What Changed
Sen. Ron Wyden has called for federal agencies to eliminate legacy remote access gateways and perimeter entry points within two years, proposing that CISA and the NSA enforce this transition by 2028. His letter to the Office of Management and Budget, CISA, and NIST follows a series of nation-state attacks targeting network edge devices, including the Arcane Door campaign against Cisco devices, FortiBleed credential harvesting targeting Fortinet systems, and breaches affecting Ivanti and Check Point infrastructure.
Wyden's proposal extends beyond a simple technology refresh. He wants NIST to publish zero trust implementation standards that mandate outbound-only remote access architecture, memory-safe programming languages, and decentralized encryption key management to isolate agencies from third-party breaches.
This isn't theoretical. A March VulnCheck report found that roughly 42% of vulnerabilities exploited last year affected devices that are end of life or likely end of life. Your perimeter is where attackers start, and legacy edge devices give them administrative access to target networks.
Key Findings
Network edge devices create persistent initial access vectors. These devices are high-risk because they lack endpoint security protections, receive sporadic updates, and contain exploitable vulnerabilities. Unlike workstations or servers behind your firewall, these public-facing systems are directly exposed to reconnaissance and exploitation attempts. When an attacker compromises an edge device, they often gain administrative credentials that let them move laterally through your network.
The "whack-a-mole" cycle wastes resources without reducing risk. Wyden's letter describes federal agencies trapped in endless reactive patching as new vulnerabilities emerge in legacy remote access technologies. You patch one CVE, another surfaces. You update firmware, a zero-day appears. This cycle consumes security team capacity without addressing the architectural problem: public-facing servers that adversaries can discover and target.
Zero Trust Architecture eliminates the exposed server model. Modern remote access alternatives use outbound-only connections, meaning your internal systems initiate connections to a cloud-based control plane rather than listening for inbound traffic. This architectural shift removes the attack surface that makes edge devices attractive targets. There's no public IP to scan, no login portal to brute-force, no unpatched service waiting for exploitation.
Memory-safe languages and decentralized key management reduce blast radius. Wyden's proposal includes specific technical safeguards beyond basic zero trust principles. Memory-safe programming languages (Rust, Go, Swift) eliminate entire classes of vulnerabilities like buffer overflows that attackers exploit in C and C++ codebases. Decentralized encryption key management means a breach at a third-party vendor doesn't compromise your agency's data, because you control your own keys.
The two-year timeline is aggressive but feasible. A 2028 deadline for removing legacy remote access gateways gives agencies 24 months to plan, procure, and migrate. That's tight for large federal departments with complex networks, but it's not impossible if you start architectural planning now rather than waiting for NIST standards to finalize.
What This Means for Your Team
If you're managing cybersecurity for a federal agency, you're about to face a mandate. If you're in the private sector, you're watching a preview of where regulatory expectations are heading.
Zero Trust Architecture isn't just about replacing VPNs with software-defined perimeters. It's a fundamental shift in how you verify identity, enforce access policies, and segment networks. The NIST Cybersecurity Framework (CSF) 2.0 already emphasizes continuous verification and Principle of Least Privilege. Wyden's proposal would codify specific implementation requirements that go beyond framework guidance.
Your current edge devices represent technical debt that's about to come due. Every firewall, VPN concentrator, and remote access gateway running on end-of-life hardware or software is a liability. The VulnCheck data shows attackers actively exploit these systems because they know many organizations can't patch fast enough or migrate away from unsupported platforms.
The shift to outbound-only architecture requires rethinking network design. You can't just swap out a VPN appliance for a zero trust product and call it done. You need to map every remote access use case, identify which applications and data each user population needs, and design policy enforcement points that verify identity and device posture before granting access.
Action Items by Priority
Inventory your current edge devices and remote access technologies. Document every VPN, firewall, load balancer, and gateway that accepts inbound connections from the internet. Note vendor, model, firmware version, end-of-life status, and which user populations depend on each system. This inventory becomes your migration roadmap.
Assess which systems are end-of-life or approaching end-of-sale. Cross-reference your inventory against vendor lifecycle announcements. Systems already past end-of-life should move to the top of your replacement list. Systems approaching end-of-sale in the next 12-18 months need migration plans before support windows close.
Map remote access use cases to zero trust requirements. For each user population (employees, contractors, partners, administrators), document what resources they access, from where, using what devices. This mapping reveals which zero trust controls you need: device posture checks, conditional access policies, micro-segmentation rules, privileged access workflows.
Evaluate zero trust vendors against outbound-only architecture requirements. Not all products marketed as "zero trust" eliminate the exposed server model. Specifically ask vendors: Does this require any public-facing IP addresses? Can users initiate connections without inbound firewall rules? How does the control plane authenticate devices before granting access?
Pilot memory-safe language adoption in custom applications. If your agency develops custom remote access tools or security software, start transitioning new development to Rust, Go, or Swift. You won't rewrite everything overnight, but establishing coding standards now prevents accumulating new technical debt in unsafe languages.
Plan for decentralized key management in vendor relationships. Review contracts with cloud service providers and SaaS vendors. Ensure you control encryption keys for sensitive data rather than relying on vendor-managed keys. This protects you if a vendor suffers a breach or receives a government data request.
Monitor NIST for zero trust implementation standards. Wyden's letter requests NIST publish specific standards. Once published, these will likely reference NIST SP 800-207 (Zero Trust Architecture) and SP 800-53 controls, but with more prescriptive technical requirements. Track public comment periods and draft releases so you can align your program before mandates take effect.
