Agencies responsible for the nation’s critical infrastructure and energy reserves face exceptional threats to security. From intellectual property theft to attacks on the power grid, and interruptions to the energy supply caused by both physical and cyberattacks there are myriad. A recent string of cyberattacks against the Department of Energy (DOE)’s national labs, such as the attack on the Idaho National Laboratory, underscore the intensity of security threats national labs face, set against a backdrop of global conflict. While all cybersecurity threats are serious, when attacks impact the nation’s energy labs, they can disrupt fundamental advancements for energy priorities and associated critical infrastructure. In addition, these cyberattacks also threaten the availability of vital systems and data, thus jeopardizing the economy and overall national security. Addressing these risks requires the DOE and its national labs to prioritize a Zero Trust approach to cybersecurity.
Why Zero Trust is Critical to Securing National Laboratories
Federal agencies have been focused on implementing Zero Trust architecture since the May 2021 Executive Order on cybersecurity was issued. The Executive Order requires agencies to modernize cyber defenses, improve information sharing, and strengthen responses to attacks. For the DoE’s National Labs, implementing Zero Trust architecture will help the agency address outstanding measures to implement Insider Threat Program as well as the Government Accountability Office’s recommendations to achieve them.
The DOE’s national laboratories work on siloed IT environments, which can present cybersecurity vulnerabilities with cross-lab information sharing. A security vulnerability at one lab can open up other labs to attacks from bad threat actors. A Zero Trust approach is critical for securing national labs from a network of vulnerabilities by ensuring that each interaction is verified and secure. A consortium across labs and critical infrastructure, chartered with Zero Trust standards adoption and change reviews, can help set mutually defined standard minimum Zero Trust Architecture requirements that will ultimately make all labs – and the nation – more secure.
However, there are still many challenges within the DOE’s National Labs that can create resistance to change, such as siloed IT environments or the fear that ambitious IT priorities could pull attention or resources away from current R&D projects. By working with outside technology experts, the DOE could navigate these challenges with ease and make meaningful progress towards Zero Trust Architecture without pulling focus from the core mission.
Mapping a Zero Trust Architecture Journey
The first step on the path to Zero Trust approach for any agency is understanding what its current security posture is and then clearly identifying gaps against the Executive Order. By identifying these two points, technology integration experts can advise agencies on the appropriate mix of cyber technologies and capabilities that are uniquely appropriate to help the organization move the needle forward. These may include identity management, cloud, artificial intelligence, machine learning, and data analytics.
Technology integration expertise can guide agencies to align their Zero Trust Architecture journeys to meet cybersecurity requirements in service of mission imperatives. Agencies might consider several approaches including:
- A gradual, pragmatic Zero Trust rollout that identifies areas of efficiency and avoids mission disruption while making progress toward prioritized cybersecurity targets.
- A focused Zero Trust pathway that features a more concentrated approach to meeting goals and deadlines within a discrete timeframe by leveraging expertise, resources, and relationships across the federal government to accelerate cybersecurity progress.
- A partnership pathway that enables agencies to fully focus on core mission imperatives by outsourcing Zero Trust responsibilities to a trusted vendor, thereby reducing execution risk and management overhead.
Realizing the Ultimate Goal for National Labs: Innovation
Executive Orders and requirements aside, experts enlisted to help implement cybersecurity initiatives for national labs must focus strategically, from start to finish, on supporting the lab’s primary goal: to innovate and solve fundamental resource and development challenges. Every tactic, tool, and technology deployed along the Zero Trust journey must be considered against the lab’s core charter, ensuring that R&D critical to the nation’s energy solutions and critical infrastructure thrive in a secure, available, and uninterrupted IT ecosystem.
Learn more strategies for implementing Zero Trust Architecture to safeguard critical infrastructure and national labs here.
Kynan Carver is the Cybersecurity Lead at Maximus, and an expert in providing federal and defense agencies with the knowledge they need to leverage innovative technology that expands cybersecurity practices.