Refuerce sus defensas: Iniciativas cibernéticas federales para un futuro seguro

In March 2023, the Biden administration unveiled a comprehensive national cybersecurity strategy. This set a bold vision for cybersecurity, emphasizing the need to defend critical infrastructure, dismantle cyber threats, drive market security, invest in a resilient future, and forge international partnerships. 

Building on this framework, the July 2024 White House memorandum from the Office of Management and Budget (OMB) and Office of the National Cyber Director (ONCD) outlines specific cybersecurity investment priorities for the future and provides a roadmap toward actionable, measurable outcomes. 

El último memorándum avanza en varias áreas clave destacadas en la estrategia original: 

• Transition to zero trust architectures: It describes the need to move quickly to zero trust architectures, which demands rigorous, continuous verification of every user and device. 
• Enhance public-private collaboration: It calls for scaling efforts to share information, bolster resilience, and drive collective action against evolving threats.
• Bolster the cybersecurity workforce: It focuses on expanding recruitment, retention, and addressing the skills gap hampering defensive capabilities.
• Prepare for quantum computing challenges: It highlights the need for preparing for a post-quantum future – including transitioning to quantum-resistant cryptography – and federal dedication to crypto agility for a secure future.

It’s essential you understand each of these key areas – which we summarize below and also plan to tackle in an upcoming webinar. [Save your spot by registering here to stay ahead of today’s threats and prepare for tomorrow’s challenges.)

Mejorar su estrategia de defensa 

Las agencias federales se enfrentan a retos de ciberseguridad cada vez mayores, por lo que es crucial adoptar soluciones avanzadas para mantenerse seguras. Veamos cada una de las áreas generales del memorándum de ciberseguridad y sus principales conclusiones. 

Adoptar la confianza cero para gestionar la identidad y el acceso

One of the key mandates from the ONCD with the goal of defending critical infrastructure requires government agencies to submit updated zero trust plans within 120 days. A zero trust approach shifts away from traditional perimeter-based security to a model focused on minimizing trust and maximizing verification. 

Esta verificación es crucial para las identidades de las máquinas, que superan en número a los usuarios en la mayoría de los entornos informáticos. Cada dispositivo necesita su propia identidad y credenciales para autenticarse y comunicarse de forma segura, y éstas deben gestionarse, actualizarse y revocarse cuando sea necesario. Esto crea una compleja red de identidades que puede dar lugar a lagunas y vulnerabilidades si se gestiona mal, como una identidad de máquina comprometida que permita el acceso no autorizado a áreas sensibles de una red, o que provoque interrupciones operativas. 

Moreover, all data in transit across networks must be encrypted using TLS (transport layer security) certificates. This requirement is crucial to safeguarding information as it moves between systems and devices. Managing these TLS certificates at scale requires meticulous oversight, and improper identity or certificate management can have severe repercussions. The risks associated with certificate management failures were made apparent when leading certificate authority Entrust incorrectly issued thousands of extended validation TLS certificates in 2024. Effective identity and certificate management is crucial to prevent attackers from exploiting weaknesses to breach networks, exfiltrate data, or disrupt operations.

Principales conclusiones:

• Se exige a los organismos públicos que actualicen los planes de confianza cero, centrándose en la verificación rigurosa de las identidades de las máquinas para todo lo que entre en contacto con la red.
• Una gestión adecuada de los certificados de TLS es crucial para evitar brechas en la red e interrupciones operativas.
• La detección y supervisión continuas de los certificados son fundamentales para garantizar la confianza.

Afrontar el déficit de competencias en ciberseguridad

A well-managed environment is easier to defend, but this requires a two-fold approach: raising the skill level of our cybersecurity workforce and reducing the complexity of the environments they operate in. To address this, the ONCD memo emphasizes the need for proper tooling, particularly around public key infrastructure (PKI) management. 

Government-owned technology solutions are often managed on an application-by-application basis, contributing to operational complexity. Ad-hoc management not only drives up costs but also makes the hiring of skilled personnel harder, more expensive, and frequently redundant. When each application requires its own PKI management, agencies find themselves trapped in a cycle of inefficiency: staff must juggle disparate systems instead of focusing on enhancing security across the board. 

Centralizing PKI management helps overcome this challenge. Organizations can lower complexity and boost security maturity simultaneously by streamlining certificate management across the enterprise. Centralization also sets the stage for automation, allowing for more seamless integration of encryption and authentication across various platforms. With proper tools in place, security becomes more accessible to all staff members, not just specialized experts. 

Using the right tools can provide significant advantages for training and onboarding new talent. As more cyber technicians enter the workforce, they are best positioned for success when working with the tools they’ve been trained on, such as EJBCA, Active Directory, and other industry standards. Equipping new hires with familiar systems can reduce the learning curve for new staff, improve operational efficiency, and benefit overall cybersecurity health and resiliency. 

Principales conclusiones:

• Centralizar la gestión de la PKI puede reducir la complejidad y mejorar la seguridad, facilitando la defensa de los entornos.
• Equipar a los nuevos empleados con herramientas conocidas mejora la eficacia operativa y refuerza la ciberseguridad.

La colaboración entre los sectores público y privado conduce a soluciones seguras

En la otra cara de la moneda, estas herramientas deben satisfacer las necesidades específicas y rigurosas de las agencias gubernamentales. Los departamentos y organismos federales están obligados a adoptar soluciones que mejoren la seguridad y cumplan estrictas normas reglamentarias y operativas. Esto es especialmente importante cuando se consideran herramientas disponibles en el mercado o open-source software . 

Open-source solutions can provide flexibility and innovation without sacrificing security when properly maintained and secured. The White House memo echoes this, encouraging agencies to contribute to and maintain open-source software components. However, when open-source components are in use, agencies must monitor code changes, identify and address vulnerabilities, and maintain the integrity of those components. Consistent oversight and security can be a challenge, without the right tools. 

Keyfactor solutions are designed to meet the high standards required by governments globally. In fact, we’re already helping several government entities manage identity programs with secure, compliant, centralized PKI management solutions. Our tools not only power the secure management of digital identities but also offer full transparency, rigorous compliance features, and automated security controls that support compliance with FIPS 140-2 and other NIST control families. Certificate lifecycle automation and secure encryption management with Keyfactor can help agencies maintain tight control over their PKI environments and meet compliance requirements. 

Principales conclusiones:

• Los organismos públicos deben adoptar soluciones seguras y conformes con las estrictas normas reglamentarias.
• Keyfactor ofrecen gestión PKI centralizada, controles de seguridad automatizados y conformidad con FIPS 140-2 y otras normas NIST.

Prepararse para un futuro post-cuántico

As the quantum computing revolution approaches, the federal government must prioritize the transition to post-quantum cryptography (PQC). Quantum computers hold the potential to break the encryption methods protecting our most sensitive data, and the shift to adapt will not be simple or easy. To make things more difficult, there are already signs that attackers appear to be acquiring encrypted data now for storage so they can decrypt later when the technology is available. This is commonly known as “capture then decrypt” but has the effect of moving the need to take action into the here and now, rather than something which can be put off while progress in the technology is monitored.

Además de identificar los datos más expuestos al riesgo de "capturar y luego descifrar", una tarea crítica y difícil de la transición es obtener un inventario completo de todos los certificados digitales de la red de un organismo para tener una idea clara de cómo se están haciendo las cosas y poder supervisar los progresos. Cada uno de estos certificados, utilizados para cifrar y autenticar las comunicaciones, debe supervisarse para detectar cambios, vulnerabilidades y fechas de caducidad. 

Without visibility, agencies risk exposing themselves to serious security gaps as they change cryptographic standards. We’ve learned lessons from the painful transition from SHA-1 to SHA-2–while manageable, the change was labor-intensive and slow. But speed will be of the essence in the face of the quantum computing threat, which will demand faster responses. 

Gaining a full understanding and control over certificate management is essential for protecting sensitive data as agencies prepare for the quantum future. A PKI platform that can manage this complex process across all certificate authorities will make the switch to PQC as painless as possible, protecting agencies from the cryptographic challenges quantum computing promises. 

Principales conclusiones:

• La transición a PQC requiere un inventario y una gestión exhaustivos de los certificados digitales.
• Una plataforma PKI que permita este proceso facilitará el cambio a PQC, garantizando la protección frente a las amenazas de la computación cuántica.

Mirando al futuro: Involucrar a Keyfactor para asegurar el futuro

Las agencias federales se juegan mucho, y cada vez más. Su ciberseguridad debe evolucionar para hacer frente a todas estas amenazas que se avecinan. '

La colaboración eficaz entre los sectores público y privado es esencial, y la aplicación temprana de las herramientas adecuadas determinará la capacidad de adaptación de la Administración a estos retos. 

Con soluciones líderes del sector para la gestión centralizada de PKI, la automatización del ciclo de vida de los certificados y la supervisión de la conformidad, Keyfactor permite a las entidades gubernamentales simplificar las operaciones de seguridad, mejorar las capacidades del personal y prepararse para el futuro cuántico. Nuestras plataformas seguras y conformes ofrecen visibilidad, control y automatización para gestionar el cifrado y la identidad, hoy y en la era post-cuántica. 

¿Quiere mejorar su ciberdefensa? Participe en nuestro seminario web el 9 de octubre de 2024. Descubra cómo proteger su entorno y cumplir las últimas normas federales, incluidas las nuevas directrices de ciberseguridad de la Casa Blanca. Reserve su plaza ahora: estará mejor equipado para afrontar los retos actuales de ciberseguridad y prepararse para las amenazas del mañana.