The National Security Agency has released its latest guidance for organizations interested in moving toward a zero-trust cybersecurity framework, with a focus on blocking unauthorized access to data both in transit and at storage.
NSA recommendations include the use of encryption, tagging, labeling, data loss prevention strategies, and data rights management tools. The NSA’s suggestions are intentionally aligned zero trust frameworks to help government agencies and businesses defend against increasingly sophisticated cyber attacks.
“Malicious cyber actors continually increase their ability to infiltrate networks and gain access to sensitive data,” Dave Luber, the NSA’s director of cybersecurity, said in a statement about the latest round of attacks. NSA zero-trust alerts. “Assuming breaches occur, implementing the pillars of the zero-trust framework is how we combat such activity.”
This focus on what the NSA in its report calls the “data pillar” is a continuation of the agency’s development of zero-trust best practices, which began when it first published “Adopt a Zero Trust security model“in February 2021.
Just last month, the NSA updated its guidelines for implementing Zero Trust, which distinguished between macro- and micro-segmentation of networks. Macro-segmentation is intended for work groups and departments; microsegmentation further separates traffic so that not all users have the same access rights – an attempt to reduce an organization’s attack surface.