A recent database incursion exposed coordination gaps between security and operations teams already strained by workforce reductions, an Agriculture Department (USDA) official said Nov. 2, underscoring the need for agencies to strengthen their technical defenses and incident preparedness.
Speaking during a FedInsider webinar on identity security, Rudolf Rojas, USDA IT program manager and security lead, and James Imanian, public sector field strategist at Palo Alto Networks, called for closer connections among security teams, architectural decisions that make agency systems easier to defend, and granular permissions that help artificial intelligence (AI) agents support employees without adding cybersecurity risk.
Database incident exposes coordination gaps
Rojas said an incursion last week affected databases supporting internally and externally facing sites in an externally hosted cloud environment. The incident remains under analysis, he said.
Coordination between security operations and database management teams complicated the response. Rojas said he struggled to identify the right contacts because some employees he previously worked with had left or been affected by workforce reductions.
The experience underscored the need for technical groups to communicate more effectively, use available monitoring tools, and provide regular updates to users about service status and recovery, he said.
Imanian said organizational silos can undermine security even when agencies have tools intended to address the risks. Identity teams and security operations centers need to exchange information in both directions, he said, so senior technology executives aren’t the only officials with visibility across separate teams.
Rethinking architecture to strengthen defenses
Imanian said agencies should revisit architectural assumptions as cloud infrastructure, containers, and hybrid environments change, particularly where compliance decisions still reflect older policies.
Older databases and applications that cannot adequately defend themselves against modern threats may need additional identity security controls and closer human monitoring, Imanian said. Other parts of the environment could operate with greater automation, allowing agencies to concentrate employees’ attention where it is most needed.
The scope of identity security has expanded beyond the relatively small group of administrators traditionally associated with privileged access, Imanian noted. Human users, machine identities, software development processes, and AI agents can all carry permissions that create significant risk, he said.
Agencies need to discover where those identities are used, control their activities, and govern their access, Imanian advised.
USDA’s FY 2024–2026 Data Strategy calls for an enterprise data architecture supporting integration, standardization, and security. The strategy also calls for promoting zero trust across the data analytics portfolio and expanding workforce training.
Using AI with limits on access and autonomy
Rojas said AI capabilities offered by vendors are helping ease some of his workload. He is evaluating how to use those tools for reporting, continuous network monitoring, and managing roles and privileges, while involving more users in learning and applying the capabilities.
USDA’s zero trust work provides a foundation for assigning roles and privileges to AI agents, he said. Rather than relying only on broad administrator or user categories, the department is developing access roles based on what an agent needs to accomplish.
But maintaining human involvement in every effort may be impractical as budgets and staffing shrink.
“I’m beginning to think that we’re going to have to start evaluating not only having a human in the loop for some very important things, but then giving those agents as well the roles and privileges at the minimum level, so that you can keep a human out of the loop,” Rojas said.
Safeguards on AI agents would include continuous monitoring, ongoing risk assessments, and limited permissions that can be renewed, reduced, or eliminated if an agent’s behavior creates problems, he said.
Cloud providers’ tools can help agencies define granular access and place time limits on privileges, Rojas said. Those controls could reduce the need for an administrator to remain involved throughout a project, while still requiring monitoring and reassessment.
Agencies can also make AI workflows more predictable through careful design, constrained models, and human review based on risk, Imanian said. Government customers should challenge vendors to demonstrate how reliably their proposed tools produce the intended outcome, he said.
Rojas said new tools should demonstrate practical benefits and return on investment as USDA works to consolidate data structures and improve the information available to employees and external customers.
Agencies should connect measures such as detection and response times, remediation, and patching to the mission they support, Imanian advised. Other useful indicators include how effectively security teams resolve reports and protect high-value assets.
Rojas called for greater cooperation across agencies and industry as employees work to maintain government services.
“It has to be a collaborative effort,” he said.