Biden goes broad and deep with order requiring MFA, zero-trust architecture

Promising strategic changes and investments, Pres. Joe Biden signed an executive order pushing federal agencies to implement significant cybersecurity initiatives, including implementing a zero-trust architecture and multi-factor authentication (MFA).

It might be the first time that a U.S. president has even mentioned the phrase “zero-trust” in public statements, an indication that the immense heft of the federal government might be focused on a critical infrastructure blind spot in digital ID.

The FIDO Alliance issued a statement supporting Biden’s move.

As it is not dependent on cooperation from the Congress, the order means the federal civilian agencies have hard deadlines to, for example, deploy multifactor encryption and authentication schemes for data at rest and in transit.

Agency heads have 60 days to show how they will “prioritize resources for the adoption and use of cloud technology.” Also within 60 days, the White House wants each agency to create a plan for adopting zero-trust security in line with NIST digital identity and access management guidelines.

The Cybersecurity & Infrastructure Security Agency, for example, must modernize its efforts to be “fully functional” with zero-trust architecture cloud-computing environments.

Biden’s decision was forced by the hacking of the Colonial energy pipeline last week. It is not known to what extent the attack was unique or unprecedented (neither businesses nor government leaders eagerly discuss losses half as monumental as this).

But something like this as been feared and predicted since the birth of the internet.

Members of the FIDO Alliance spotlighted how the order prioritizes multi-factor authentication across the board. “It makes clear that priority is protecting every account,” according to the group’s statement.

Article Topics

access management  |  biometrics  |  cloud services  |  cybersecurity  |  FIDO Alliance  |  identity management  |  multi-factor authentication  |  standards  |  U.S. Government  |  Zero Trust