We live in a fast-moving environment of evolving business models, cloud adoption, changing workforce dynamics, increased connectivity complexity and more elaborate devices. And despite the advances in cyber security, it seems cybercriminals continue to step up the pace.
So how do cyber security professionals stay ahead of an increasingly sophisticated cyber threat landscape while keeping up with technology that is advancing at a breakneck pace?
Although not a new concept, the latest buzzword in cyber security is Zero Trust Strategies. It seems simple enough – a cyber security strategy based on the maxim ‘Never Trust, Always Verify’. And yet, even the firm where the term originated has trouble with what the definition of Zero Trust actually is.
This doesn’t mean that security leaders aren’t aware that Zero Trust technologies are the way forward when it comes to cyber security. According to IDG’s 2020 Security Priorities study, 40% of the survey’s respondents say they’re actively researching ZT strategies. Another 18% said they’d already deployed ZT solutions, and 10% said their ZT strategy was in the pilot phase.
So what does Zero Trust mean?
Zero Trust is NOT a single plug-and-play, one-size-fits-all solution. Rather, it is a strategic approach to security that challenges the concept that trust is binary or permanent. Traditional models relied on perimeter security (firewalls, etc.) and assumed that anything inside the network is from a trusted source. Only once the transaction has met all interconnected requirements is it allowed to proceed.
With a Zero Trust strategy, this assumption of trust is eliminated. With a Zero Trust security model, every user, device, application and connection are authenticated before being authorised to use any and all access points.
Moreover, it ensures that an interaction meets the conditional requirements of an organisation’s security standards using dynamic policies that rely on context from as many data sources as possible. Only once the transaction has met all interconnected requirements is it allowed to proceed. This step-change embeds the protections that come from enhanced identity validation requirements.
The basic principles of Zero Trust
Least privilege access
According to the 2021 Financial Services Data Risk Report, employees have access to an average of nearly 11 million files the moment they walk in the door. They don’t need access to all that data though. With a Zero Trust model, each user, device or workload is assigned the lowest level of access possible.
Although not the only method, this is often done using automated security software that enables Role-Based Access Control (RBAC) – with the default permissions of all packets, transactions, users and connections being zero access. By doing this, your organisation’s attack surface is minimised as lateral movement across the network is limited.
Micro-segmentation
Segmentation is not an entirely new idea – in the past, network segmentation was defined by hardware. With micro-segmentation, network administrators create policies designed to limit the flow of network traffic between workloads based on a Zero Trust approach.
Critical applications and the most sensitive data were hosted on stronger and more securable network devices. With modern micro-segmentation, virtualisation software is used to create increasingly granular secure zones with their own access permissions and built-in security.
Data usage controls
Using Enterprise Digital Rights Management (EDRM) software, which is a combination of encryption, identity and access management and data usage control tools, network administrators can limit what users can do with a piece of data once they’ve accessed it. ‘User’ in this case refers to a person, a device (including IoT devices), an application or other source.
With EDRM protection policies, content is encrypted and coupled with a secured usage policy that specifies usage permissions such as ‘view only, print, forward, download, edit or save’. These usage permissions increasingly rely on dynamic permissions, such as preventing the copying of previously downloaded data to a USB thumb drive, email or cloud storage app.
Zero Trust strategies are the way forward
Traditional security strategies based on protecting the network perimeter haven’t adapted to change well. This is because they were designed around monolithic endpoint solutions that often don’t integrate well with each other.
With a Zero Trust model, your entire cyber security strategy is designed to be reviewed and optimised on a continuous basis. And that means it is perfectly suited to a digital landscape and malicious threat actors that are evolving, advancing and getting more sophisticated every day.
At the end of the day, a Zero Trust strategy allows the right user who meets the specific conditions to gain the appropriate access to the correct data, no matter where they’re located, how they’re connecting, what device they’re using or the time of day. This is accomplished while keeping them wrapped in a cocoon of security that is designed to make it easier for security professionals to identify, contain and eradicate malicious actors and cyber threats.
