Federal agencies can’t just connect their systems to the internet; they need to follow a policy called Trusted Internet Connection to ensure a certain level of security. The policy was recently updated and the Cybersecurity and Infrastructure Security Agency was tasked with providing use cases for guidance and a reference architecture explaining key concepts. The draft documents for the latter include a concept called “trust zones,” which caused confusion about whether it was related to a popular cybersecurity concept called “zero trust.” Nextgov Senior Editor Aaron Boyd talks to the people shaping the program—and a critic—to set the record straight.
