Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Sara Mosley, technical director for the Bureau of Diplomatic Security’s Cybersecurity and Technology Services, works with the U.S. State Department to help identify threats and potential compromises. In her role, she advocates for a Zero Trust approach that focuses on protecting critical data rather than trying to secure everything equally. She recommends balancing security measures with mission needs to prevent users from circumventing security protocols.
In this episode of WE’RE IN!, Sara underlines the importance of collaboration between IT and security teams to adequately protect data and address relevant threats in anticipation of the September deadline for federal Zero Trust compliance.
Listen to hear more about:
The role of the private sector in adopting Zero Trust frameworks and providing security tools
Preparing for emerging technologies like quantum computing and their accelerated development due to AI advancements
Why Sara believes hackers will initially benefit more from AI advancements than defenders
Listen to the episode
S3 E15 · Sara Mosley on best practices for Zero TrustWE'RE IN! Podcast · 30 min
Key takeaways
You cannot protect everything equally Sara's example is that the cafeteria menu does not need the same protection as HR data, yet many networks protect both the same way, which does not scale for a worldwide agency.
Bring IT and threat context together Her team asks the groups rolling out applications to identify their sensitive data, then adds the threat perspective so controls match the threats that actually apply to each environment.
Too much friction drives workarounds If security makes it too hard for the mission to move forward, mission owners go around the security team, so risk acceptance has to be part of the balance.
Zero Trust is a journey The M-22-09 deadline in September 2024 measures progress on foundational elements, but Sara says no organization is ever 100 percent done because threats keep evolving.
Vendor interoperability is the gap Without integration between identity, device, and network vendors, organizations in mixed environments face a heavy integration burden or must buy into a single vendor's suite.
Topics covered
U.S. Public Sector
Zero Trust
Notable quotes
The reason why I'm a big advocate of zero trust … is because I truly believe that we cannot protect everything.
That cafeteria menu may be compromised, but does it really matter?
At some point, security actually could hurt the mission's ability to move forward. And what happens is that at that point, mission owners tend to go around us.
Zero Trust is a journey. You'll never achieve, quote unquote, Zero Trust completely.
Questions this episode answers
What is the Zero Trust mindset?
Sara describes Zero Trust as a strategy built on the idea that you cannot protect everything, so you focus on protecting what needs to be protected. It is about data, not treating every asset on the network the same way. Read this section
What is the federal Zero Trust deadline?
OMB memo M-22-09, the federal Zero Trust strategy, set the end of fiscal year 2024 in September as the deadline. It lays out requirements across the five pillars of Zero Trust as foundational elements. Read this section
Will federal agencies meet the Zero Trust deadline?
Partially. Sara thinks more progress has been made than is reported and almost all cabinet-level agencies have a plan, but not every agency will reach everything outlined in M-22-09. FISMA reporting now includes Zero Trust questions. Read this section
What are the biggest obstacles to adopting Zero Trust?
Integration in multivendor environments and culture. Security staff used to a network-boundary mentality have to shift to understanding data flows, and products for continuous authentication are not yet mature. Read this section
What does continuous authentication mean?
Instead of logging in once and accessing everything all day, access should be scoped to the data a user needs, and actions like viewing other people's records or a sudden change in location should trigger reauthentication. Read this section
About the guest
At the time of recording, Sara Mosley was technical director supporting the integration contract for the State Department's Bureau of Diplomatic Security Cybersecurity and Technology Services, spanning the enterprise security operations center, red and blue teams, threat teams, and security baselines. She previously served as chief network architect in the department's information resource management group, worked on policy and guidance at CISA, and led the security architecture group at the FDIC. She is an early adopter and advocate of Zero Trust.
Hello, and welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer, and joining the program today is Sara Mosley, technical director at the state department supporting its critical mission and ensuring the protection of its global IT infrastructure. Sara is something of a zero trust expert and an early adopter, and she can speak to the security mindset that's needed when tackling some of the federal government's toughest cyber challenges. I'll ask Sara about the looming Zero Trust deadline for federal agencies and a host of other pressing cybersecurity topics. But first, let's tune into a quick word from WE'RE IN's sponsor.
Confusion in the marketplace about which is the best method of security testing is so real. Bug bounty, pentesting, pentesting as a service, what do they all mean? We break it down in our latest playbook, navigating the security testing landscape to demonstrate the strategic value of third party security testing. We cherry pick the best elements across the security testing market to incorporate into a strategic, comprehensive pentesting solution, the Synack platform. Learn more at synack.com/playbook. That's synack.com/playbook.
So currently, I'm the technical director supporting the integration contract that Diplomatic Security, Bureau of Diplomatic Security, cybersecurity, and technology services has. In that role, the responsibility kind of spans across the enterprise security operations center, red and blue teams. You know, there's threat teams, standards and configuration security baselines. So from the perspective of the work, the mission that CTS has, my role is to make sure that it all kind of comes together, and there's a good execution of the strategies into future years. So ultimately, for our customer base and for the state department, what that means is that we're helping ensure that we identify all the threats and and the compromises.
That's that's... And this isn't your first stint helping secure the State Department and its global worldwide IT infrastructure. You'd previously served as senior security engineers, I understand it, and and lead network architect for the State Department's Office of Information Assurance. You've also supported, I think, various other federal agencies, the FDIC, CISA. What can you tell me about some of those experiences?
I love learning. So I I like to take different roles and responsibilities that help me actually grow. And so starting with actually the diplomatic technology group, which has information assurance in there. So DT is, you know, our former IRM, information resource management group. I started as a chief network architect, you know, so building and and maintaining the department's worldwide telecommunications infrastructure, the routing, and all of that, and kind of the... Grew from there into the... Some of the cybersecurity disciplines that were affecting department of state and and working very closely from an operational perspective. So that was like a very, very much an operational, like, in the weeds. And then moving to DHS CISA, which is known as CISA now, more on the policy and the guidance side.
So it kinda took my experience from state and helped develop some of those types of recommendations that most agencies are looking for from CISA. And then moved on to FDIC where, you know, as the chief of their security architecture group, shaping how they see architecture folding into their their services. And then back at State now on the security operations side, which gives me that breadth. And I think what that helps is understand all the different aspects of missions for the different groups and be able to bring a perspective of how to bring in the right stakeholders and and making sure that whatever we are developing or providing as a service actually meets the requirements as well as, ultimately, it's about protecting the department's environments, right, their network.
And so with your experience in both network architecture and then, you know, you mentioned SOCs, you know, security operation centers and security architecture, For the uninitiated, for somebody nontechnical, what's the balance would you say of of, like, designing in security, CISA's leading this big secure by design push versus just other general people wanna accomplish the mission in a certain way and aren't thinking about security. How have you straddled those worlds in your various roles?
I think that that goes back to education, awareness, involvement. Definitely, I I can tell you there's been a significant push to make sure there's awareness. Actually, one of the things our group does is also the awareness aspect, the security awareness piece. Right? So it's it's getting even just the typical user base understanding what are those security, I guess, flags that they should be looking for. Right? So what are those things that they need to be aware of to make sure that they're securing their data, they're securing their environments. Right? That's a cultural shift and and a, you know, shift in mindset that security is this group that's sitting onto the side versus security is everybody's responsibility. And and I think we're we're starting to see that shift. We have seen that shift quite a bit because everybody's getting awareness training, but to what extent does that really mean in their day to day job?
And that's, I think, changing, especially with... Within the personal space when you think about, like, all the things that have happened with the PII breaches and and things like that. Right? I think more people are aware that they need to be responsible for for their data and for what they're doing. Right? So it it it has changed over the past bit, but I think we still have some more work to do.
Absolutely. You it is interesting to see how that media conversation around cybersecurity has sort of shifted now. It's it's almost... People almost expect to see breaches in the headlines nowadays, sad... Sadly. For for for better or worse, often worse, but at the very least, to your point, that can definitely help beat the drum of awareness a little bit. Now you mentioned kind of a security mindset and adopting that. And as I understand it, you have a quite deep experience in the Zero Trust world. Dare dare I turn to a buzzword, so to speak, but it's kind of a... Obviously, Trust from a government context carries with it some some specific requirements, but it's also something of a philosophy almost. How would you describe that zero trust mindset, and and how can organizations hope to adopt it?
I totally agree with you. I think it is a buzzword that's being used, especially with the vendors. The reason why I'm a big advocate of zero trust and I've been working in that field for a while is because I truly believe that we cannot protect everything. And and with zero trust, the mindset, the the framework, and, like you said, a framework, really, it's a strategy, right, to get to a point where you are protecting what needs to be protected. We always give the example of, you know, the cafeteria menu does not need to be protected in the same type of manner as, like, your HR data, your human resource data, right, personal data. What we're doing today is exactly that, right? We're protecting them in...
On the same network in the same way, and that is what's, I think, not feasible. You can't scale like that, especially when you talk about an agency like Department of State or worldwide. We're probably one of the most attacked organizations in the world. And so when you start actually getting into the the reality, we cannot protect everything. That cafeteria menu may be compromised, but does it really matter?
that's pretty scandalous. That... That's that's pretty scandalous. But, no, point point well taken. It is Right. That, you know, that you do have to have those sort of priorities and consider what you most wanna protect. Amid all these bevy of frameworks and guidelines and, you know, keeping up with modern technology, when you are working with security teams, how how do you help them make those choices and prioritize, like you said, the menu versus something else?
So that's a really good question because oftentimes, it's not just security teams. It's... And again, I just wanna make sure. It's like, we have to work with the teams that are rolling out IT. And and so what we do is we try to bring in the IT that are rolling out, you know, just, you know, your typical, you know, types of applications and things like that alongside the security teams. Looking at this from the perspective of prioritizing what really matters. When you look at, again, the kind of the zero trust concept, it's all about data. It's about protecting data. When we bring these teams in, we're looking for them to provide us with what they believe is the data that is sensitive, that shouldn't be compromised and needs to be protected.
And also from the security side, what are the threats? What... For that environment? We need to understand and prioritize what are those threats that we, you know, we actually can conclude that may potentially happen, maybe threats that just don't even apply. So we may apply control, security controls, that are really not as useful if you're not looking at it from that threat perspective. So I think bringing in the threat perspective is so important to that conversation to make sure that everybody is understanding really what end goal... What is our end goal? What is... What are we trying to actually achieve?
And to your point earlier, there are no shortage of threats facing the state department, especially, unfortunately. I'm almost like, can you really discount any threat in that environment? I feel like it's just the whole work, Selma.
Depends on the environment. Yeah. You'd be surprised. I think every environment is a little bit different, and so you really do have to look at, for example, a cloud environment. Right? If we have cloud assets, right, versus the production network, development network, you've got all these different environments. And for each one, you gotta really think through what would they be looking for? What would the mad actor be looking for? And, ultimately, it goes back to the data. Right? Where does the data reside? So they may be using, like, a completely disposable Internet facing environment to get into something else. Right? What is the tactics, and how are they trying to actually move laterally between those environments? So, yeah, I think we we think about all of those things and and how that may change what those controls are. And, also, I gotta say, we have to balance it with what the mission needs are.
I mean, to... At some point, security actually could hurt the the the mission's ability to move forward. And what happens is that at that point, mission owners tend to go around us. Right? And so not having a scenario where, you know, we're making it so difficult for the mission to actually do what they need to do is important. And we always have to balance that. So we have to understand that there's always gonna be a risk. There's no scenario where you don't have risk. Right? It's just that how do you balance, you know, and the risk acceptance piece.
No. That that makes a lot of sense. It's like, of course, you could stay secure if everybody just kept their computers off all the time, but then it would be hard to accomplish the mission when that's when that's the case. So somewhere between there and bringing your phone to work and logging on to TikTok is probably the happy medium.
Yeah. It's it's funny you should say that because a long long time ago, when I was actually into blank technology, we we had a a frame of a PC, you know, those old PCs, and it was on the wall. It was just a blank frame, and we basically labeled it DS approved personal computer because that
You won't you won't find any hackers in there. Exactly. It's a a poster on the wall. That's really funny. So there's a there's a pretty important September deadline looming for zero trust compliance in the federal space. What can you tell me about that and its significance?
There's been progression along the way, but that deadline is ultimately OMB memo M-22-09, right, which is the federal zero trust strategy. The memo specifically calls out the end of the fiscal year, which is September 2024. All agencies have made progress towards zero trust, and there's basically the five pillars of zero trust. And they outline specifically for each pillar what the requirements are. I think the significance is gauging where agencies are by the end of this fiscal year in September to see whether they've been able to check off basically each one of those things that were mentioned. And I gotta say that memo entailed, and they they kind of explained at the beginning, is that it's really supposed to be the foundational elements of Zero Trust.
Zero Trust is a journey. You'll never achieve, quote unquote, Zero Trust completely. You're not a 100% done. It's always evolving because your threats and attacks are always evolving. It's more about has there been progress? Have those specific things that have been identified in M-22-09 been accomplished and have have agencies made progress towards those things.
So with that context in mind, you know, can federal agencies meet the deadline? I I know it sounds like it's a bit of a moving target, so maybe that's not a black and white question. But do do you think people are are demonstrating that progress?
Partially so. I've I've read a lot of different articles, and actually, Gartner had a... Had an interesting presentation on this as far as the progress and how agencies are really lagging behind in terms of zero trust. And I actually would say that there's been more progress made than probably being touted at this point. I think almost all the cabinet level agencies have a plan. They have, from a cultural perspective and a training perspective, have started progressing in terms of changing people's mindset, you know, and and changing how they look at security. I wouldn't say that they all are gonna meet, and there's basically 10 FISMA report questions that are now zero trust specific. They're... OMB's measuring where agencies are, and, you know, I think there's gonna be some level of progress, but maybe not to the extent that's outlined in twenty two zero nine for every agency.
Right. Right. FISMA, of course, referring to the Federal Information Security Management Act of 2002, kind of the bedrock of a lot of federal law around this around this this area. Looking outside of the federal space though, zero trust does have implications for the private sector and and a lot of organizations. And not just in terms of applying the framework, but also, you know, actually offering security tools for for enterprises. Where... What role does the private sector play?
A couple of different roles. Right? So private sector from the perspective of organizations that are trying to protect their environments. I think that when they look at the the cybersecurity kind of threats and and where things are, there's been an... Also an adaptation of how do we act... Address it using something like a zero trust framework. Right? So having the private sector also buy in is so important because you can have federal mandates that cannot be satisfied because the the the private sector is really not bought in. Think that's one of the... Our challenges with IPv6. You know? It's... You know, IPv6 memo came out when? 2008. Right? Right.
and we're still all talking about, yes. You know, we're gonna do IPv6. Right? From the perspective of that buy in, it's so important to have the private sector part of that conversation and end the buy in and the urgency to move to this framework. Then there's the other part, which is the vendor space. I have some, I guess, concerns with how zero trust is being used to sell. Not necessarily... It's more just an approach for for how they're gonna sell products vice truly looking at how the the vendors are are integrating zero trust concepts into what they're selling. Right? So just to give you an example, from a vendor market perspective, the integration piece isn't there. Right? So if you wanna actually have Zero Trust capabilities, you almost have to basically buy into one vendor's solution set.
Now there are... There have been some partnerships between vendors from identity to device to, you know, to network. But, ultimately, when it comes down to it, there's a huge integration burden that agencies and and any entity would have to to be able to actually... Especially if they're in a heterogeneous environment where they have multiple different vendors, to be able to kinda put it all together. And I think the interoperability is where we're lacking, and that's where we don't see, like, the vendor market as much gaining momentum.
That makes sense. I mean, the very design of the vendor ecosystem almost runs contrary to its Zero Trust principles in some sense that you have tool sprawl, you have multiple vendors, you have a lot of... It's just it feels... I can see how that would be a challenge. And that actually segues into my next question, which was what are some of the biggest practical challenges standing in the way of applying these zero trust principle?
Yes. So integration, obviously, being a big one. Even I think DOD, who's kind of at the forefront of this, has stated that just some of the challenges with kind of being in that heterogeneous multivendor environment. But also, I think there are cultural challenges as well. There... You have personnel and and staff that are used to how they do things, including your security security SMEs and security operators. Right? And when you look at how you need to change for zero trust, which is going from a network mentality, network security mentality, to now I need to understand the data. I need to understand where the data's flowing and where there may be anomalies with the data patterns. When you start looking at that, definitely, there's a resistance to moving in that direction.
However, I would say because of the cloud and because of remote work, there's almost been a mandatory shift in terms of you have to look at the problem set differently. You can't look at security as here's my network boundary, and I'm just gonna protect my network boundary, and I'm done. Whether they like it or not, they're being dragged into this. But I think we still have that cultural piece that needs to happen as well as the maturity of the products. You know, like, when you talk about continuous authentication, continuous authorization within a zero trust world, that's one of the big zero trust tenants, right, to continually authenticate. So not as, you know, a specific user is not gonna be authenticated once and then do what they wanna do. The market, I think, is still kinda trying to reconcile between what the application is doing versus what your identity provider is doing.
That's where the kind of the handoff, the handshakes are not necessarily as mature as where I think we need to be at this point in order to execute something like a continuous authorization, continuous authentication.
I'm glad you mentioned continuous authorization because I was... For... Again, for for those outside the VED space or or or network architecture technology experience here, what does that concept mean, and and how does it fit into the federal government security goals?
Basically, first of all, what does it even mean, like, to to continuously authenticate? Most users are used to opening up their laptop, logging in, and connecting to their network, and then they can do their work pretty much all day. They could go into different multiple applications. They could, you know, work on their different files. Right? They can access different things.
Well, not not necessarily. But here's the difference is I'm a user. I'm not necessarily connected to a specific network. I could be sitting at home. I could be sitting halfway around the world. When I log in, what is it what is it, first of all, that I should have access to? Let's say there's, like, five five applications I need to access. Right? But then after I log in, my credentials should determine what I have access to in those applications. Not just that I have access, let's say, to my mail to some HR application, but what data in a human resource application? I should see my data. Right? But I shouldn't see everybody else's. And let's say I'm an administrator or maybe I'm an HR expert. I wanna go and look at some of the records, somebody's file.
I should actually be challenged. I shouldn't be sitting there as a regular user and be able to access multiple records without really having that access, and that could be a separate challenge. In that case, yeah, but doing your basic work, maybe it's, you know, suddenly your location changes. And so there's this flag that goes up, and you need to be reauthenticated because you just moved. Seems like, you know, you're not sitting at home anymore. You're sitting somewhere in Internet hotspot. Right? So it's like that that... Those types of things should trigger a mechanism for getting re... Reauthenticated and revalidated. So, yeah, there's a balance between kind of usability and security. There's work being done on this. I just it's not there. I don't think there's a huge investment in trying to get to the point where you're truly revalidating, re authenticating the users.
Right. Which then the users start to rebel against, etcetera, etcetera. But, no, that that was a great answer. Definitely, I think hit the nail on the head. It's like, if I'm in the HR app, I wanna just send my colleague a thank you note. Yeah. But are you... Do you really need to go see your colleague's addresses and things as a... Just a user and not an HR professional? Probably not. Right? So, yeah, that makes sense that you have some of those guardrails up. Now on the investment front, of course, AI, you know, talk about buzzwords. Eclipse Zero Trust is a buzzword these days, it seems. And... But but it is obviously... There have been leaps and bounds made in in advancing AI technology and just even week by week, it seems. How do you see Gen AI and some of these large language models affecting your work in the next, say, twelve months?
Significantly, I think. You know, from... There's two different perspectives. Right? How is it gonna increase probably the threat space? Right? Like, the attack space because it's just gonna be so much easier to create your little scripts and to basically be able to do your hacking or whatever types of things that you see happening, it's gonna definitely grow exponentially. And we have to look at it from the perspective now, how do we protect against things like that, right, to be able to to not only identify that there's these maybe bots or other types of attacks that are happening that are AI generated. And then there's also the the perspective of using AI for actually exponentially growing, like, our knowledge base and our visibility.
Right? And I think we're we're looking at both of those as potentially being impacted quite a bit in the next year or so and how do we leverage our existing tools to be able to do a better job of, first of all, identifying threats and identifying things like that, but also being able to automate a lot of things. Taking some of that AI capability and being able to have it do that collection of the data and orchestrating of the data and prioritizing, like, this threat looks more important than this one so that we can give our analysts here's a critical high priority and here's, you know, maybe what, you know, the bots can take care of. You don't have to worry about it. So I think it's both of those, but we definitely see that as a significant tool as well as a significant threat.
I know. I always like to ask people which they think is gonna be the... Like, which is gonna win out. Right? Is AI gonna be more of a benefit for defenders or for attackers in the near term? I I honestly don't know where I fall, which is partly why I always ask it. What are your thoughts?
Absolutely. Yeah. Because that's something that... It's another tool just in their toolbox, right, that they can they can take on and they can just generate things right away versus if you're on a React... And that's why I think, you know, what we're trying to do is kinda get ahead of that curve. Right? You know, what's the next... Like, quantum is another one that's coming up. Right?
And, you know, AI is accelerating that too. Right? The reality of quantum was, like, projected for, you know, late twenty twenties. Right? Now they're talking about it in a couple of years. Right? Because of AI. Yeah. We gotta consider all of those things as we're looking at what is our cyber defenders gonna need. Right? What do they need in order to be able to detect and protect against those things? So that's kind of where I'm focused on is trying to get all of those pieces of the puzzle together and and be able to make sure that we're ready for it when it happens.
Well, that's no small task, and I do really appreciate you taking time out of your busy day to talk with us about some of these fantastic and really fascinating security issues. Now, Sara, there is one question that we always ask of our guests of the podcast, and that's the fun fact, if you will, though. What's something that we wouldn't know about you just by looking at your LinkedIn profile?
think probably one of the main hobbies or or, like, things that I actually love doing is traveling. Being with the state department, I got the travel bug. So since, you know, early two thousands, I've been all around the world trying to experience different cultures, different countries, understanding the bigger world that we live in. Right? So probably something you won't get from from my LinkedIn profiles. Well,
If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little info sec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
