The acting federal CISO said agencies now have an opening to turn years of zero trust planning into more measurable, operational security.
Federal agencies should use the push to prepare data for artificial intelligence (AI) as an opportunity to advance long-running zero trust efforts, according to acting Federal Chief Information Security Officer (CISO) Michael Duffy.
Speaking at the Billington CyberSecurity Summit on Sept. 8, Duffy said AI is bringing more agency leaders into conversations about data security, potentially giving CISOs the cross-agency support needed to make greater progress on zero trust.
“The things that I need to advance data security for zero trust, and the things that we need to make data trustworthy and usable for AI are very much aligned,” Duffy said. “Sometimes even the same things.”
Duffy encouraged CISOs to use the current AI momentum to revisit zero trust work that may have stalled earlier.
“Seizing that momentum to say, ‘The things that I may have tripped on early in this process, I think I have the right community of interest within my organization to make some meaningful steps forward,’” Duffy said. “That’s the kind of momentum that we need.”
He also cautioned against viewing zero trust as “a fad that already ran its course a few years ago.” Instead, Duffy said the current wave of AI adoption underscores why agencies spent the past several years building stronger cybersecurity foundations.
“I think it’s really important for this community to continue making important progress when it comes to implementing and executing zero trust operations, because this is exactly the moment that we foresaw several years ago,” Duffy said.
He pointed to the White House Office of Management and Budget’s memo published in January 2022 that directed federal agencies to migrate to zero trust security architectures.
“We have the strong foundation upon which to build,” he explained, referring to the memo.
Duffy also said the government is moving beyond measuring zero trust progress by asking agencies whether they have deployed a particular capability. Increasingly, officials are looking for continuously operating security controls.
The Cybersecurity and Infrastructure Security Agency’s Continuous Diagnostics and Mitigation program has evolved over the past few years to provide that telemetry across government, the acting federal CIO said.
“Now it’s continuous monitoring for real,” Duffy said. “If we look at the zero trust maturity model, this is what it’s about: zero trust in operations.”
