In its new zero trust guide for operational technology systems the National Security Agency outlined 84 activities that organizations can take to protect critical infrastructure.
NSA says the moving OT systems to a zero trust architecture is more important than ever as nation states and hacktivists are targeting water, power and other critical infrastructure systems.
The Coast Guard knows this threat first hand as it’s protecting OT systems on land and at sea at more than 1,500 locations across the globe. In August, it worked with the FBI and other federal cyber experts to investigate possible foreign cyber actors targeting ships operating in U.S. waters.
Capt. Patrick Thompson, the technical director of infrastructure at the Coast Guard, said the service’s new zero trust task force is providing a focused group of experts to tackle this growing challenge.
“This is all they’re doing. They’re really attacking these very complex, logistically challenging issues that are simple at a small scale, but not at the scale that we operate as a large military organization,” Thompson said after speaking at the recent ATARC Cyber Summit. “If you look at updating a router, we have team members who know how to update routers. What we don’t have is a logistics cell that is managing updating routers on 300 ships globally, managing their import schedules, when are they getting underway, how that changes on a regular basis, coordinating travel for all those personnel to do that, getting the hardware procured, shipped and configured ahead of time. That’s really where this team is focused. They understand what they need to do. They need to do it at scale.”
Scale is one of many challenges around OT systems. NSA says in its cybersecurity information sheet that there are 26 high-impact activities that organizations can implement now as part of moving toward a zero trust architecture. NSA says by prioritizing key measures to secure remote access, harden smart controllers, enhance visibility and enforce micro-segmentation, organizations can disrupt attacks on industrial control systems. NSA also says by implementing zero trust principles such as complex passwords, multifactor authentication and the continuous verification of users and devices, organizations can disrupt attackers.
The scale and complexity of OT systems is part of the reason why the Coast Guard is putting the task force in charge of its migration. Thompson said the service, like many agencies, has been on the ZTA journey for some time. But the oversight and management of zero trust tools and capabilities fell under different parts of the organization.
Creating a foundation to modernize apps
Thompson said the task force is focused on the requirements laid out by the Defense Department and the Office of Management and Budget to meet the September 2027 deadline.
“We have to go to a more modern identity management solution for 300 applications. Who’s coordinating across our entire organization so every single app owner clearly understands what their responsibilities are, their personnel training, and whether they filled out all the forms and all the paperwork required with DoD to get onboarded into the new systems?” he said. “We’re a little bit behind and we’re trying to play catch up. We’re trying to evolve an organization that is financially challenged as well. We’re having to reprioritize some initiatives that people were not anticipating two or three years ago during the normal budget cycle, so that’s always a challenge. But I think we’re attacking it in a holistic manner. We understand which apps are the most important for us to modernize quickly, and which ones that we may try to combine with other apps. We may just get rid of them. It’s really giving us a chance to look back internally at ourselves and assess what are our organizational priorities, and making sure that we secure those ones that are necessary for our mission effectiveness.”
Among the task force’s top priorities is setting up and ensuring the zero trust foundation is set so those 300 applications can take advantage of the security tools.
“We’ve been focused on getting our software-defined wide-area network (SD-WAN), our security and our identity management done. I think the real value proposition is that when, once you have a super strong security foundation, the applications you develop can have new enabling technologies that you were not able or did not feel comfortable enabling before. To do that, we’ve looked at a lot of the applications that are legacy applications, and almost all of them need to be significantly modernized onto new modern like cloud-based platforms. We’re looking at that,” he said. “One aspect of it is making sure we have the contractual vehicles that allow us to pivot and move well. We’ve partnered with some of our General Services Administration vehicles to do that, and we’ve recently enabled those. We’re starting to onboard those personnel. They’re starting to build out the environment so that we can start to modernize our apps faster.”
Thompson said one of the ways the Coast Guard is addressing their legacy applications is through the use of low-code, no-code platforms. He said recently the service modernized an application in three weeks instead of the one-to-two years many were expecting, which surprised many in leadership.
“I think everyone’s very excited about that because the user interface and everything on the new modern apps is much more intuitive, and I think it is just better overall,” he said. “Zero trust has been the kind of thing that’s been pushing us along and driving us. But I think the end result is that we’re going to end up with a better IT environment, a better Coast Guard, a much more effective and efficient workforce.”
Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.