Applying Zero Trust Without Disrupting Operations

Presented by Booz Allen

Federal agencies have made meaningful progress in cybersecurity, but increasingly connected environments keep expanding the challenge. Operational technology, connected devices, and enterprise systems create dependencies that security teams must understand before they can protect the mission effectively. In Applying Zero Trust Without Disrupting Operations, Jay Gazlay, Acting Associate Director for Vulnerability Management at CISA, and Ryan Zacha, Director, Zero Trust Architecture at Booz Allen, join Francis Rose to discuss how agencies can translate zero trust into practical improvements in visibility, containment, and resilience.

Gazlay begins by recognizing how much federal civilian defenses have improved over the past several years. He points to stronger observability, better logging, and modernization at the network edge. Those improvements reflect substantial effort to instrument complex environments and act on the information they produce. They also create a stronger starting point for further progress. The conversation presents zero trust as an ongoing discipline in which agencies build on existing gains while adapting to new devices, changing connections, and faster threats.

Observability runs through the discussion because protection depends on understanding the environment. Teams need to know what is connected, what vulnerabilities exist, and how infrastructure behaves. Zacha connects those fundamentals to identifying the organization’s most important systems and assets. Understanding their criticality helps determine where protective boundaries belong and which disruptions would have the greatest mission effect. That relationship between technical visibility and operational importance gives agencies a basis for deciding where to concentrate attention as they strengthen defenses.

The growth of connected equipment makes that work more demanding. Devices that once seemed separate from enterprise networks now introduce additional communication paths and dependencies. Gazlay highlights the importance of CIO visibility into purchases that will touch the network. Bringing that awareness into the acquisition process can help an organization design its defensive approach with a clearer picture of what it is adding. It can also support response planning by reducing uncertainty about the equipment and connections teams may need to investigate.

Segmentation is another recurring priority. Gazlay emphasizes deliberate design when an environment is first being built. Establishing appropriate boundaries at the outset is easier than retrofitting them after systems are already supporting operations. Changes made later may introduce engineering challenges or create a risk of taking something offline. For OT environments, that operational consequence deserves particular attention. The discussion therefore connects zero trust architecture to planning decisions made before deployment, when agencies have greater flexibility to define how systems should connect.

Gazlay also calls attention to outbound communications. Organizations may not predict every attempted intrusion, but they should understand the communications their devices need to initiate. Visibility into expected ports, protocols, and traffic patterns helps teams distinguish required activity from something that warrants investigation. His emphasis on positive control of outbound connections gives the broader discussion a practical focus. Knowing what should leave an environment can strengthen the ability to recognize and contain activity that does not fit the system’s intended behavior.

Zacha connects those concerns to the history of OT security. Specialized protocols and unfamiliar equipment have sometimes limited visibility, while apparent obscurity offered reassurance. AI changes that calculation by making it easier to analyze systems and protocols that previously required substantial effort to understand. The conversation highlights the need to instrument OT environments and examine the connections at their boundaries. A system’s unfamiliarity to the average observer offers little assurance if an adversary can quickly work out how it communicates and where its weaknesses lie.

That makes coordination with the vendor community and investment planning important. Zacha encourages agencies to understand their networks, consider how available capabilities can improve protection, and address the capital needs associated with securing OT. These are operational and resource decisions as well as technical ones. Agencies need to understand the environment they have, the visibility they lack, and the improvements that would best support the mission. Progress depends on connecting those decisions so that new controls strengthen protection without creating avoidable disruption.

The discussion closes with a reminder that enterprise identity remains a central priority. Gazlay urges agencies to sustain their efforts in that area even as they address new technologies and operational risks. Across the conversation, the practical direction is consistent: maintain visibility, understand critical assets, establish intentional boundaries, and preserve the ability to respond. Zero trust advances through those connected choices. For government leaders, its value lies in helping agencies contain threats and sustain essential operations as digital and physical systems become more intertwined and adversaries gain new ways to analyze them across their operational environments.

Three Key Takeaways

• Know the environment and its critical assets. Observability and asset awareness help agencies connect vulnerabilities to mission consequences.
• Design containment into operations. Plan segmentation and expected communications early to reduce the difficulty of retrofitting controls around active systems.
• Sustain the fundamentals as threats evolve. Strengthen OT visibility, coordinate with vendors, and continue protecting enterprise identity.

Explore the Ideas Behind the Program

This interview is part of Reimagining Cyber: At Velocity, presented by Booz Allen and inspired by its Velocity magazine. Continue exploring insights on cybersecurity, emerging technology, and federal missions.

Read Velocity at BoozAllen.com/Velocity.

📺 Watch the full program at FedGovToday.com/Velocity.