Ensuring Mobile Devices Meet 2024 Federal Security Requirements for Zero Trust
Security isn’t a “nice to have” in the federal government. It’s a necessity. The standard for federal agencies is a zero trust infrastructure, which means that every device, network, service, and user must have multiple levels of security and authentication to keep confidential government information safe. With the Sept. 30 deadline drawing closer for federal civilian agencies to develop a zero trust strategy, the topic becomes even more timely.
In April 2023, the Cybersecurity & Infrastructure Security Agency (CISA) released its Zero Trust Maturity Model Version 2.0 to help guide agencies in strategy development. While 67% of federal agencies report confidence in meeting these requirements, they need a trusted IT solutions partner to reach and maintain zero trust security compliance.
Challenges IT teams face in reaching zero trust
Three key challenges make it difficult for federal agencies to achieve the required zero trust security goals:
- Most agencies work under an “implicit trust” model. This means they grant access to information based on fixed attributes, like location. Zero trust requires agencies to take a more adaptive approach, granting access based on identity, context, and data to secure classified information and minimize cybersecurity threats. This requires redefining security standards and changing systems that agencies may have used for years. It can be hard to break these patterns, especially in today’s digital landscape where most things already have established workflows and standards.
- Different stakeholders have different priorities. While IT teams may have the expertise and resources to enhance networks and devices with upgraded authentication and security measures, it is likely to require additional costs — which require approval from senior leadership — or more steps for the end user, which can impact workflows. Varying priorities may cause delays in the implementation process for zero trust.
- There isn’t a standard starting line for transitioning to zero trust. CISA outlines four different peaks on the journey to zero trust that the more than 400 federal agencies nationwide could fall under. Some agencies are at the traditional level, with manually configured device lifecycles, static security policies, and siloed pillars of policy enforcement. Each subsequent level — initial, advanced, and optimal — requires greater levels of protection, details, and complexity for adoption. To get all federal agencies to a zero trust infrastructure, each agency must first identify where it is in its security journey, and from there, the steps it must take to reach the optimal level.
How TOUGHBOOK devices support a zero trust strategy
Devices, which are a key component of zero trust security infrastructures, can be an agency’s biggest asset and biggest risk. They keep teams connected and can be used to store and share important information beyond the walls of government buildings, which is critical with nearly 70% of federal employees still working remotely in some capacity. But given the highly classified nature of government data and records, federal employees can’t use just any device on any network.
Panasonic Connect’s TOUGHBOOK devices and integrated software support federal agencies in their transition to zero trust in several ways, including:
-
Hardware-based encryption to maintain device performance while keeping data secure. Users can move encrypted drives to other machines with a password to keep data protected until authenticated for the new device. The devices can also support software-based encryption, which is easy to use and update as standards change.
-
Multiple authentication options, such as contactless and insertable smartcard readers and fingerprint scanners, to guard identity and limit access to the appropriate users. These help agencies comply with multifactor authentication requirements.
-
Asset tracking software to allow agencies to manage and track devices after assigning them to end-users. That way, if a device is compromised, IT can address the issue quickly and even render the device unusable by wiping sensitive data.
Along with these features, the key benefit of TOUGHBOOK devices for zero trust compliance is their longevity in the field. Nothing is more frustrating than setting up a device with all the security and authentication requirements only to have it break in the often-challenging work environments of federal agencies.
TOUGHBOOK mobile solutions are designed and built with these mission-critical conditions in mind. The devices are Trade Agreements Act (TAA) compliant to control the supply chain and manufacturing process, and they offer modularity via expansion packs (xPAKs) so agencies can adapt their devices as needed and security requirements change without issuing a new unit.
Learn more about how Panasonic Connect helps federal agencies enhance security measures to support efforts toward a zero trust security model.
