{"id":25118,"date":"2024-08-26T19:00:45","date_gmt":"2024-08-27T03:00:45","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2024\/08\/26\/news-18848\/"},"modified":"2024-08-26T19:00:45","modified_gmt":"2024-08-27T03:00:45","slug":"news-18848","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2024\/08\/26\/news-18848\/","title":{"rendered":"How Microsoft Entra ID supports US government agencies in meeting identity security requirements"},"content":{"rendered":"

Credit to Author: Joy Chik| Date: Mon, 26 Aug 2024 16:00:00 +0000<\/strong><\/p>\n

If you\u2019re in charge of cybersecurity for a United States government agency, you\u2019re already familiar with Memorandum M-22-09, \u201cMoving the U.S. Government Toward Zero Trust Cybersecurity Principles<\/a>,\u201d which the US Office of Management and Budget issued in January 2022. This memo set a September 30, 2024, deadline for meeting \u201cspecific cybersecurity standards and objectives\u201d toward implementing a Zero Trust architecture in compliance with the Executive Order on Improving the Nation\u2019s Cybersecurity<\/a>.<\/p>\n

Microsoft has embraced Zero Trust principles, both in our security products and in the way we secure our own enterprise environment. We\u2019ve been helping thousands of organizations worldwide transition to a Zero Trust security model, including military departments and civilian agencies. Over the past three years, we\u2019ve listened to our US government customers, so we can build rich new security features that help them meet the requirements described in the Executive Order, and then support their deployments. These advancements include certificate-based authentication in the cloud, Conditional Access authentication strength, cross-tenant access settings, FIDO2 provisioning APIs, Azure Virtual Desktop support for passwordless authentication, and device-bound passkeys.<\/p>\n

The illustration below depicts the Zero Trust Maturity Model Pillars<\/a> adopted by the US Cybersecurity and Infrastructure Security Agency (CISA).<\/p>\n

As the memo\u2019s deadline approaches, we\u2019d like to celebrate the progress our customers have made using the capabilities in Microsoft Entra ID<\/a> not only to meet requirements for the Identity pillar, but also to reduce complexity and to improve the user experience for their employees and partners.<\/p>\n

An architectural diagram that illustrates the Zero Trust Maturity Model Pillars adopted by the U.S. Cybersecurity and Infrastructure Security Agency. The five pillars are depicted as five vertical boxes labeled Identity, Devices, Networks, Applications and Workloads, and Data. Along the bottom of the diagram are three horizontal boxes labeled \"Visibility and analytics,\" \"Automation and orchestration,\" and \"Governance.\"<\/figure>\n

Microsoft Entra ID is helping US government customers meet the M-22-09 requirements for identity<\/h2>\n

US government agencies are adopting Microsoft Entra ID to consolidate siloed identity solutions, reduce operational complexity, and improve control and visibility across all their users, as the memo requires. With Microsoft Entra ID, agencies can enforce multifactor authentication<\/a> at the application level for more granular control. They can also strengthen security by enabling phishing-resistant authentication for staff, contractors, and partners, and by evaluating device information before authorizing access to resources.<\/p>\n

\n

Vision<\/strong>: <\/p>\n

Agency staff use enterprise-managed identities to access the applications they use in their work. Phishing-resistant multifactor authentication protects those personnel from sophisticated online attacks.<\/p>\n

Actions<\/strong>:<\/p>\n

    \n
  1. Agencies must employ centralized identity management systems<\/strong> for agency users that can be integrated into applications and common platforms.<\/li>\n
  2. Agencies must use strong multifactor authentication throughout their enterprise.\n