In light of Presidents’ Day, our CEO shared his admiration for his favorite President, Ronald Reagan in a recent Q&A session. We talked about the former president's values, leadership style, and the lessons we can still learn from him today. As he was known for and truly was the “Great Communicator.”

Q: Who is your favorite President and why?

 Ronald Reagan – and as to why, well there are a few main points that come to mind. Mostly, his love for our country. He was a true “America first” President and was one of the first Presidents who went across party lines and brought America together. He was a Hollywood stud who turned Politician to bring the country together. We were in turmoil, inflation was crazy high along with unemployment and interest rates, civil rights and Nixon (e.g., Watergate) and because of his ability to be a people’s person and to turn the focus internal and on America he was able to unify our country in a truly remarkable way.

Q: What is your favorite quote from President Reagan?

I actually served in the U.S. Army under Reagan and found inspiration when he directly addressed what we knew then as the Soviet Union in his speech he gave in West Berlin in 1987. Reagan's statement was a direct challenge to Soviet leader Mikhail Gorbachev to dismantle the wall and to bring an end to the division of Germany and Europe.

Q: How did he inspire you and your career path?

“America first” – Love America and treat everyone the same. Anyone who knows me knows that I am not a “CEO first” mindset – I am an Engineer and at ANS our org chart is upside down, where I report to everyone. Reagan once said “

The greatest leader is not necessarily the one who does the greatest things. He is the one who gets the people to do the greatest things

.”We are a team; we win together, and we lose together.I believe that by looking inward and treating your company (or for Reagan, his country) as the same and equal we can achieve great things together.

Q: What can we still learn from President Reagan today?

Honestly, how great America is! But on a different level, there are a lot of lessons we can learn decades after his presidency.

Leadership being a big one. Reagan was a charismatic and effective leader who was able to communicate his vision and inspire others to work toward a common goal. He emphasized a clear and consistent message, a willingness to listen to others, and a positive and optimistic outlook.

Although Reagan was a conservative Republican, he was also known for his ability to work with members of the opposite party and find common ground on important issues. Today, in a time of heightened political polarization, we can still learn from Reagan's legacy for bipartisanship and his willingness to put country over party.

While I could continue on and on as to what we could still learn from Reagan today, I will end with his view of the power of ideas. Reagan was a strong advocate for the power of ideas and the importance of ideological debate. He believed that by engaging in robust and respectful discussions, we could find solutions to even the most difficult problems. One of our core values at ANS is continued excellence;  accept the challenge, chose to be a leader.  We want to solve problems, and work together, with respect.

Q: Any closing remarks about why President Reagan is your favorite President?

Never let things you can’t do stop you from doing what you can!

Having worked alongside President Reagan in support of The White House Communications Agency (WHCA), during his time in the Army, Chris Dunn was able to provide a unique perspective. One that America grew to love President Reagan for, but Dunn got to experience firsthand. ANS hopes you have a great Presidents’ Day and encourages you to take time to reflect on your favorite President and how their leadership can inspire you!

Q&A President’s Day 2023

Applied Network Solutions, Inc. (ANS) strives to stay on the leading edge of technology with regards to network architectures, network security and enterprise infrastructure security. One of the major shifts over the last decade, and increasing over the last five years, has been a shift to cloud computing.

Prior to cloud computing, the task of securing an enterprise server infrastructure was easy to define when every server was a physical host. It essentially came down to three architectural components: 1) secure the server operating system, 2) apply secure practices to application development and deployment, and 3) secure the network around the server. The move to virtualization did little to change this, only adding a fourth component: secure the hypervisor. The introduction of containers made things a little more complicated, but early implementations treated containers as special instances of an application on a server. Most of our traditional security practices are based on this simple architecture. This includes vulnerability scanners that externally look at the network interface of a server and internally the operating system configuration and software.

The move to cloud computing has changed this. The clean boundaries of application, server, hypervisor and network may not exist in a cloud deployment. A simple deployment of a virtual machine requires transferring responsibility to the cloud provider for security of the physical infrastructure, the hypervisor, the storage, and the network boundary. The Enterprise retains control over the server operating system, the applications and defining the security controls for the network boundary. Still, this architecture is not that different from a traditional architecture. The same vulnerability scanners can be used to monitor the system and software.

The introduction of cloud-based containers (e.g., Docker with Kubernetes) and serverless computing renders these traditional methods obsolete.

Network scanners are unable to perform port and protocol scans of containers and serverless computing. Likewise, traditional firewalls are unable to define a static set of rules to control communication between contains.

Containers create an overlay network for their communication that is inaccessible to a scanner. Further complicating the problem is when managed by an orchestrator, such as Kubernetes, containers can be ephemeral coming and going as needed to support the workload.

Serverless computing has no associated IP addresses to scan. They are nothing more than application modules utilizing network API calls to other resources. They are ephemeral and are only run when invoked and disappear when the module function returns and exits.

Software vulnerability scanners have a similar problem. There is no host on which to run the scanners.

The problem with network scanners does not have a solution. There is no static target to scan with regards to internal communications. The best they can do is to treat containers and serverless computing the same as internal applications on a server and scan the external facing services provided by the system.

Traditional firewalls will need to take a similar external facing approach. A non-traditional firewall architecture can go deeper into the environment by extending the concepts of a Software Defined Perimeter to containers. A Software Defined Perimeter focuses on the application communications, both internally and externally. A controller is used to adapt to the changing environment as needed.

The Software Defined Perimeter concept was initially designed for managing communications between virtual machines. Large applications, such as a web site, can have different VMs performing different functions. A simple example is the front-end servers providing the web page, and back-end servers performing data access, billing, and other functions. A Software Defined Perimeter protects the communications between these different components and limits the impact should one of them be compromised. It can also provide protection to the external access to the system. A key aspect of this concept is it can adapt as needed as compute resources are added and removed and based on other aspects such as the user requesting services.

Extending the Software Defined Perimeter for containers can leverage the same concept but cannot be implemented by simply putting a smart firewall on the network. A solution such as provided by the Istio project (https://istio.io/) is an example of a firewall with can implement a Software Defined Perimeter for containers.

Network Security for Serverless Computing

Network security for serverless computing requires a different approach. There are no discrete network communications between serverless functions. This means there is nothing to scan, and no IP communications to protect.

Security in this environment is dependent on the definition and application of policies and roles. Performing the equivalent of a network scan would require evaluating these policies to determine if they are compliant with the intended allowed communications. A resource would be the equivalent of a host, and the allowed functions would be the equivalent of ports.

Performing software vulnerability scanning for containers and serverless computing also requires a different approach. Neither of these have a host on which to run the scans of the operationally deployed software. Instead, a proxy approach must be used.

Solving this problem requires recognizing the software is first developed on a traditional host. Software in the development environment can be scanned to ensure it is not using any packages with known vulnerabilities. Scans can also be used to verify the code is following acceptable security coding practices. Ensuring the deployed software matches what was scanned requires developing a method to compare the scanned software to the deployed software.

A Software Bill of Materials should be maintained for any packages incorporated into the containers or layered onto the serverless computing functions. This will make it easier to identify software using packages that have been newly identified as containing vulnerabilities.

Moving to a cloud environment utilizing containers and serverless computing requires changing how we view security and our techniques for performing vulnerability scans and assessments. Traditional security scanners and firewalls cannot operate in an environment where the entity running the software is ephemeral and have no define host on which they run. Containers managed by an orchestrator (e.g., Kubernetes) can come into and out of existence as needed. Serverless computing is nothing more than application code that runs only when invoked and leverages network API calls to other resources in the cloud environment. Neither have a host on which to run software scanners.

Protecting these environments requires the adoption of new approaches for performing security scans and implementing firewall protections.

Cloud Computing

At ANS we provide world-class network engineering and cybersecurity services that help secure the most critical government networks. Those network owners count on our expertise with the rapidly changing strategic and technological elements of cybersecurity to enable them to make risk informed security decisions. It is critical that we anticipate customer needs as they roll out new network configurations and cybersecurity capabilities. Zero Trust (ZT) is an example of a concept we must understand and prepare to support for our customers. Planned deployment of ZT capabilities throughout the government and private sectors has the potential to fundamentally change the nature of the networks we help protect, and will require us to develop new skills, tools, and methods to support our customers through this period of change.

 was issued that mandates the federal government to “advance toward Zero Trust Architecture (ZTA).” Subsequent 2022 OMB memorandums M-22-09 

Administration Cybersecurity Priorities for the FY 2024 Budget

 made it clear that ZT is a major focus for federal government network defense. In 2021 NSA, DoD, NIST, CISA, and even our allies at the UK NCSC all published ZT guidance in the form of architectures, frameworks, and maturity models to help speed understanding and adoption of ZT security capabilities. Similar work is occurring simultaneously across private sector organizations, with new white papers dropping almost daily from sources like Gartner, Forrester, and many other researchers. The vendor community is aggressively moving out to provide solutions for the evolution of public and private networks to ZTA, producing new products and updating existing products to provide the necessary capabilities.

Throughout 2022, work on ZT has accelerated in both public and private sectors with a focus on planning for widespread adoption, research and training, standards development, demonstrating solutions in testbeds using available commercial technology, and opportunities to add ZT concepts to widely adopted cyber security frameworks. Let’s discuss a few of those efforts.

In early 2021, the DoD Chief Information Officer, John Sherman, announced plans to create a new portfolio office to manage the DoD Zero Trust Architecture Program. The effort was officially launched in January 2022, and in only a few short months produced a strategic plan that will enable DoD to achieve a target level of ZT capabilities across the DoD Information Enterprise.

This strategic plan, intended for release in October 2022, defines 45 ZT Capabilities, 42 of which are targeted for deployment by 2027. The document further details that these capabilities are comprised of 152 Activities, 90 of which map to the 45 capabilities planned for 2027. It also suggests three potential synergistic courses of action for deployment ranging from enhancing the existing DoD enterprise to more “greenfield” options for commercial and private cloud-based network architectures.

Additionally, the portfolio office completed a 2.0 update to the 

 originally published in 2021, to be released as an aid in implementing the strategic plan by serving as an authoritative guide for DoD ZTA and solutions. They also plan to publish a 

 containing timelines to implement ZTA across most DoD enterprise systems beginning in 2023 and depicting ZT capability advancement across all seven DoD defined pillars, capturing predecessor/successor capabilities.

NIST NCCoE Zero Trust Architecture Implementations (NIST SP 1800-35)

In August 2020, the National Institute of Standards and Technology (NIST) published Special Publication (SP) 800-207 

As the first US Government publication addressing the concept of ZT in significant detail, it has influenced all later ZT publications, including NSA’s 

. In SP 800-207, NIST introduced all the basic tenants of Zero Trust, defined the logical components of a ZTA, and discussed many of the other concerns related to migrating to a ZTA.

The National Cybersecurity Center of Excellence (NCCoE), a part of NIST, has begun to build a series of exemplar ZTA solutions in their Zero Trust testbed in collaboration with a group of 32 ZTA technology providers. The project goal is to use commercially available technology to build interoperable, open standards based ZTA implementations that align to the concepts and principles in SP 800-207. Multiple scenarios are planned in diverse enterprise testbeds, leveraging distinct sets of vendor security products as integrated ZTA solutions. This effort is an iterative process with results shared through updates to NIST SP 1800-35 Volumes A – D after each iteration, as appropriate.

The preliminary drafts of all volumes of SP 1800-35 documenting the details and results of the first functional demonstration are available for review on the NIST ZT 

. Sufficient details are provided to duplicate both the testbed environments and the functional demonstrations if desired.

The results of the first experiment (described in the publication as the “crawl phase”) were predictable. All the solutions used for this demonstration integrated well within their own vendor ecosystems and provided the desired capabilities. However, many of the vendors used do not integrate outside those vendor specific ecosystems out-of-the-box (NIST uses only integrations provided by solution vendors rather than custom integrations for this project.) This prevented implementation of all the desired enterprise ZT capabilities. The solution set chosen for this demonstration also lacked a Comply-to-Connect capability, so there was no way to prevent an endpoint from initially joining the network based on its authentication status by performing authentication and reauthentication of resources that host endpoints.

This NCCoE project is serving a critical role in providing examples of ZTA commercial solution integration, identifying gaps in the available technology, and highlighting problems with integration across vendor ecosystems. Hopefully new partnerships will emerge from this effort to address those technology gaps and the participating capability providers find ways to better integrate that provide holistic enterprise ZT solutions.

Originally developed to meet the requirements of the Cybersecurity Enhancement Act of 2014, the NIST 

Framework for Improving Critical Infrastructure Cybersecurity

 (CSF) has since become a best practice for cybersecurity applied by governments and businesses worldwide. NIST has begun updating this ubiquitous cybersecurity framework to keep pace with the evolving cybersecurity landscape through a series of 

, the first held on 18 AUG 22. The secret to encouraging international adoption of the CSF v1 was strong stakeholder engagement. NIST plans to continue their history of transparent stakeholder engagement through a series of collaborative workshops, interactive development of multiple drafts, and use of dedicated Slack channels to produce the updated version.

This revision of the CSF is an opportunity to synchronize ZT concepts with the CSF. A key theme to emerge from the responses to the Request for Information (RFI) that preceded the first workshop was the desire to “Align the CSF with existing efforts by NIST and others” and “Ensure the CSF remains technology neutral yet can be applied to specific and emerging topics such as cloud, hybrid work, and zero trust.” ZT implementations would greatly benefit from the standard, vendor agnostic taxonomy that could be provided in the new version of CSF, enabling better mapping across any number of other cybersecurity frameworks in use today.

In March of this year, the Cloud Security Alliance (CSA) announced the launch of the 

 in partnership with CrowdStrike, Okta, and Zscalar. The new center’s purpose is to explain ZT as a strategy in a vendor-agnostic setting, frame it with a set of guiding principles, and help provide context around the myriad of related solutions. To achieve these goals, they plan to:

Lead the development of tools and resources to guide ZT implementation

Build and evangelize authoritative ZT best practices and tools

Create research, training, professional credentialing and provide an online center for additional curated ZT resources

Provide courses in ZT architecture and strategy, a CloudBytes webinar series, several research whitepapers, an annual ZT Summit to be initiated in Q4 2022, and a new professional credential, the Certificate of Zero Trust Knowledge (CZTK).

In August, the CSA also launched a ZT Working Group focused on collaboratively developing Zero Trust standards to achieve consistency for cloud, hybrid, and mobile endpoint environments. This working group plans to perform research and produce deliverables such as specifications, architectural guidance, technical documents, thought leadership articles, position papers, and implementation guidance. This work will focus on nine workstreams:

Zero Trust as a Philosophy & Guiding Principles

Zero Trust Organizational Strategy & Governance

Automation, Orchestration, Visibility & Analytics

Zero Trust Architecture, Implementation, and Maturity Model

The CSA has a long history of delivering on their promises for developing new architectures, specifications, and standards for cloud security. There is little doubt that they will be successful in developing new ZT focused security specifications, standards, and related architectures.

The level of interest in Zero Trust across the public and private sectors continues to grow and the level of effort applied to moving ZT concepts closer to widespread adoption is encouraging. However, most of the efforts discussed are moving forward without coordination or, in some cases, even knowledge of the other efforts. Zero Trust activities must be coordinated such that they share a common taxonomy, map to a common set of security controls where appropriate, and most important avoid contradictory guidance that will confuse and delay widespread adoption.

While it would be convenient to just buy Zero Trust in a box, no single vendor today provides all the solutions necessary to deploy a holistic enterprise ZTA solution. But many of them already have products that meet some of the requirements of ZTA, so progress towards implementation can start now. A common goal of all these efforts is to enable vendor agnostic implementations. To avoid having to develop “glue code” to integrate products from multiple vendor ecosystems, we need ZTA enabling data standards, command and control standards, interface standards, universal playbooks for automation, and maybe even dedicated message fabrics to make that vision a reality. Another option would be for coalitions of vendors to work together to provide integrated solutions in answer to government contracts, like they did for the DHS Continuous Diagnostics and Mitigation (CDM) program.

Achieving these goals requires true public/private coordination and partnership to ensure that we do it right the first time. All the efforts described in this article need to align and work together to ensure standardization of core concepts. And the standards bodies need to complete their work on ZT standards quickly to enable the ZT community to overcome the challenges of integration and deployment of solutions. Collaboration is key to success.

ANS is tracking these efforts, and in some cases participating in the working groups. All of us working in cybersecurity should ensure that network owners are aware of the ZT work that is underway and help them prepare for success. Proactively consider ways ZTA will force us to evolve the tools and techniques we use today. Take every opportunity to engage the ZT community to encourage synchronization of effort. We can all play a role in making ZTA a success. Let’s help make it happen together.

ZT Architecture: Coming Soon!

One of the hottest topics in cybersecurity today is Zero Trust. Just in the past 20 months, DoD[i] and NIST[ii] published Zero Trust Architectures, CISA published a Zero Trust Maturity Model[iii], an Executive Order[iv] and OMB Memorandum[v] levying requirements on government organizations to implement Zero Trust were issued, and GSA released a Zero Trust Architecture Buyer’s Guide[vi]. Not to mention all the vendors advertising Zero Trust solutions, Gartner and Forrester publications, and the other 3,660,000,000 results from a Google search on the term “Zero Trust.” Likewise, a search on the term "How to Implement Zero Trust" yielded 80,900,000 results. It’s safe to say there is a lot of interest in Zero Trust.

But what is Zero Trust? According to Gartner[vii], Zero Trust network security “starts with a default deny posture of [trusting nothing]. Access is granted based on the identity of the humans and their devices — plus other attributes and context, such as time/date, geolocation, device posture, etc. — and adaptively offers the appropriate trust required at the time.” This is a significant paradigm shift from traditional, "trust, then verify” perimeter-based network security that seeks to keep malicious actors out, while assuming that anyone who is already inside the network can be trusted. The Zero Trust security model eliminates the idea of a trusted network, assuming instead that threats exist both inside and outside a network, so no one human or thing can be trusted implicitly. Under this model’s principle of "verify, then trust," permissions are only granted to user accounts, devices, applications, or services once properly validated, and moreover trust must be continually revalidated to maintain access.

With all the buzz, you’d think Zero Trust is a brand-new silver bullet for all our cybersecurity concerns. But if you’ve worked in cybersecurity for a while, you’ll find much of Zero Trust to be hauntingly familiar. Let’s explore that further:

Since it seems that each publication addressing Zero Trust has a different take on the concept, for simplicity let’s just look at one of the Zero Trust frameworks, the DHS CISA Zero Trust Maturity Model.

 organizes capabilities required to achieve Zero Trust into five categories (referred to as pillars): Identity, Device, Network/Environment, Application Workload, and Data. The capabilities listed in each pillar are then divided into three maturity levels: Traditional, Advanced, and Optimal. It’s here that a sense of déjà vu begins to set in when looking at the security functions called out for each block of the Maturity Model.

As we begin to examine the CISA model, we see Multifactor Authentication and Federated Identity required under the Identity pillar. Nothing new here conceptually. The original patent[viii] for the SecurID token was filed in 1993, Chip and Pin for credit cards was introduced in France in 1984[ix], and Paypal began offering a token for multifactor authentication around 2006[x]. So multifactor authentication has been available to enhance identity security for decades. Standards for Federated Identity Management (Single Sign-On) such as OpenID have been around since 2005[xi], and many commercial solution providers have broad user bases today. Again, nothing new.

Under the Device pillar, Device Compliance Enforcement and Data access management based on initial device posture are specifically called out. Requirements for automated asset management, vulnerability scanning, and patching are also levied in the detailed descriptions of this pillar. Again, not really anything new. In the SANS Consensus Audit Guidelines[xii] (the precursor to the SANS Top 20 Security Controls) dated 02 Mar 2009, the first control requires an inventory of all devices on the network and the third requires secure configurations for all network devices. NIST 800-53[xiii] published in February 2005 addressed requirements for configuration management. For over a decade, we've had solutions associated with Network Access Control and VPNs that install a client on the user’s computer and assess device security status and compliance before admitting the device onto the network. More recent methods add other sources of data, such as endpoint security scanning, and network vulnerability scans to facilitate that determination. This is the basis of the DoD comply-to-connect strategy and associated implementation framework[xiv] developed over the past decade. Everything in the Traditional and Advanced blocks of this pillar are well-known security requirements with existing solutions.

In the Network/Environment pillar, we see macro-segmentation, traffic encryption, internal micro-segmentations using micro-perimeter controls, as well as basic network traffic analytics. Traditional firewall and VLAN technology to enable macro-segmentation have been available since the late 90s[xv]. Information Flow Enforcement controls to enforce segmentation was first added to NIST 800-53 in Rev. 1 published in 2006. Next Generation firewalls coupled with Active Directory (or other user-to-IP tie-in) have been capable of enabling network micro-segmentation for over a decade.

The concept of Micro-perimeters is a more recent development moving the firewall to the application. For comparison, network micro-segmentation might sit at the front of a data center and can control the IP addresses, and for web pages, the URL accessible by a user. The micro-perimeter sits with the application and can control access with finer granularity beyond just the URL, such as the type of queries allowed. While the term micro-perimeter is new, the ability to provide this level of data access control at the application level is not. The Multiplexed Information and Computing Services (Multics)xvi operating system designed in the late 1960s, and evolved through the 1980s, provided an application-based data protection capability similar to a micro-perimeter. The operating system could prevent direct user access to data thus enabling the application as the enforcement control point for data access. The concepts are the same, differing only in the method of access to the application.

Other Network/Environment pillar capabilities have also been around. We have had the capability to do basic traffic analysis for 20+ years. And strong encryption for data-at-rest and data-in-motion has been recommended and commercially available for decades.

The Application Workload pillar for the Advanced Maturity level requires centralized authentication and authorization for access to applications and integration of threat protections into application workflows. Standards and solutions to meet these requirements have been available for almost forty years, dating back to when MIT developed Kerberos[xvi] in the 1980s. Requirements for application security date back to the early publications of both the Sans Top 20 Security Controls and NIST 800-53. The migration to cloud services has accelerated the use of centralized authentication services.

The final pillar, Data, requires application of least privilege data access, and encryption of data at rest. The concept of Least Privilege dates back to 1983 when the National Computer Security Center (NCSC) Trusted Computer System Evaluation Criteria (TCSEC, aka. Orange Book)[xvii] was initially released. The original 2009 SANS critical controls included “Controlled Access Based on Need to Know,” and the 2005 release of NIST 800-53 v1 included the Least Privilege security control. It is not until the third revision of 800-53 in 2010 that we see a control specifically addressing Protection of Information at Rest recommending encryption, but that was added twelve years ago. Again, all well-known cybersecurity principles.

The question is then “Is Zero Trust just old wine in a new bottle?” or does it bring something new to the fight? Zero Trust is at least shining a new spotlight on required security controls that haven’t been universally applied despite having been known and recommended for many years. If so many of the tenets of Zero Trust have been recommended by security practitioners for decades, why aren’t they already in widespread use? The answer lies in the fact that security is the enemy of ease of use. Network users don’t want to be burdened with carrying tokens for multifactor authentication, strong passwords that are hard to remember, having to ask for access to data that they didn’t need to do their job until just now, networks slowed by the need to encrypt and decrypt data, and all the other “burdens” of strong cybersecurity. Security is also hard, often requiring restructuring of network architecture and additional capital investment. Security is often seen as an unnecessary cost by senior executives, at least until after they experience a ransomware attack or major security breech. Mandatory requirements for Zero Trust may be just the incentive needed to get network owners to finally implement all those well-known security controls we’ve recommended for decades.

Zero Trust also brings with it several newer concepts. The core tenet of Zero Trust is to assume that the network has already been compromised, and malicious actors are inside the network perimeter. This idea encourages stronger identity management and access controls and shifts the defensive focus from boundary defense to role-based and attribute-based access, network segmentation, data segmentation, and treats each application as a boundary. This leads to a key new concept: The user logs into applications, not the network, and data is accessed through the application based on the user’s need to know, and right to know. The paradigm shifts from blanket trust to transactional trust.

The truly innovative elements of Zero Trust are found in the requirements for the Optimal level of the CISA Zero Trust Maturity Model. Continuous validation isn't that hard to achieve. Most centralized security authentication/authorization systems issue a token that has a lifetime forcing continuous validation. When the token expires, re-authentication/authorization is required. In Contrast, real time analysis, continuous monitoring, machine learning, encryption of all data at rest and in motion, and other requirements are beyond the scope of most current enterprises. Virtualization, cloud services, artificial intelligence, machine learning and automation capabilities are required to achieve these goals. Technology is truly still evolving as new approaches and techniques improve how this can be done by machines, because in most places there aren't enough human resources to manage and analyze the data flow, much less do it in real-time. For most network owners, this will require significant investment and rebuild of their networks to add these capabilities. These investments and changes are unlikely to happen overnight. Network owners can still implement those legacy elements of Zero Trust that are well understood and for which many commercial solutions are available in the near term.

The bottom line is that Zero Trust can serve as a forcing function for the implementation of good security practices that have been recommended by cybersecurity practitioners for many years, while encouraging adoption of even stronger controls enabled by newer technologies. Adoption of Zero Trust principles will help minimize the blast radius of data breaches to single user sessions rather than the entire enterprise. And the increased automation and centralized control required for an optimal implementation of Zero Trust will reduce the burden on administrators implementing required security controls, making them more dynamic and transparent to users. Finally, remember Zero Trust is a journey not a destination, with each step taken providing more protection to organizational data, and well worth the trip.


[i] Joint Defense Information Systems Agency (DISA) and National Security Agency (NSA), Department of Defense (DOD) Zero Trust Reference Architecture (2021).

[ii] Rose, S., Borchett, O., Mitchell, S., & Connelly, S., NIST Special Publication 800-207 Zero Trust Architecture (2020).

[iii] CISA Cybersecurity Division, Zero Trust Maturity Model (2021).

[iv] Exec. Order No. 14028, 86 Fed. Reg. 93 (May 12, 2021).

[v] Office of Management and Budget, Memorandum M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles (2022).

[vi] GSA, Zero Trust Architecture Buyer's Guide (2021).

[vii] McQuaid, A., MacDonald, N., Watts, J., & Handa, S. (2022). (tech.). Market Guide for Zero Trust Network Access. Gartner

[viii] Weiss, K. P. (1996, January 16). Enhanced security for a secure token code.

[ix] Roos, D. (2014, May 16). How chip and PIN credit cards work. HowStuffWorks. Retrieved May 18, 2022, from https://money.howstuffworks.com/personal-finance/debt-management/chip-and-pin-credit-cards.htm

[x] Gibson, S. (2007, August 2). Security now! Transcript of Episode #103. Retrieved May 18, 2022, from https://www.grc.com/sn/sn-103.htm

[xi] Fitzpatrick, B. (2005, May 16). Distributed identity: Yadis. LiveJournal. Retrieved May 18, 2022, from http://community.livejournal.com/lj_dev/683939.html

[xii] Gilligan, J. (2009, February 27). Consensus Audit Guidelines - Draft 1.0. SANS.org. Retrieved May 18, 2022, from http://www.sans.org/cag/guidelines.php

[xiii] NIST, Recommended security controls for Federal Information Systems and organizations (2005). Gaithersburg, MD; U.S. Dept. of Commerce, National Institute of Standards and Technology.

[xiv] Defense Information Systems Agency. Fact Sheets. (n.d.). Retrieved May 23, 2022, from https://www.disa.mil/about/fact-sheets

[xv] "IEEE Standards for Local and Metropolitan Area Networks: Virtual Bridged Local Area Networks," in IEEE Std 802.1Q-1998 , vol., no., pp.1-214, 8 March 1999, doi: 10.1109/IEEESTD.1999.89204.

[xvi] S. P. Miller, B. C. Neuman, J. I. Schiller, and J. H. Saltzer, Section E.2.1. Kerberos Authentication and Authorization System, M.I.T. Project Athena, Cambridge, Massachusetts (December 21, 1987).

[xvii] National Computer Security Center, DoD 5200.28-STD Department of Defense Trusted Computer System Evaluation Criteria (1985).

Zero Trust: Same Old Controls, or Something New and Shiny?

…But my dad, my sister, and my brother-in-law did, and I genuinely respect all those who have. With Applied Network Solutions (ANS), I am excited to be part of a company that shares my passion to honor the commitment of those in the armed services who are transitioning to private sector life via the DoD SkillBridge program.

A program in which military members on the cusp of separation can apply to be interns at commercial companies while still being paid their military pay and benefits for the final few months of their enlistment.

The program creates positive opportunities for both parties involved.

The transitioning military member gets to experience real-life working in the business world. For some, this can be a refreshing change; for others a bit more difficult to adapt to. In the case of the latter, even more reason to take a few months to gradually adapt to life outside of the structure and rigor of military life. In addition, military members may gain assistance and mentoring with regards to interviewing and job searching. In the case of my company, they are afforded training, study time, and vouchers to test for information technology and/or cybersecurity industry certifications – the backbone of DoD contractor hiring and qualifications. In short, ANS desires to do everything we can to set our interns up for success in their new work-life beyond the military.

Participating companies gain the potential to hire vetted, disciplined, quality candidates while potentially leapfrogging the wickets of general recruiting processes and procedures. So much more than just “free labor” that the term “intern” may conjure in the minds of some, companies gain a chance to build engagement, loyalty, and goodwill from a qualified pool of candidates appreciative of the opportunities being offered. ANS simply believes it’s the right thing to do for those who have given of themselves in service to our country.

Anthony, one of our current SkillBridge interns put it this way: “It’s like the DoD partnering with industry to give back to the military members a chance to gain a skillset for better employment opportunities. There’s not a lot of call for a mortarman or artillery gunner in the commercial sector!” Anthony started his internship days before our company-wide annual kick-off party. It was there that we learned that Anthony already knew many of our employees. They were contractors working with him previously! We are selective in who we employ and bring on as interns, as we look for people with aptitude and a love for the mission they support. Anthony is no exception.

Former SkillBridge beneficiary at our company, David, recently related to me, “I genuinely feel lucky to have found ANS!” We assisted David in his relocation and transition, allowing him ample time for out-processing and attending to his few remaining military responsibilities. We provided training which he leveraged to gain additional desired IT certifications. We happily cheered him on as he successfully applied to and negotiated a great paying job 

 – but that’s totally okay as it was never about us in the first place! All credit goes to him!

With internship locations in both San Antonio, TX and Columbia, MD we have been fortunate enough to employ many of our interns. One intern immediately joined ANS at the end of his internship and was accepted onto a cyber protection team in TX. Another learned the ropes of becoming a Software Developer during his internship and proved essential in creating our new website - a task that not many others were up for completing!

Don’t Just Say “Thank You” … Show Your Gratitude!

Working and living in San Antonio, Texas, I meet and know a great many current and former military members. I often say to them, “Thank you for your service!” and sincerely mean it, but simply 

 “Thank You” to show my appreciation is easy, and ultimately profits them nothing. It is 

something to show that appreciation that takes deliberate effort.

Comprised of 52% Veterans, ANS takes great pride in hiring and taking care of our prior military servicemen and women. As a business community, may we always be about 

Want to become a SkillBridge Industry Partner?

More information on SkillBridge can be found at 

Reflections On The SkillBridge Experience

My name is Emily. I am a 31-year-old cybersecurity enthusiast, and I have been in the Information Technology and Cybersecurity field for eight years. I specialize in network threat detection and mitigation and enjoy forensic analysis and studying adversary behavioral patterns. Some of my hobbies include hiking, kayaking, reading Fantasy Fiction, and crafting. I am married to my best friend and have a 4-year-old German Shepherd, Cipher.

Some of the brightest minds in Information Technology were and are women. From the mid to late 1800s to the current day, women have been pioneers in the world of computing. Great minds like Ada Lovelace, Grace Hopper, Katherine Johnson, Margaret Hamilton, Adele Goldberg, Hedy Lamar, and many more have designed and developed computations still used today. Without women, the computing world we live in today may look very different. Women worldwide are breaking down barriers and announcing that women can do anything with the correct equation of motivation and passion.

The Cybersecurity workforce is ever-changing, and amongst these changes, the most popular topic of change is the rise of women in the industry. More women are applying and being hired for cybersecurity roles every day. Women are also earning higher-level positions faster than their male counterparts. According to The International Information System Security Certification Consortium (ISC)² survey conducted in 2018, 24% of the cyber workforce is women 

. The study includes women in positions where at least 25% of their daily duties are Cybersecurity responsibilities. The study comprises traditionally prominent government roles and small businesses nationwide and worldwide 

. So why are women still only making up a quarter of the workforce? There are many contributing factors to the slow rise of women in cyber. Experts say, “access to opportunities, education, and the lack of value on diversity could be some contributing factors 

.” Although these barriers to entry still exist, many companies are working hard to provide more opportunities for women and encourage women to join the workforce.

To continue to increase our female workforce in cyber, we should be inspiring young women and girls to act on their curiosities about Science, Technology, Engineering, and Math (STEM). Marketing to them the benefits of participating in STEM programs can give them the freedom to explore their passions when they are young. They may feel confident enough to enter the workforce knowing they have the skills and abilities to be valued team members.STEM field jobs are typically challenging and rigorous. Working in STEM roles requires copious amounts of training and education to be competent, so expressing passions and working towards goals early in life can contribute to their success. It is also essential to teach all young people to follow their passions regardless of their race, color, national origin, religion, sex (including pregnancy, sexual orientation, gender identity, or transgender status). Inclusivity is the way of the future.

A common theme in most communities right now is inclusivity. What does it look like to be an inclusive workforce? Where do we start? These questions are all valid and not always easy to answer. People are different and have different needs. Our paths are all different, and how we arrive at a conclusion may never be the same. So, how do we inspire people from all walks of life to work together with synergy and maintain productivity? We start by being people-focused. We consider that exultant employees are more productive and benefit the bottom line. We support employees’ passions because that leads to inspiration and innovation. We believe in their goals and develop pathways to help them reach them. We encourage diversity because it provides unique perspectives, and we do all these things for everyone, including the women aspiring to be great leaders in the industry.

Once we have provided a thriving working environment for all, we all must take a moment to do a personal moral and ethical inventory every day and in everything that we do.“We should remain aware of unconscious bias, communicate the significance of managing bias, endorse pay equity, acknowledge all cultures, make company resources available to everyone, and never stop tracking progress over time 

.” Awareness and acknowledgment of personal bias and developing ways to thwart the tendency to discriminate in the workplace can help make all employees feel safe and welcome. Being an advocate for women in the workplace can help women feel safe and welcome.

The relationship between a mentor and mentee can be very beneficial. Mentorship programs have proven to be helpful for employees eager to increase their skill level, responsibilities, and career advancement. Employees who have mentorship in the workplace have higher job satisfaction, retention, productivity, and career growth 

. Mentors have all the previously stated benefits and have the pride of developing the next generation of leaders and innovators. The lack of mentorship in the workplace can be detrimental to the organization’s overall success. A mentorship program decreases employee conversation, experience sharing, and direction.

I am a woman. I have been in a male-dominated field since I was 19 years old. I have also spent my entire career in Information Technology and Cybersecurity. After graduating high school in 2010, I joined the United States Army as an Information Technology Specialist. In Basic Training and Advanced Individual Training, I was one of the very few women pursuing a career in Communications and IT. The environment in the military was still very much a “boy’s club.” I had to learn quickly how to identify allies and advocate for myself. I believe the less-than-welcoming environment made me resilient and creative. Even though the military setting wasn’t always accepting women, it wasn’t bad all the time. Over the six years I was in the service; I had one great mentor. One of my mentors was my Non-Commissioned Officer in Charge or NCOIC for the IT shop. She was a fierce Sergeant. She was loyal to her team and engaged with us on what we wanted for our futures. She helped me not only with career advancement but also with personal and life tribulations. She was my first example of how powerful career women can be assets to the workforce. She also taught me to treat others with dignity and respect regardless of rank or position.

After leaving the Army in 2016, I went back to school for my degree in Cybersecurity. Once again, as I walked through the doors of the enormous lecture hall in the business building, I saw rows and rows of young men with few young women. I honestly wasn’t expecting anything else. I knew I wanted to be friends with the women who sat before me. I knew I wanted to share my experiences and allow them to share theirs with me as well. I knew we would be strongest together. So, that is precisely what I did. I made friends. Some of those women graduated and became financial advisors, statical analysts, and, yes, cybersecurity professionals. As for the teaching population, I had exactly four female professors in 4 ½ years of schooling. Every single one of them taught an Information Systems or Cybersecurity course. Each of them brought their perspective into the classroom and made me feel like I could do anything if I wanted to. College was a pivotal moment in my career when I realized the Cybersecurity industry needed more women, and I would do everything I could to make that happen…starting with me.

Following my graduation, I joined Applied Network Solutions. I started with the corporate team developing security postures and capabilities procurement, which I had never done before. I was in a group of five, and I was the only woman. I enjoyed the work I was doing, and the men on my team were very bright and welcoming. They pushed me out of my comfort zone and provided feedback on my work. I learned so much from them in the short time I worked in the position. A few weeks after joining the ANS team, I moved to my current position on contract. I currently work with nearly all men. There are four or five other women, but I am the only full-time female operator. I now have two mentors that have been incredible in helping me navigate my new role and helping me advance to the next step in my career. They have guided me through onboarding, shared their expertise, and saved me from repeating their blunders from the past. They have become wonderful friends, and I cherish their guidance and perspective. They also happen to both be male. I share this because women do not always need a woman mentor. The mentor/mentee relationship should never be restricted to gender.

The future looks bright for women in cyber. We look back to the past and the women who paved the way before us. We look forward to the future and encourage the next generation of women to act on their passions for cyber. We foster a working environment fit for everyone. We support diversity, innovation, inspiration, and inclusion. We work together as a team to build brighter futures and support the changing workforce for “doing what we have always done will get us what we have always gotten [5].”  Change is coming, and the women of today and tomorrow will be the best in the business.

https://www.isc2.org/-/media/ISC2/Research/ISC2-Women-in-Cybersecurity-Report.ashx?la=en&hash=4C3B33AABFBEAFDDA211856CB274EBDDF9DBEB38

https://www.lifewire.com/why-we-need-more-women-working-in-cybersecurity-5116378

https://www.ceridian.com/blog/support-diversity-and-inclusion-in-the-workplace

https://www.mentorscout.com/benefits-of-workplace-mentoring.cfm

https://www.goodreads.com/quotes/904186-if-you-always-do-what-you-ve-always-done-you-ll-always

Right Where We Belong

Welcome to Applied Network Solutions, Inc. (ANS). We are the same ANS, with an improved, updated look. We have spent many months refreshing our site to reflect our focus on people and technology. We are a company that doesn't try to do everything. Instead, we are hyper-focused on networking and cybersecurity. 

22 years ago, ANS was formed out of a passion for technology and the desire to deliver solutions with impact. We have always been equally focused on our employees and securing the network to protect our national security. Often, defense contractors rent contracts and rent people. We hire for the person, not the position and we are invested in continuous development and opportunities for our employees. Our engineers are encouraged to think beyond a single contract or customer and focus on development and opportunities; call it “Passion over Profit.”

As we reflect on the last two decades and fast forward to years to come, I am humbled to say ANS has not waivered on the solutions we deliver and the commitment to our employees. I am honored to work alongside some of the most talented and passionate people in the industry and that they have chosen ANS to be part of their career. We continuously strive to be better and have excelled in doing so entirely due to the dedication and passion of our employees. I cannot thank them enough!

Please check back periodically as we will be posting updates and refreshed content.

Featured Post

Q&A President’s Day 2023

Our Insights