CISA looks to set the example for data stewardship under ‘zero trust’ push

CISA is helping agencies advance data security, while ensuring it has its own data house in order.

Justin Doubleday@jdoubledayWFED

June 18, 2024 3:33 pm

3 min read

Under the ongoing federal “zero trust” push, data is often considered one of the most important but least mature area for federal agencies.

The Cybersecurity and Infrastructure Security Agency (CISA), which maintains the “zero trust maturity model” that serves as a roadmap for agencies, is also working to better understand, protect, and connect its cybersecurity data, according to Grant Dasher, architecture branch chief within the office of the technical director at CISA.

“Data is one of the areas of the zero trust transition that probably has gotten a little bit less attention, but that’s not because it’s not critically important,” Dasher said on Federal News Network. “We do think it’s critically important.”

Dasher said one of his big jobs is to help CISA’s cybersecurity teams gain an understanding of the agency’s internal data holdings. That work is critical to programs like Continuous Diagnostics and Mitigation (CDM), which provides cybersecurity services and dashboards to the entire federal civilian executive branch.

“We are applying strong security controls to the data that we steward, and making sure that we understand it and connect it between different parts of the mission, so that they can make effective use of it,” Dasher said.

CISA’s chief data stewards

To help address the data challenge, Dasher said CISA has identified “chief data stewards” who are responsible for managing specific datasets across the agency. Those responsibilities include identifying the metadata characteristics that are necessary to both share and protect the information in question.

“We think developing that understanding is critical, because then on top of that, you can put in place data governance controls,” Dasher said. “You can say, ‘Okay, well, this person is the data owner, or the data steward. And so this is the person who should be able to approve, for example, access requests to that data by other parts of the organization’.”

CISA’s zero trust support

Combining data access controls with strong identity governance is a key aspect of moving away from perimeter-based cybersecurity and toward a zero trust architecture.

Within the CDM program, CISA has made a major investment in Endpoint Detection and Response (EDR) tools that agencies are adopting as part of the zero trust push. Dasher said CISA has also helped some smaller agencies with identity security. And the cyber agency is also helping agencies adopt its Secure Cloud Business Applications (SCuBA) guidance.

Ultimately, though, Dasher said there’s no one-size-fits all solution to improving data security across federal agencies. But he said its key for agencies to embrace established best practices in cyber risk management.

“There’s a natural tension here between enabling access to support the mission and providing security,” Dasher said. “We can’t let security become something that prevents the government from delivering services to its to its constituents. But we have to protect the data. And so finding how to triangulate that is really the crux of data protection.”