Reflection

This research was conducted by myself earlier this year, with the topic of research being an analysis of the implementation of Zero Trust Architecture (ZTA) across the Federal government. There were a number of interesting conclusions I had come to after completing this paper, many of which present a plethora of opportunities for improvement. As it currently stands, it seems that the biggest barrier to broad Zero Trust implementation is the unwillingness for agencies to share resources and knowledge. This is in a large part due to the fundamental differences in mission and objectives between each agency. There also seems to be a level of competition inherent between these agencies, as they are all vying for funding, many times at the expense of other agencies. Lastly, it has become clear to me through my research that in order to appropriately implement Zero Trust across the federal government, a comprehensive and coordinated consolidation of independent agency ICAM infrastructure into an overall Federal ICAM infrastructure is needed.

When considering the differences between each agency, there is one clear constant – the need for Zero Trust adherent ICAM capability. Unfortunately, condensing the entirety of all federal agencies’ existing ICAM architecture is a massive undertaking, and more importantly, one that has not yet been federally mandated. Without implementing a federal mandate to accomplish this consolidation, it is unlikely to transpire. There have been steps towards achieving this parity, however the overall progress has still been uneven.

A secondary solution to this problem I have considered is the implementation of decentralized identity. Through this implementation, identities are no longer managed by central authorities, and instead are managed by the individual associated with the identity. In the decentralized identity model there are three parties involved. The issuer is the entity that provides the signed, asserted identity. The holder is the person to whom the identity belongs. The verifier is the party requesting authentication or authorization of the holder. The benefits to this are vast, including increased security, decreased identity management overhead, and increased user privacy. With the recent shift to identity-based network security, this is a clear next step to further securing sensitive networks and user identities.

Although the benefits to decentralized identity are undoubtedly vast, there are also a few key challenges to its implementation. The first is the fact that in order for this model to function, private keys must be tied to the identity, and if these keys are lost, it could result in permanent loss of identity credentials. Additionally, this model has not yet been widely accepted, meaning in order to implement it effectively, legacy support for standard user identities must still exist. Another consideration is where these identity credentials may be stored. Cellphones are the current best repository for these credentials, as cellphones are ubiquitous. Unfortunately, n many federal environments cellphones are not allowed, meaning an alternative solution must be identified.

With all of this considered, I believe the best course of action would be to consolidate all existing agencies ICAM infrastructure, with plans to pivot to decentralized identity. Doing so will ensure the federal government is better equipped to handles the ever increasing flurry of cyber attacks.