The Office of Management and Budget (OMB) in coordination with the Department of Homeland Security (DHS) recently proposed an update to the Trusted Internet Connections (TIC) policy: TIC 3.0. Still in draft form, TIC 3.0 proposes increased cloud security flexibility for federal agencies and the opportunity to use modern security capabilities to meet the spirit and intent of the original TIC policy.
During MeriTalk’s Cloud Computing Brainstorm Conference, I had the opportunity present a session with Sean Connelly, Senior Cybersecurity Architect, CISA, DHS—or, as I like to call him, “Mr. TIC.” We discussed how the revised TIC 3.0 policy will remove cloud barriers and accelerate federal cloud transformation. Connelly, who has been with DHS for the last six years, helped lead the TIC initiative, including recent updates to TIC 3.0.
Challenges for TIC in today’s environment
Connelly first explained that the policy originated in 2007 as a way for OMB to determine how many external connections were being used by federal networks. The number of connections, according to Connelly, was “eye-opening”—and OMB found that the security surrounding these connections wasn’t consistent, even within the same agency. The original policy required external connections to run through the TIC with a standard set of firewalls to give agencies baseline security. But today, as the number of mobile devices increases and cloud adoption expands, the perimeter is dissolving. This evolving landscape makes it is difficult for agencies to determine what connections are internal or external to their network.
Where do we go from here?
When I asked Connelly how TIC 3.0 will modernize internet security, he echoed Federal CIO Suzette Kent by saying it would require “flexibility and choice.” Instead of having two choices—internal or external—TIC 3.0 allows for three different choices: low, medium, and high trust zones. He said, “It changes the game entirely.” Agencies now have a responsibility to determine the appropriate trust zone for their networks.
Connelly added, “If you look at today’s environment, you’ve gone from fixed assets and desktops—and now you have mobile assets, mobile devices, and pretty soon the platform is not even going to matter...so we have to make sure the policy and reference architecture can support all three models going forward.”
Catalog of use cases
One important aspect of the draft TIC 3.0 policy is the addition of use cases that encourage moving TIC functions away from perimeter-based, single-tenant appliances to a multi-tenant, cloud service model. As agencies develop TIC 3.0 solutions, it is vital they share them across government, providing other IT leaders with the opportunity to compare their security requirements, review the viable and tested options, and avoid reinventing the wheel.
Connelly shared that the use cases will come out on a consistent basis and will result in a “catalog approach to use cases.” Agencies can propose pilot programs through the Federal CISO Council; then DHS and OMB will work with the agencies on their pilots. The pilot programs will provide agencies with the use case examples and lessons learned.
When can we expect the final policy?
The final TIC 3.0 policy will be issued later this year. Connelly confirmed the final policy will look “very similar” to the draft policy.
Increased cloud adoption across the federal space will lay the foundation for emerging technology, shared services, and the ability to meet the expectations of a federal workforce that wants simple, seamless access to applications and data.
TIC 3.0 is an important step forward to expand cloud security options and remove a significant cloud barrier. With these flexible new guidelines, we should see accelerated cloud adoption in government. I’m excited to see the innovation ahead.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Steven Kovac is Vice President of Global Government and Compliance at Zscaler
