Zero Trust Cyber Exchange: NARA’s Sheena Burrell on adjusting the ZTA plan to the agency | Federal News Network
2022-06-24 14:38 (EST) - Jory Heckman
Every agency faces a clear mandate from the Biden administration to move toward a zero trust cybersecurity architecture.
Some agencies started moving toward a zero trust approach before the administrations executive order made it a governmentwide priority. Others, however, are just getting started.
Sheena Burrell, deputy chief information officer at the National Archives and Records Administration, said each agencys journey to zero trust will look different because each agency has its own unique challenges.
Everyones...
READ MORE
NARAS SHEENA BURRELL ON ADJUSTING THE ZTA PLAN TO THE AGENCY
Everyones zero trust implementation plan should be different, and I think thats a healthy thing for them to be different, because everyones not starting from the same starting point.
Sheena Burrell Deputy Chief Information Officer, National Archives and Records Administration
Every agency faces a clear mandate from the Biden administration to move toward a zero trust cybersecurity architecture.
Some agencies started moving toward a zero trust approach before the administrations executive order made it a governmentwide priority. Others, however, are just getting started.
Sheena Burrell, deputy chief information officer at the National Archives and Records Administration, said each agencys journey to zero trust will look different because each agency has its own unique challenges.
Everyones zero trust implementation plan should be different, and I think thats a healthy thing for them to be different, because everyones not starting from the same starting point, Burrell said during Federal News Networks Zero Trust Cyber Exchange .
For small agencies like NARA, the biggest challenge standing up a zero trust strategy remains budgetary resources, she said.
NARA has a lot of data. We have to be able to protect that data, and zero trust really does give us the capabilities and that strategy. We just need to be able, from a National Archives [perspective], to take a look at all those different pillars of zero trust and figure out whats the best thing for the National Archives. Where do we really start, and how do we get those resources to be able to build a zero trust architecture? Burrell said.
SAME GOAL, DIFFERENT PATHS TO ZERO TRUST
Although agencies face unique challenges in making zero trust a reality, Burrell said that all agencies share a fundamental goal.
All agencies are going to have to really look at this the same way, in terms of what resources do you have? What are your existing tool sets that youre already working with? And what capabilities do you need to add in to have a good zero trust architecture? I think that for the most part, the National Archives wouldnt be any different in terms of how we are doing our cybersecurity measures as, say, the Social Security Administration, somewhere I used to work, Burrell said.
Agencies also share some common elements when it comes to what a zero trust implementation should achieve, she said.
We all have a plethora of data, a lot of information that we want to make sure that were protecting. But there are also different applications that we need the public to get on, Burrell said. Now that were all teleworking and were working from home, we need to make sure that we have applications that our users at our agencies can get on. Its not necessarily being restricted based off of just your network, but being able to see who is trying to get onto what application or what device. All agencies have to be able to look at that.
COMMON ZERO TRUST CHALLENGE: RESOURCES
NARA is hardly the only agency seeking additional budget resources to move forward on its zero trust strategy.
Burrell also serves on the Technology Modernization Board, which oversees a governmentwide revolving fund that lends money to agencies for IT modernization projects that demonstrate a strong return on investment. Agencies, in turn, are expected to pay back Technology Modernization Fund.
Being a member of the TMF Board, Ive seen a couple of proposals from agencies for zero trust, and they all kind of look a little bit different, she said. And its not to say any of them are wrong. Its just that needs for one agency may differ from the needs of another agency.
TMF has experienced ebbs and flows from Congress in terms of annual appropriations. However, the fund received an unprecedented $1 billion through the American Rescue Plan.
When we put out mandates, a lot of times these mandates dont come with funding, and the TMF board really does help to support those agencies who may not have a pot of money just sitting around, Burrell said.
The ARP funds led to different TMF loan repayment terms that allowed its board to give greater consideration to zero trust and cybersecurity proposals.
A lot of these zero trust strategies or even cybersecurity strategies may not have cost savings where youre able to pay back the traditional TMF loan. ... Agencies are able to put together these proposals and have a minimal payback versus a full payback, Burrell said.
The TMF Board also has several zero trust experts among its members, including Federal Chief Information Security Officer Chris DeRusha and Sean Connelly, the Cybersecurity and Infrastructure Security Agencys Trusted Internet Connection program manager.
As all these different proposals have come in, weve had those experts be able to look at them and really provide some guidance. And even if they didnt hit the mark, the TMF Board is able to say, Heres what you could do better to be able to put in a proposal again, Burrell said.
UNEXPECTED BENEFITS OF ENGAGING WITH TMF BOARD
Agencies benefit from applying for TMF funds, even if the board rejects their proposals. Burrell should know. NARA submitted a zero trust proposal to TMF that was rejected. (She recused herself from voting on her own agencys proposal.)
Following the TMF Board rejection, Burrell said NARA officials met with CISA and the Office of Management and Budget to discuss ways to improve the agencys strategy for zero trust.
I think the benefit for NARA, by putting together our proposal and getting denied, was the support from CISA, she said.
Small agencies in need of zero trust resources can also benefit from TMF in other ways. The TMF board is responsible for producing playbooks based on successful use cases. Burrell said those playbooks may especially benefit agencies that are not sure where to begin with a zero trust implementation strategy.
As agencies start to implement zero trust, especially some of our bigger agencies, like the General Services Administration or the Department of Education, those playbooks are really going to help small agencies as they go about doing their implementation of zero trust. Even if there isnt a monetary value that the TMF Board can give to some of the smaller agencies, or even bigger agencies, I think that the knowledge from the project management office and the feedback from the board on their proposals, as well as those playbooks, really do play a part holistically in the TMF Boards value to agencies, Burrell said.
Those are intangible benefits that we get from the board and from submitting TMF proposals.
To listen to and watch all the sessions from the 2022 Federal News Network Zero Trust Cyber Exchange , go to the event page .
