{"id":42370,"date":"2021-08-17T16:00:36","date_gmt":"2021-08-17T16:00:36","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=95586"},"modified":"2021-08-17T16:00:36","modified_gmt":"2021-08-17T16:00:36","slug":"microsoft-and-nist-collaborate-on-eo-to-drive-zero-trust-adoption","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/microsoft-and-nist-collaborate-on-eo-to-drive-zero-trust-adoption\/","title":{"rendered":"Microsoft and NIST collaborate on EO to drive Zero Trust adoption"},"content":{"rendered":"
<\/div>\n

2020\u2019s Nobelium attack sent shock waves through both government and private sectors. 2021 has already seen large-scale nation-state attacks such as Hafnium1<\/sup> alongside major ransomware attacks2 <\/sup>on critical infrastructure. The breadth and boldness of these attacks show that, far from being deterred, bad actors are becoming more brazen and sophisticated. To help protect US national security, the White House on May 12, 2021, issued Presidential Executive Order (EO) 14028 on Improving the Nation\u2019s Cybersecurity3<\/sup>. This EO mandates \u201csignificant investments\u201d to help protect against malicious cyber threats:<\/p>\n

\n

\u201cThe Federal Government must bring to bear the full scope of its authorities and resources to protect and secure its computer systems, whether they are cloud-based, on-premises, or hybrid\u2026security must include systems that process data (information technology (IT)) and those that run the vital machinery that ensures our safety (operational technology (OT)).\u201d<\/p>\n<\/blockquote>\n

Executive Order 14028 also states the \u201cprivate sector must adapt to the continuously changing threat environment, ensure its products are built and operate securely, and partner with the Federal Government to foster a more secure cyberspace.\u201d<\/p>\n

Section 3 of the EO required federal agencies to develop a plan to adopt a Zero Trust Architecture. This blog post will discuss how Microsoft is continuing to help with the implementation of Zero Trust<\/a> to fulfill these directives.<\/p>\n

How is Microsoft helping to implement EO 14028?<\/h2>\n

The National Institute of Standards and Technology<\/a> (NIST) is one of the agencies chartered with creating the cybersecurity standards and requirements outlined in Executive Order 14028. Microsoft is working with NIST\u2019s National Cybersecurity Center of Excellence<\/a> (NCCoE) on the Implementing a Zero Trust Architecture Project<\/a> to develop practical, interoperable approaches to designing and building Zero Trust architectures that align with the tenets and principles documented in NIST SP 800-207, Zero Trust Architecture<\/a>. The NCCoE public-private partnership applies standards and best practices to develop modular, easily adaptable examples of cybersecurity solutions by using commercially available technology.<\/p>\n

Much of the technology required to execute the roadmap is already in place at many agencies\u2014they simply need to activate and fine-tune existing capabilities. To this end, Microsoft has identified five of the most impactful scenarios<\/a> agencies should build towards EO 14028. These reference architectures are mapped against key NIST requirements for Zero Trust while including other EO priorities, such as endpoint detection and response<\/a> (EDR), multifactor authentication<\/a>, and continuous monitoring.<\/p>\n