Driving Zero Trust Success in Government and Beyond

The U.S. defense industry is one of the most high-profile and frequently attacked sectors in the world. Whether it’s the fault of nation-state actors, terrorists or even financially motivated cybercriminals, the stakes couldn’t be higher — for national security and battlefield success. The war in Ukraine has revealed how kinetic and digital capabilities are increasingly linked in offensive operations. But this isn’t just a Pentagon challenge. Sophisticated attacks are also increasingly targeting critical infrastructure providers in sectors like healthcare and financial services.

That’s why zero trust has become not just a government priority – driven by the White House – but something CISOs across the board are planning. A new webinar reveals how Tanium is teaming up with Microsoft to accelerate the journey for customers.

Watch the fireside chat portion from the webinar below.

Zero trust comes of age

Zero trust has been around as a concept for over a decade. So why has it taken so long to permeate federal government cyber best practices? Today, we live in the kind of cloud and mobile-centric world where traditional perimeter approaches are no longer sufficient to guarantee security. In fact, the old “castle-and-moat” paradigm creates a broad attack surface. And if a threat actor makes it past the perimeter, there’s nothing stopping them from moving laterally to cause maximum damage.

On the other hand, zero trust posits that no devices or personas inside a network are to be trusted. Instead, every device and entity must be continuously verified and authenticated in real-time — not just for initial access. Zero trust also follows a best practice least privilege approach, which requires user and endpoint segmentation and limiting access only to apps and data required at the time. So, assume breach and always verify — not only validating identity through multi-factor authentication but also device health through vulnerability and configuration compliance checks.

There’s more to it than this, of course, and organizations will approach their zero trust journey differently depending on their level of maturity and what existing technologies and processes they have in place. The U.S. Department of Defense’s framework for zero trust is built on seven pillars:

1. Users: Authenticate, assess, and monitor user activity patterns to govern access and privileges while protecting and securing all interactions.
2. Devices: Understand health and status of devices to inform risk-based decisions. Real-time inspection, assessment, and patching play a role in every access request.
3. Apps & workloads: Secure apps, hypervisors, containers, VMs, and everything in between.
4. Data: Transparency and visibility enabled by enterprise infrastructure, apps, standards, encryption and data tagging.
5. Visibility & analytics: Derive context from analyzing events, behaviors, and activities and apply AI/ML to improve threat detection and real-time access decisions.
6. Automation & orchestration: Automated security response based on defined processes and policies, enabled by AI.
7. Network & environment: Segment, isolate, and control networks with granular policy and access controls.

Managing challenges

Without a doubt, zero trust can be a significant undertaking, especially for large and complex IT environments. But getting the end user and device authentication piece right can help organizations take a significant step in the right direction by protecting their most critical apps and data.

Azure Active Directory’s Conditional Access policies can help to streamline the process. However, the quality of the data organizations use is critical to the effectiveness of their programs. For example, if they’re working from old data, organizations may not realize that a user machine is not up to date with its patches and erroneously allow access. Or they could wrongly block devices that actually pass compliance requirements.

Even if the correct access decisions are made, if multiple users are locked out of a network without any rapid way to remediate device issues, security will significantly undermine productivity.

The Tanium and Microsoft difference

This is where Tanium’s partnership with Microsoft comes into its own. Thanks to the integration between Tanium and Microsoft Sentinel, customers can benefit from real-time Tanium endpoint data whilst using their Sentinel product — to enhance triaging, prioritization, and investigation of alerts, and support threat hunting. Users will also be able to remediate at scale using Microsoft Sentinel Playbooks. It’s all about helping customers’ zero trust journey, one step at a time.

Learn more and watch the full webinar – including our full demo – here.