This is the fifth in a series of Covington blogs on implementation of Executive Order 14028, “Improving the Nation’s Cybersecurity”, issued by President Biden on May 12, 2021 (the “Cyber EO”).  The first blog summarized the Cyber EO’s key provisions and timelines, and the second, third, and fourth blogs described the actions taken by various federal government agencies to implement the EO during June, July, and August 2021, respectively.  This blog summarizes  key actions taken to implement the Cyber EO during September 2021.

I.   Actions Taken During September 2021 to Modernize Federal Government Cybersecurity

The Office of Management and Budget (OMB) publically released a draft zero trust architecture strategy for federal agencies on September 9, 2021.  On that same day, the Cybersecurity and Infrastructure Agency (CISA) issued two draft documents designed to further OMB’s zero trust strategy: the Zero Trust Maturity Model and the Cloud Security Technical Reference Architecture.  Each of these documents was required by Section 3 of the Cyber EO to modernize and standardize federal government agency approaches to cybersecurity.

The OMB draft zero trust strategy states that the Federal Government can no longer depend on perimeter-based defenses to protect critical systems and data in the current threat environment, and that meeting these threats “will require a major paradigm shift in how Federal agencies approach cybersecurity” — namely, migration to a Zero Trust Architecture.  The draft strategy identifies the “foundational tenet” of  Zero Trust  as “no actor, system, network, or service operating outside or within the perimeter can be trusted.  Instead, we must verify anything and everything attempting to establish access.” The draft states that the purpose of the strategy as “to put all Federal agencies on a common roadmap [to zero trust] by laying out the initial steps agencies must take to enable their journey toward a highly mature zero trust architecture.”

The draft strategy would require agencies to achieve certain specified zero trust security goals by the end of FY2024. These goals are grouped according to five “pillars” underlying the foundation of zero trust.  These pillars are:

• Identity: Agency staff use an enterprise-wide identity to access the applications they use in their work. Phishing-resistant MFA protects those personnel from sophisticated online attacks.
• Devices: The Federal Government has a complete inventory of every device it operates and authorizes for Government use, and can detect and respond to incidents on those devices.
• Networks: Agencies encrypt all DNS requests and HTTP traffic within their environment, and begin segmenting networks around their applications. The Federal government identifies a workable path to encrypting emails in transit.
• Applications: Agencies treat all applications as internet-connected, routinely subject their applications to rigorous testing, and welcome external vulnerability reports.
• Data: Agencies are on a clear, shared path to deploy protections that make use of thorough data categorization. Agencies  take advantage of cloud security services to monitor access to their sensitive data, and have implemented enterprise-wide logging and information sharing.

The draft strategy provides considerable detail regarding the goals associated with each of the pillars described above.  In addition, the draft strategy requires each agency to update its zero trust architecture implementation plan to incorporate these requirements and to submit its updated plan to OMB within 60 days after the draft strategy becomes final.

The draft CISA Zero Trust Maturity Model issued on September 9 identifies  three stages of implementation for each of the five foundational “pillars” identified in the draft OMB strategy: “Traditional”; “Advanced”; and “Optimal”.  The model describes each of these stages as follows:

• Traditional: Manual configurations and assignment of attributes, static security policies, pillar-level solutions with coarse dependencies on external systems, least-function established at provisioning, proprietary and inflexible pillars of policy enforcement, manual incident response and mitigation deployment.
• Advanced: Some cross-pillar coordination, centralized visibility, centralized identity control, policy enforcement based on cross-pillar inputs and outputs, some incident response to pre-defined mitigations, increased detail in dependencies with external systems, some least-privilege changes based on posture assessments.
• Optimal: Fully automated assigning of attributes to assets and resources, dynamic policies based on automated/observed triggers, assets have self-enumerated dependencies for dynamic least-privilege access (within thresholds), alignment with open standards for cross-pillar operability, centralized visibility with historian functionality for point-in-time recollection of state.

CISA’s draft maturity model provides considerable additional detail regarding each of the above maturity stages.  It also identifies current and expected services and offerings by CISA that can help an agency reach a higher stage of zero trust maturity.

Finally, CISA’s Cloud Security Technical Reference Architecture provides guidance to federal agencies regarding the advantages and risks of adopting cloud-based services as they move toward zero trust architecture. The Cloud Security Technical Reference Architecture  recommends approaches to cloud migration and data protection for agency data collection and reporting that leverages Cloud Security Posture Management (CSPM). The Architecture document defines CSPM as a continuous process of monitoring a cloud environment; identifying, disclosing, and mitigating cloud vulnerabilities; and improving cloud security.

II.  Actions Taken During September 2021 to Enhance Software Supply Chain Security

The National Institute of Standards and Technology (NIST) held a public workshop on September 14 and 15, 2021, to obtain feedback from government agencies, industry, and other sectors on its draft criteria for pilot labelling programs for (1) consumer software and (2) consumer Internet of Things (IoT) devices required by section 4 of the Cyber EO.  Among the issues discussed at the workshop were whether labelling should be voluntary or mandatory and what methods should be used for conformity assessment and attestation with respect to consumer software and IoT device labels.  A NIST spokesperson stated at the meeting that NIST does not intend to establish its own labelling programs, but rather is focused on developing a baseline for the contents of  consumer software and  IoT labels.  NIST has also stated that it plans to issue a second draft of labelling baseline criteria in October 2021 based on input from the September 14-15 workshop, and  to meet the February 2022 deadline in the Cyber EO for publication of the final baseline.