assigned permissions to individual areas of the network, it is also critical to classify structured and unstructured data properly. This enables health agencies to control how data moves through the organization and who has access to specific areas within the data.
Important steps include:
- Identifying structured and unstructured data
IT leaders need to understand what data they have and what form it takes as a precursor to data categorization efforts and building data libraries and data management policies.
- Leveraging data tagging and classification toolsets
Defining clear data tagging standards will set a foundation to implement data tagging and classification at the metadata level to align specific data types with user permissions and access. These processes can be automated using artificial intelligence (AI) and robotic process automated (RPA)-based tools.
- Deploying tokenization for granular data access
By taking advantage of tokenization, agencies can encrypt individual sections of data, enabling granular access based on user permissions even within a single type of data. For instance, a beneficiary health record may be accessed in full by the patient and provider, while administrative staff have access to only portions of the information.
Among the benefits of protecting data through stringent access protocols and implementing data classification and categorization is that these approaches support overall efforts toward data standardization. This drives interoperability between departments and agencies and breaks down data silos that impede everything from collaboration to beneficiary experience and ultimately, mission outcomes.
Download the whitepaper to learn more ZTA-aligned data security approaches that can help federal health agencies improve total user experiences.
The author, Eric Ritter, is Vice President of Strategy and Growth at Maximus. His co-author, Kynan Carver, is Federal Cybersecurity Lead at Maximus.