Hairpin traffic, distant data centers and the road to federal zero trust

The week

On March 17, 2020, the Office of Management and Budget, the White House office that sets management rules for federal agencies, issued a short memorandum with large consequences. Memo M-20-16 told agencies across the country to maximize telework, including mandatory telework if necessary, while keeping mission-critical work going. Until then, the guidance had focused on the national capital region around Washington. Now it applied everywhere. The memo also asked agencies to extend telework to contractor staff wherever feasible.

The memo came at the end of a fast sequence. On March 11, the World Health Organization described COVID-19 as a pandemic. On March 13, the President declared a national emergency. On March 16, the White House issued its “15 Days to Slow the Spread” guidelines, which asked Americans to work from home where possible and avoid gatherings of more than ten people.

Federal telework was not new. The Telework Enhancement Act of 2010 required agencies to set telework policies and name telework managing officers, and many agencies had run telework days for years. What was new was scale. Policies built for a minority of staff working from home part of the week were now asked to carry nearly everyone at once.

The result was one of the fastest workplace changes in the government’s history. Many federal employees who had rarely or never worked remotely were sent home within days. Claims processors, analysts, inspectors and administrative staff who were used to badging into a building each morning found themselves at kitchen tables. They were trying to reach systems that had been designed on the assumption that they would be sitting in an agency office.

Agencies scrambled on three fronts. They expanded VPN capacity. A VPN, or virtual private network, is an encrypted tunnel from a laptop at home into the agency’s own network. Each tunnel ends at a piece of equipment that can only handle so many at once, and those devices had been sized for a small minority of remote workers. Agencies also bought laptops, competing with every other employer in the country for the same stretched supply. And they added licenses for collaboration tools, the video meeting and chat services that suddenly became the main way colleagues saw each other.

The security agencies were already worried about those VPNs. In January 2020, CISA had warned of continued exploitation of known flaws in widely used VPN products from Pulse Secure and Citrix. On March 13, it issued an alert on enterprise VPN security. The alert urged organizations to patch VPN devices, require multifactor authentication on VPN connections, test capacity limits, and prepare staff for more phishing and more log review.

The rules for internet connections were also in flux. The Trusted Internet Connections program dated from a 2007 OMB memorandum. In September 2019, OMB had replaced the earlier TIC policy with memorandum M-19-26, which opened the way to TIC 3.0. That version moved away from one mandatory network design and toward “use cases” describing how security could be applied in different settings. A remote user use case had not yet been written.

The same story played out beyond Washington. State and local governments made similar moves as states declared emergencies, often with smaller budgets and thinner technology teams. Courts, benefits offices and city halls all had to work out how to keep services running with buildings emptied. Many were handling surging unemployment claims at the same time, with call centers and caseworkers who also had to go home.

The scale of that surge became clear days later. On March 26, the Labor Department reported about 3.3 million initial unemployment claims for the week ending March 21, then a record by a wide margin. State unemployment agencies, many running decades-old systems, had to absorb that demand while moving their own staff out of offices. For them, remote access was one problem among several, and identity verification for claimants would soon become another.

In April, the Cybersecurity and Infrastructure Security Agency, known as CISA, the federal body responsible for protecting civilian government networks, followed with interim guidance on applying its Trusted Internet Connections 3.0 model to telework. That name will mean little to most readers, but it matters. Trusted Internet Connections, or TIC, is the federal program that governs how agency networks connect to the public internet. CISA’s guidance was an early signal that the old rules, written for people in offices, needed to bend for people at home. That signal, it turned out, pointed toward a much bigger change in how government protects its systems.

The interim guidance did not abolish the gateway. It described how agencies could apply security capabilities at several points, including the agency campus, a cloud service provider and the remote user’s own device. It was labeled interim because the formal remote user use case was still to come, and agencies were told to treat it as a bridge.

Take a benefits processor at a federal agency on a Monday in late March 2020. She has a government laptop, which puts her ahead of many colleagues. She logs in from her dining room, connects to the agency network, and opens a video call with her team. The picture freezes. Her voice arrives a beat late. A shared document takes a minute to load. By midmorning the help desk line is busy, and someone on her team suggests they just use a free consumer meeting app instead.

Nothing in that scene is dramatic, but it captures the problem federal technology leaders faced. Federal agencies had telework policies long before 2020, and many employees already had government laptops. The difficulty lay in the network. It assumed that users worked inside an agency perimeter and that internet traffic passed through a few Trusted Internet Connections where it could be inspected. When most staff went home at once, three parts of that design came under strain: the path traffic took, the devices it came from, and the way users proved who they were. Each strain had a short-term fix, and each fix raised a question that only a different architecture could answer.

After some background on the old design, the sections below take the three strains in that order. They then look at what the strains meant for mission, law and cost, compare two local governments facing the same week, and close with readiness checks that apply to any organization with remote staff.

The castle and the moat

For decades, most large organizations protected their computer systems the way a medieval town protected itself. There was a wall, the network perimeter, and everything inside it was treated as broadly trustworthy. Guards at a few gates checked what came in and went out. If you were inside, you were assumed to belong.

In the federal government, those gates have a formal name: Trusted Internet Connections. The TIC program was created to reduce the number of places where agency networks touched the public internet, so that traffic could be funneled through a small number of checkpoints. At each checkpoint, security tools inspect traffic, look for known threats, and keep logs of what passed through. Fewer gates meant fewer places to watch. It was a sensible design for a world in which employees worked in offices and applications ran in agency data centers.

The design also fed a national sensor program. CISA’s intrusion detection and prevention service, known as EINSTEIN, watched traffic at those consolidated gateways. Concentrating traffic made that monitoring possible. It also meant that any traffic routed around the gateways was traffic the national program could not see.

A few other terms will help.

• VPN (virtual private network). An encrypted connection from a remote device into the organization’s network. Once connected, the laptop behaves as if it were plugged in at the office. The connections end at a device called a VPN concentrator, which can only process so many connections at once.
• Cloud services. Software that runs in a provider’s data centers rather than the agency’s own, such as email, video meetings or document sharing delivered over the internet. By 2020, many agencies used cloud services for collaboration.
• Endpoint. Any device a person uses to reach systems: a laptop, a tablet, a phone, a home computer.
• PIV card. The Personal Identity Verification card, a smart card with a chip that federal employees use to prove who they are, both to enter buildings and to log in to computers.
• Zero trust. A security approach that drops the idea of a trusted inside. Every request to reach an application is checked on its merits: who is asking, from what device, in what condition, for what data. It replaces the town wall with a guard at the door of every room.

Why the old design persisted

The perimeter model survived for good reasons. It was easy to explain to auditors. It matched how federal networks were funded, through large shared infrastructure contracts. And it let a small security team protect many applications at once, including old ones that could never be rewritten to check identity themselves.

Those legacy applications matter to the rest of the story. Many agency systems, such as mainframe case management tools, assume that anyone who reaches them is already trusted. They cannot ask for a smart card or evaluate a device. For them, the network was the only control available, which is why agencies could not abandon it in a crisis.

With those in hand, the three strains of March 2020 become easier to see.

The path: everything back through the center

Under the TIC model as most agencies built it, a teleworker’s traffic travelled over a VPN into the agency network. It then went out through a TIC access point to reach the internet, including cloud services the agency itself used. Engineers call this a hairpin, because the traffic makes a sharp U-turn. It goes from home to the agency, then back out again to a service that may run in a data center near the employee’s house.

That hairpin made sense when remote users were few. With most of the workforce remote, VPN concentrators and TIC links carried far more traffic than they were sized for. Much of it was video and collaboration traffic headed for cloud services anyway.

Agencies responded in three ways. They enabled split tunneling for trusted cloud services, so that traffic to approved platforms went direct, rather than through the agency. They bought emergency capacity for concentrators and circuits. Some scheduled when groups of staff could connect, in effect rationing access by shift. Each was a reasonable measure. Split tunneling, though, removed the agency’s view of that traffic. Security teams now had to answer a new question: how to apply inspection, logging and data loss controls to traffic that never touched the agency network.

That question is the heart of the matter. Inspection means looking at traffic for signs of attack. Logging means keeping a record of who did what, which investigators rely on after an incident. Data loss controls are tools that try to stop sensitive information, such as Social Security numbers, from leaving where it should stay. All three had been built at the gates. Once traffic stopped passing through the gates, those protections stayed behind.

How split tunneling decisions were made

Split tunneling comes in two broad forms. In one, the VPN carries everything except a short list of named services, such as a collaboration platform’s published address ranges. In the other, the VPN carries only traffic for internal systems, and everything else goes direct.

The first form is narrower and easier to defend, because the agency chooses each exception. It also needs upkeep, because cloud providers change their address ranges. The second form relieves the most load but leaves general web browsing outside agency inspection. Most agencies that split their tunnels chose the narrower form, and some found it still left them maintaining lists by hand under pressure.

Whichever form an agency chose, the decision should have been recorded as a risk acceptance. That means a short note naming who approved it, which traffic it covered, what compensating controls applied, and when it would be reviewed. Many agencies made the change through an emergency change ticket and never revisited it.

Where visibility could move

Lost visibility at the gateway did not have to mean lost visibility everywhere. Three places could take over part of the job. The cloud service itself keeps sign-in and activity logs, if the agency licenses and collects them. The endpoint can run detection software that records what happens on the device. And cloud-delivered security services can inspect traffic close to the user, wherever the user is.

Each option has a price. Richer cloud logs often require higher license tiers. Endpoint detection needs every device enrolled and reporting. Cloud-delivered inspection is a new subscription and a new vendor relationship, with its own authorization under FedRAMP, the federal program that assesses cloud services. In March 2020, few agencies had budgeted for any of them.

A sensible order of collection follows the attack paths. Sign-in logs from the identity provider come first, because stolen credentials are the most common way in. Audit logs from email and file sharing come next, because that is where data leaves. Endpoint telemetry follows, because it shows what ran on the device. Each log source needs a retention period long enough for an investigation that starts months after the event, and someone who reviews it before that investigation is needed.

The concentrator as a target

Concentrating remote access in a few VPN devices created a second problem. Those devices faced the internet, held credentials and sat in front of the internal network. The flaws CISA had warned about in January showed that attackers targeted them deliberately. Scaling them up in a hurry meant more devices, more configuration, and less time to patch each one.

Patching itself became harder. Taking a concentrator offline to update it disconnected the staff who depended on it, at a moment when every connection counted. Agencies faced a real trade-off between availability and security, and those with redundant capacity could make it more safely.

Slow tools become a security problem

The hairpin also hurt users. Video routed through a distant data center and back suffered latency, the delay between speaking and being heard, and dropped calls. Staff reasonably looked for workarounds, such as personal accounts for meetings. Poor performance turns into a security problem when it pushes people off sanctioned tools, and help desk ticket volumes were an early warning that it was happening.

People are rarely trying to break rules; they are trying to do their jobs. If the approved tool freezes and the unapproved one works, most people will choose the one that works, and agency information ends up in places nobody is watching. Performance is therefore part of security.

Personal accounts also create a records problem. Under the Federal Records Act, as amended in 2014, a federal employee who conducts agency business on a personal messaging account must copy or forward the record to an official account within 20 days. Most state public records laws reach similar communications. A team that drifted to a consumer meeting or chat app during the spring of 2020 may have created records the agency never captured, and that later surfaced in records requests or litigation.

A few measures make this visible. The number of concurrent VPN sessions against the licensed limit shows headroom. Help desk tickets tagged “slow” or “cannot connect,” grouped by tool, show where users are struggling. Sign-ins to unsanctioned services, where a web proxy or cloud access tool can see them, show where users have already left.

The device: who owns the endpoint

Not every employee had a government-furnished laptop. Some agencies let personal devices reach virtual desktops or web-based email. Others could not, and staff waited weeks for equipment while suppliers were stretched. Where personal devices were used, the agency had little visibility of their patch level, malware protection or who else used them.

Each of those gaps matters. Patch level means whether the device has the latest security fixes from its manufacturer; an unpatched computer carries holes that attackers already know how to use. Malware protection is the software that detects malicious programs. And “who else used them” is a polite way of saying that a family computer might also be used by teenagers downloading games.

Sensitive data made this harder. Rules for federal tax information, health records and criminal justice information did not anticipate unmanaged endpoints. Program offices had to decide quickly what was acceptable, often without a clear owner for the decision. Virtual desktops that kept data off the device were the safest option, but they added load to the same central infrastructure that was already congested.

A virtual desktop is worth explaining. Instead of running programs and storing files on the laptop itself, the employee sees a picture of a computer that is actually running in the agency’s data center. Keystrokes and mouse clicks go in; screen images come back. The data never really lands on the home device. That is excellent for security, but every one of those streams has to travel through the same congested pipes.

Which rules applied to which data

The rules differ by data type and by agency, which made blanket decisions risky. Federal tax information shared with state agencies is governed by IRS Publication 1075, which sets safeguards for any agency that receives it. Criminal justice information is governed by the FBI’s CJIS Security Policy, which applies to police departments, courts and other agencies that access FBI systems. Health data held by a state Medicaid agency falls under HIPAA.

A single state human services department might hold all three. Its caseworkers might need tax data for eligibility, health data for Medicaid, and criminal history for child welfare checks. A decision to let caseworkers use personal laptops therefore needed review against several regimes at once, by people who understood each.

The safest pattern was to separate access by sensitivity. Staff could reach email and collaboration from a wider range of devices. Systems holding regulated data stayed behind managed devices or virtual desktops. That pattern needed an inventory of which applications held which data, which many agencies did not have in usable form.

Managed devices and what they enable

A managed device is one enrolled in a management system that reports its state and can enforce settings. That includes whether the disk is encrypted, whether updates are current, and whether endpoint detection is running. The management system can also block access when a device falls out of compliance.

The value of management shows up when it connects to access decisions. If the identity system can ask the device manager whether a laptop is healthy before granting access, then device state becomes a condition of entry. Without that link, device management produces reports nobody acts on in time.

Hardware shortages made this harder in 2020. New laptops arrived from many suppliers, sometimes shipped directly to homes. Agencies that could enroll a device automatically on first boot, with no visit to an office, could issue equipment quickly without losing control. Those that relied on technicians imaging each machine on site faced a backlog.

Home networks and shared spaces

The device was not the only thing outside agency control. Home routers often ran old firmware with default passwords. Family members shared the same network, and sometimes the same room. Printed documents, which staff were used to leaving in a locked office, now lay on kitchen tables.

Agencies could not manage home networks, and most did not try. They could set rules that reduced the exposure: no printing of regulated data at home without approval, screen locks after short idle periods, and guidance on where to work during calls involving sensitive cases. These are modest controls, but they address real paths by which information leaks, and they cost little.

Contractors: the people nobody counted

Contractors added another layer. M-20-16 asked agencies to extend telework to contract staff where feasible. Those staff often used employer-issued laptops, governed partly by their employers’ policies. Few agencies could say with confidence which contractor devices were connecting, or how they were configured. Contract clauses on device security, where they existed, had been written for on-site work.

For a general counsel or procurement chief, that is a familiar kind of gap. The contract described a world that no longer existed. Responsibilities that had been obvious when the contractor worked in an agency building, using agency equipment on an agency network, became ambiguous overnight.

Fixing that gap meant contract changes, which take time. Agencies could issue interim direction through contracting officers, setting minimum device requirements for remote access. Over the longer term, remote access terms belonged in standard clauses, along with the right to verify device state and to receive logs.

The identity: a card and a reader

Federal employees authenticate with Personal Identity Verification cards. At home, that requires a card reader, a device configured to use it, and a working process for expired or lost cards. Issuance normally requires an in-person visit to a credentialing office, many of which were closed or limited. Agencies that relied on PIV as the only strong authenticator found that the credential itself was now a logistics problem.

Authentication means proving you are who you say you are. A password is weak authentication because anyone who learns it can use it. A PIV card is strong authentication because you need both the physical card and a PIN. The strength of the card was never in question. The problem was that a physical credential depends on physical processes, such as printing, posting and in-person identity checks, and those processes stopped working when buildings closed.

Several agencies issued temporary alternative credentials and extended card validity where policy allowed. Those were sensible stopgaps, but they created a population of accounts with weaker or non-standard authentication. Tracking those exceptions, and retiring them later, required a register that many agencies did not keep. Cloud services added a further gap: some accepted PIV through federation, while others still relied on passwords.

Federation is the arrangement that lets you sign in once with a trusted credential and then reach many services. Where cloud services were federated, a PIV login carried across. Where they were not, staff fell back on a separate password for that service, which is exactly the kind of weak link attackers look for.

Credentials that do not need a card reader

The PIV program already had a partial answer. NIST had published guidance on derived PIV credentials in 2014, Special Publication 800-157. A derived credential is issued to a mobile device, such as a government phone, on the strength of the holder’s existing PIV card. Because the holder is already proven, issuance does not require a fresh in-person identity check.

Few agencies had deployed derived credentials widely by 2020. Those that had could let staff sign in from phones and tablets with strong authentication, without card readers. The capability existed on paper; the gap was deployment, which is a pattern that recurs throughout this story.

What a register of exceptions needs

A useful exceptions register is short and specific. Each entry names the account or group, the exception granted, the reason, the approver, any compensating control, and an expiry date. A weekly report of entries nearing expiry gives someone a reason to act.

The compensating control is the part most often skipped. An account allowed to use a password instead of PIV might be limited to fewer applications, monitored more closely, or blocked from administrative rights. Without such a limit, the exception becomes the weakest door into the agency, and nobody notices.

The phishing that followed

Attackers adapted quickly. Pandemic-themed phishing rose sharply in the spring of 2020, as CISA and others warned. Staff working alone, on unfamiliar tools, with help desks overloaded, were easier to deceive. A message asking someone to “re-verify” a VPN or collaboration login looked plausible when everything else was new.

That exposed the difference between kinds of strong authentication. A one-time code sent by text or shown in an app is better than a password alone, but a convincing fake login page can capture and replay it. A PIV card, or a FIDO security key, uses cryptography tied to the genuine site, so a fake page gets nothing useful. Agencies that had fallen back to codes during the crisis had traded phishing resistance for availability.

Administrators and the help desk

Two groups deserved special attention. System administrators working remotely held the most powerful accounts. If their credentials were stolen, an attacker gained control of systems as well as data. Requiring the strongest authentication and separate administrative accounts for them was more important at home than in the office.

The help desk was the other. When staff lose access, the help desk resets it, often by phone. An attacker who can convince the help desk to reset a password or enroll a new device can bypass the strongest credential. Verifying callers, for example by calling back a number on file or by requiring a manager’s confirmation, closed a gap that the crisis widened.

What the strains meant for mission, law and cost

These strains were never a technical sideshow to the real crisis. Each connected directly to issues senior leaders own.

• Mission delivery. If staff cannot connect, benefits are not processed, cases are not reviewed and the public waits. Rationing VPN access by shift kept systems standing but slowed the work.
• Legal and regulatory exposure. Tax, health and criminal justice data come with specific handling rules. Decisions made in a hurry about personal devices were, in effect, decisions about compliance, and they deserved a named owner.
• Visibility after an incident. When traffic bypassed the agency’s gates, logs went with it. If something went wrong, investigators might not be able to reconstruct what happened.
• Workforce trust. Staff who fight their tools all day lose time and patience. Drift to personal accounts is a symptom of that frustration.
• Cost. Emergency capacity bought in a hurry is rarely cheap, and much of it served traffic that never needed to pass through the agency in the first place.

Taken together, the strains pointed in one direction. Security that depends on where the user works and how traffic flows does not scale to a distributed workforce using cloud services. Security that depends on the identity of the user, the state of the device and the sensitivity of the resource does. CISA’s interim TIC 3.0 telework guidance began to formalize that shift. It allowed security capabilities to be applied closer to the user and the cloud service, rather than only at the agency edge.

Counting the cost honestly

Emergency spending in March 2020 went mostly to the most visible items: concentrator licenses, circuits and laptops. Those were one-time purchases, easy to approve under emergency authority. The investments that reduced the underlying strain, such as identity platforms, device management and cloud-delivered security, usually came as multi-year subscriptions.

That difference shaped behavior. Capital-style emergency purchases fitted the budget process; new recurring costs needed a base budget increase or savings elsewhere. An honest comparison weighs both against the cost of the alternative: gateway hardware refreshed every few years, staff time spent on VPN troubleshooting, and the risk of an incident nobody can reconstruct. Agencies that framed the choice that way found it easier to justify the subscription.

How the effects differed by level of government

Large federal departments had the most complex networks but also the deepest benches. Many had already begun cloud migrations and could expand existing contracts. Their difficulty was coordination: dozens of components with their own networks and help desks, each making emergency decisions.

The Defense Department faced different constraints. Much of its work involves classified networks that cannot be reached from home at all. Unclassified work could move, but mission work in secure facilities often could not, so some staff kept going in.

State agencies carried the heaviest public demand. Unemployment insurance offices faced claim volumes far beyond anything their systems had handled, while their own staff moved home. Fraud followed the money, and identity verification for claimants became a parallel crisis to identity verification for staff.

Counties and cities had the thinnest teams. Many had a few IT staff supporting police, courts, utilities and clerks at once. For them, a single well-configured cloud identity service and managed laptops did more than any amount of VPN capacity, because they could not staff the alternative.

The strongest case for the old model

The perimeter model has defenders, and their argument deserves a fair hearing. Hairpinning traffic gave agencies one consistent place to inspect and log. It worked with legacy applications that cannot check identity. And many agencies did get through March 2020 with bigger VPNs and some split tunneling.

All of that is true, and it explains why the network remains part of the defense. The argument fails on direction of travel. As more applications moved to cloud services, a larger share of traffic hairpinned for no security benefit. The concentrated gateway also became a concentrated target. A model that protects legacy systems well can still be the wrong default for everything else.

A second objection is that zero trust became a marketing label, attached to almost any product. That criticism has force. The answer is to judge the approach by its specific controls, such as phishing-resistant authentication for every application and device health checks before access, rather than by vendor claims.

A third objection concerns resilience. Moving every access decision to a cloud identity provider means an outage there can lock out the whole workforce. That risk is real, and it calls for tested break-glass accounts, documented fallback procedures and contracts that set out the provider’s recovery commitments. It argues for preparing the new model properly, not for keeping the old one.

Two local governments, one week

Take two local governments facing the same week. They are hypothetical, but each reflects a pattern common at the time.

One county had spent the previous two years moving staff onto a single sign-on system that worked for both its own applications and its cloud email. Its laptops were enrolled in a device management system, software that lets the IT team see whether each machine is patched, encrypted and running protection, and that can block a laptop that falls behind. When staff went home, the county still had network headaches. But it could let traffic to approved cloud services go direct, because it was checking the person and the device at the door of each service, not at the county’s own gateway.

A neighboring city had a strong firewall, a big VPN and a policy that everything ran through headquarters. It bought more VPN capacity within a week and felt reassured. Within a month, its help desk was swamped, a handful of departments had moved meetings to personal accounts, and it had issued dozens of temporary passwords to staff whose smart cards had expired. Nobody had written them down in one place.

What separated them was the order of investments made in the years before, not budget in March.

The difference also showed up later. When the county’s auditors asked which staff had reached sensitive systems from home, it could produce sign-in logs by user and device. The city could show VPN connection records, but not which applications each user reached or from what machine. For its police department, which handles criminal justice information, that gap was the harder conversation.

Where organizations went wrong

• Treating capacity as the whole answer. More bandwidth relieves the symptom. It does not restore the visibility lost when traffic goes direct.
• Opening exceptions without closing them. Temporary credentials, extended card validity and split-tunnel rules all made sense. Without an expiry date and an owner, temporary becomes permanent.
• Leaving decisions about sensitive data to whoever is on the call. Someone has to own the decision about which data may be reached from which devices.
• Forgetting the contractors. Contract terms written for on-site work leave the agency guessing about off-site devices.
• Ignoring the help desk. Ticket volumes about slow tools were an early signal of drift to unsanctioned alternatives, and many leaders never saw them.
• Scaling VPNs without patching them. Adding concentrators in a hurry expanded the most targeted part of the network.

The order of investment

For a federal CIO, the strains meant reordering investment. Identity providers that could enforce strong authentication for every application came first. Device management that could report a laptop’s health before granting access came second. Network capacity, the most visible bottleneck in March, mattered least over time because it could be bought quickly. State and local agencies, facing the same strains with smaller budgets, had even more reason to follow that order. Capacity can be bought in a crisis; identity and device maturity cannot.

Bandwidth is a commodity. It can be ordered, delivered and switched on in days. A trustworthy identity system, one that covers every application and that staff actually use, takes years of patient work: cleaning up old accounts, connecting applications one by one, training people. Device management is similar. Those are the investments that pay off when the next surprise arrives, and they are the hardest to make in a hurry.

Sequencing within identity matters too. Connecting the most-used cloud services to the agency identity provider first removes the largest number of separate passwords. Legacy applications that cannot be connected can sit behind an access gateway that checks identity and device on their behalf. That lets the agency extend the new model to old systems without rewriting them.

Traffic, devices and identity: readiness checks for any organization with remote staff

Whether you run an agency, a hospital or a bank, these questions translate directly.

1. If everyone worked from home tomorrow, where would our traffic go, and which piece of equipment would run out of room first?
2. Which of our cloud services do people reach directly, without passing through our own network, and what inspection and logging do we have on that traffic?
3. Can we see, today, whether every laptop that connects to us is patched, encrypted and running protection, and can we block one that is not?
4. How many temporary credentials or security exceptions are open right now, who approved them, and when do they expire?
5. If we had to cut one budget line, would it be network capacity, identity or device management, and why?

These questions need no technical background to ask, but each needs a straight answer, and that answer shows how ready the organization is for another week like this one.

The evidence behind each answer should already exist. For the first, a capacity test with dated results. For the second, a list of direct-to-cloud services and the logs collected for each. For the third, a device compliance report linked to access policy. For the fourth, the exceptions register itself. For the fifth, a budget that shows which of the three has a multi-year plan.

With hindsight

The shift that began as an emergency was soon formal policy. NIST published its zero trust architecture guidance, Special Publication 800-207, in August 2020. The SolarWinds compromise came to light in December 2020, a breach in which attackers slipped malicious code into widely used network management software. Afterward, Executive Order 14028 in May 2021 directed agencies toward zero trust architecture. OMB memorandum M-22-09 in January 2022 then set out a federal zero trust strategy, with goals for identity, devices, networks, applications and data. It asked agencies to meet them by the end of fiscal year 2024.

Look at that list again and it reads almost like a summary of March 2020. Identity: the PIV card logistics and the temporary credentials. Devices: the personal laptops and contractor machines nobody could see. Networks: the hairpin and the congested gateways. Applications and data: the cloud services reached directly and the sensitive records that rules had never contemplated on a kitchen table.

The visibility problem got its own memorandum. OMB’s M-21-31, issued in August 2021, set tiered requirements for what logs agencies must keep and for how long, including logs from cloud services and endpoints. That was a direct answer to traffic that no longer passed through the gateway.

Phishing-resistant multi-factor authentication, including PIV and FIDO-based options, is now a central requirement. Multi-factor authentication means proving your identity with more than one thing, typically something you have and something you know. Phishing-resistant means a fake website cannot trick you into handing it over. FIDO is an industry standard for that kind of sign-in, often using a small hardware key or a device’s built-in security chip. Its inclusion alongside PIV answers part of the 2020 problem: strong credentials no longer have to depend on a single card printed in a single office.

The PIV standard itself was revised. NIST published FIPS 201-3 in January 2022, the first full revision since 2013, with updated provisions on identity proofing, federation and alternative authenticators. CISA published version 2 of its Zero Trust Maturity Model in April 2023, giving agencies a common yardstick across the same pillars.

The VPN concern did not fade. In January 2024, CISA issued an emergency directive on actively exploited flaws in Ivanti Connect Secure, the product line formerly sold as Pulse Secure. It followed with direction for agencies to disconnect affected devices. Remote access appliances at the network edge remained a favored target four years after they were scaled up in a hurry.

Identity concentration brought its own lesson. In 2023, a China-based group tracked by Microsoft as Storm-0558 used a stolen signing key to forge access to cloud email accounts, including at the State Department. The department detected it through logs it had licensed. The Cyber Safety Review Board’s 2024 report on the incident criticized Microsoft’s security culture. Moving trust to identity made the identity provider the most valuable target.

Money followed, unevenly. The American Rescue Plan Act of 2021 added $1 billion to the Technology Modernization Fund, which agencies used in part for zero trust projects. For states and localities, the Infrastructure Investment and Jobs Act created a State and Local Cybersecurity Grant Program. The FBI’s CJIS Security Policy was modernized starting in 2022 and made multifactor authentication a requirement for access to criminal justice information.

Telework itself turned into a political question, and a January 2025 presidential memorandum directed federal employees back to in-person work. The architecture did not reverse with it. The case for identity-based access never depended on where people worked. It depended on where applications and data lived, and much of that had already moved to the cloud.

What held up was the direction set in the spring of 2020: identity and device state as the basis of access. What did not hold up was the hope that it would be quick. Agencies reported uneven progress against the 2024 goals, and legacy systems still depend on network controls. Zero trust became a long program, not a single deadline.

In any sector, debates about where people work will come and go. The question of how you know who is asking for your data, and whether the device they are using can be trusted, does not go away when staff return to the office. The organizations that came through March 2020 best were those that had already invested in identity and devices. The ones that did best afterward treated the crisis as evidence for that investment, not as a one-off problem solved by buying more bandwidth.