What You See Is What You Secure With Zero Trust

Every day, Rudolf Rojas, an IT manager at the U.S. Department of Agriculture (USDA), pulls up his dashboards and watches malicious bots and automated tools ping the department’s websites and networks. It’s a sobering sight, but it’s also a reassuring one, because his team can see it happening.  

During a recent GovLoop webinar on securing operational technology (OT) in the AI age, Rojas credited three things for keeping the USDA free of catastrophic breaches so far: that view, a strong Zero Trust foundation, and regular disaster recovery drills.

I joined Rojas on that panel, along with experts from Netskope and the U.S. Department of Transportation. His story shows what good looks like, because his team works from a live view of the network.

That kind of view is harder to come by than it should be. During my 10 years as a federal CIO, teams brought me neat diagrams of their networks, but the real environment rarely matched the picture. As IT and OT networks merge and AI speeds up every attack, that gap matters more than ever.

Zero Trust starts with network visibility: a real-time view of what’s talking to what. When security teams can see real connections as they happen, they can control them. That’s how they contain a breach before it spreads.

Why attackers understand your network better than you do

I hate breaking this news to customers, but attackers often understand how an agency’s systems connect better than the agency does. They land on one workload, look around, and follow whatever paths are open.

In fairness to OT teams, IT teams have the same problem. It’s hard to track which applications reach into the OT environment, what’s talking inside it, and what’s talking to the outside world.  

As Kevin Sanchez-Cherry from the Department of Transportation pointed out on the panel, a diagram nobody updates is a snapshot of the past. It can’t tell you what’s happening on the network right now.

How IT/OT convergence made network visibility harder

OT security used to depend on isolation. Today, agencies connect control systems to cloud analytics, give vendors remote access, and feed plant data into enterprise reports. Those are good mission choices, but each adds a connection that may never reach the diagram.

OT also can’t modernize at the pace of IT. Systems built into pumps and manufacturing equipment often need a full redesign to change, so OT keeps falling behind while the paths into it keep growing. A vendor on a flat VPN, for example, can end up with a route to the whole plant network when it only needs one device.

AI makes attacks faster, so your view has to be live

AI will help defenders, but I believe it’ll help attackers more. We’ll see more breaches, and they’ll happen faster.  

Still, AI doesn’t change the physics of an attack. An attacker has to compromise a workload and then move from one system to the next over the network.

That’s why your view of those connections has to be near real time. AI can help here, too, by sifting through the flood of alerts so your people can focus on judging what matters to the mission.

Turning network visibility into breach containment

Once you can see the real connections, you can start cutting them back. Allow only the traffic each application or OT system truly needs, and turn everything else off.  

That’s least-privilege access, the principle at the heart of Zero Trust. Zero Trust sets the strategy, and microsegmentation enforces it one connection at a time.

Start at the seam between IT and OT, where attackers love to cross. You can govern that boundary without touching fragile OT devices. Done well, this keeps ransomware on the corporate network, and the plant keeps running while IT recovers.

Zero Trust network visibility can’t wait

Breaches are going to happen, so every security leader should be asking how far they’ll spread. Every week your diagram goes without an update, the gap between the network you think you have and the one attackers are mapping grows wider.  

As AI shortens the time between first access and lateral movement, that gap gets more expensive to close.

Rojas’ team watches the bots arrive every day. That real-time view is what lets them decide what gets through. Build the same live map of your IT and OT networks, and microsegmentation can do the rest. When a breach hits, it stays small.