By Julie McCabe, Territory Account Manager, Panasonic Connect

Cybersecurity threats to the United States government from a range of bad actors are escalating. In 2023 alone, the federal government reported more than 32,000 cybersecurity incidents – a five percent increase from the previous year.

These attacks are not only growing in volume but also in sophistication, making robust cybersecurity measures more critical than ever. Supply chain security is an important part of the cybersecurity protection process.

To address these challenges and threats, the Office of Management and Budget (OMB) has set several ambitious goals through its Zero Trust Strategy memorandum. Federal agencies are expected to meet stringent cybersecurity standards, encompassing asset inventories, phishing-resistant multi-factor authentication, and enhanced data security.

Achieving these objectives will require government leaders to adopt a proactive and comprehensive change management and adaptation approach. Adopting a zero trust approach means requiring authentication and validation from the top down. Governmental entities, suppliers, and end users all need to verify their devices and prove their identities to help prevent cyberattacks and espionage.

Building Secure Supply Chains

One key priority for federal agencies is establishing secure supply chains for hardware and software. While bad actors – state-sponsored or otherwise – pose significant risks, people within the supply chain are often the first line of defense and the biggest potential vulnerability. Simple mistakes, such as mishandling sensitive devices or inadvertently exposing systems to malware, can compromise the entire chain.

To mitigate these risks, integrating security into supply chain planning is essential. Teams must be able to quickly identify and mitigate risks, ensuring that devices and systems are safeguarded against tampering and other threats.

Adopting Zero Trust Principles

Central to the OMB’s strategy is the adoption of a zero trust cybersecurity framework. This approach operates on the principle of “never trust, always verify,” requiring constant validation of all users and devices before granting access to resources.

As Alper Kerman from the National Institute of Standards and Technology explains:

“You could be working from an enterprise-owned network, a coffee shop, home or anywhere in the world, accessing resources spread across many boundaries, from on-premises to multiple cloud environments. Regardless of your network location, a zero trust approach to cybersecurity will always respond with, ‘I have zero trust in you! I need to verify you first before I can trust you and grant access to the resource you want.’ Hence, ‘never trust, always verify’ — for every access request.”

Zero trust is not a standalone initiative. It exists as just one part of a broader compliance ecosystem that also includes other frameworks such as the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) and the NSA’s Commercial Solutions for Classified (CSfC) program.

Federal agencies must ensure devices are secure, supply chains are and stay tamper-free, and that a secure chain of custody exists for maintenance and repairs.

Planning for Real-World Scenarios

Government IT leaders must also plan and account for potential security breaches, many of which can stem from human error. Several examples include an employee accidentally leaving a work laptop at a public location such as a coffee shop, a computer with sensitive information being stolen during shipping for repairs, or a bad actor physically stealing a smartphone or tablet.

A strong zero trust strategy anticipates these scenarios and integrates solutions to minimize risks and reduce the likelihood of supply chain compromise.

For agencies managing remote or hybrid workforces, these challenges multiply rapidly. Employees often use various devices, including laptops and smartphones, in a range of different locations. To address these complexities, IT teams should prioritize technology solutions with features like:

Hardware-based encryption: Protect sensitive data while maintaining device performance. This enables secure access to encrypted drives even when moved between devices.

Multiple authentication options: Contactless and insertable smartcard readers, fingerprint scanners, and other technologies provide flexibility and security.

Asset tracking software: Helps agencies monitor device usage and respond swiftly to lost or stolen equipment.

A Path Forward

As highlighted by the OMB’s Zero Trust Strategy memorandum, protecting federal systems is a top priority. By embracing a zero trust framework and securing supply chains, technology leaders at agencies can stay ahead of increasingly sophisticated threats, ensuring sensitive data and systems remain secure while adapting to evolving challenges.

In the fight against cyber threats, a robust zero trust strategy is not just an option – it is a necessity. Zero trust and adoption of strategies like hardware-based encryption, multiple authentication options, asset tracking software, and stringent authentication protocols go a long way in increasing governmental cybersecurity. Whether a device is being sent in for repairs or being used in a hybrid workspace for the first time, smart planning and authentication helps users and helps their organizations.