The Current Government Security Environment

Today, nearly every valid user of federal government IT systems is required to have a digital key to unlock the kingdom of sensitive information and public sector data. Those keys are all part of the federally mandated PKI, which provides baseline security to agencies’ IT infrastructures by assigning roles, policies and procedures to digital certificates, providing blanket encryption to applications and preventing users without keys from accessing application data.

Agnos described PKI as “the ability to provide the checks and balances between the utilization of digital certificates to identify and authenticate users.” However, he said, while PKI does provide some degree of authentication, most organizations will need to add more layers to their cybersecurity protocols in order to truly safeguard their information from malicious users.

“PKI is a binary solution, meaning it gives you a yes or no solution,” Agnos explained. While PKI prevents users without digital keys from accessing protected information, those who do have a key gain nearly universal access to what lies within the infrastructure. More often than not, that results in users having unnecessary or even inappropriate access to information.

In addition to potentially providing excessive access to users, PKI also leaves agencies vulnerable to illegitimate users via falsified credentials. Agnos referenced a previous breach at an intelligence agency, where an insider fabricated digital keys to gain access to sensitive information. This tactic is not uncommon, given its relative ease: A malicious user only has to replicate the infrastructure key to gain nearly unlimited access to information and applications when PKI is the only layer of defense.

Moreover, while PKI authenticates digital certificates, it doesn’t dive into the details or credentials of individual users.

“An insider threat isn’t necessarily always an employee or a contractor who compromises your information,” Rivey said. “It could be someone who has stolen your identity or who has executed a phishing attack on an employee or contractor and inserted malicious software into the infrastructure. You can address that sort of insider threat by adding more layers of defense.”

Especially in government, further segmentation of access is necessary to reduce the risk of data overexposure and ensure that only the appropriate users can access sensitive or classified information. Adding additional attribute checks to sign-on protocols, as well as applying security directly to applications, can provide better information protection guarantees.

Download the full perspective here.