The push to evolve security beyond the network perimeter has been in progress at many federal agencies for several years. However, the urgency to quickly accommodate remote work at scale during the onset of the coronavirus epidemic fast-tracked those initiatives.
Now, more than ever, agencies must be able to identify, monitor and manage all people, applications and devices that access government resources. The best way to do this is by putting management of identities—privileged and nonprivileged—at the center of an agency’s security strategy.
Laying the Policy Groundwork for Identity-Centric Security
In May 2019, the Office of Management and Budget published an updated Identity, Credentialing, and Access Management policy, which highlights the need to elevate the role of identity management in agency security. OMB acknowledged that hardening the network perimeter is important, however, agencies must shift from simply managing access inside and outside of the perimeter to “using identity as the underpinning for managing the risk posed by attempts to access federal resources made by users and information systems.”
The ICAM policy aligns with guidance from the National Institute of Standards and Technology, which recognizes the importance of protecting, managing, and monitoring privileged and administrative accounts, including the ability to revoke or destroy credentials in a timely manner. Moreover, the policy requires each agency to define and maintain a single comprehensive ICAM policy, process and technology solution roadmap, consistent with their operational mission needs, which aligns with the government’s Continuous Diagnostic and Mitigation program.
ICAM, CDM Alliance Boosts Network Visibility
The goal of the CDM program, which is managed by the Department of Homeland Security, is to ensure federal agencies continuously know:
What ..
Support the originator by clicking the read the rest link below.
