BEFORE ZHERO TRUST
Historically, your organisation may have focused on securing network access with on-premises firewalls and VPNs, assuming that everything within the network was safe. However, as data footprints have expanded to include off-premises locations in the Cloud and across hybrid networks, the Zero Trust security model has evolved to address a wider range of attack vectors more comprehensively.
WHAT IS ZERO TRUST?
Zero Trust security is an IT model that enforces strict identity verification for every individual and device attempting to access resources on a private network, regardless of whether they are within or outside the network perimeter. While Zero Trust Network Access (ZTNA) is the primary technology linked to Zero Trust architecture, the approach itself is comprehensive, encompassing a range of principles and technologies. In simpler terms, traditional IT network security assumes trust for anyone and anything inside the network. Conversely, a Zero Trust architecture trusts no one and nothing by default. Traditional IT security relies on the castle-and-moat concept, where gaining access from outside the network is difficult, but everything inside is trusted by default. The flaw in this approach is that if an attacker breaches the network, they have unrestricted access to everything within. William Shakespeare would undoubtedly have embraced Zero Trust. The playwright astutely understood that kindness does not equate to granting unearned trust. In All’s Well That Ends Well, the famous Bard wrote:
“Love all, trust a few, do wrong to none.”
THREE CORE PRINCIPLES OF ZERO TRUST
Zero Trust is built on three core principles:
Assume breach - Instead of automatically trusting every user who attempts to access the organisation's network, Zero Trust operates on the assumption that any user could be compromised, potentially leading to a data breach.
Verify explicitly - Given the possibility of compromise, Zero Trust requires all human and non-human users to prove their identity before gaining access to the organisation's network. This verification process is required every time access is requested.
Ensure least privilege - After gaining access, users are granted only the minimal level of access necessary to perform their tasks, which helps mitigate the impact of a potential breach.
THE FIVE PILLARS OF ZERO TRUST
When implementing Zero Trust security, organisations must focus on five key pillars, each requiring careful assessment and updates:
Identity - Verify the digital identity of all users, devices, and applications before granting network access. Utilise strong authentication, behavioural analysis, real-time detection, automated remediation, and connected intelligence to monitor and respond to abnormal behaviour.
Device - Maintain a comprehensive inventory of all devices within the network. Ensure these devices are secure, functioning properly, compliant with security standards, and running only approved software before allowing network access.
Network - Segment the network to prevent lateral movement by threat actors. Restrict users’ access to only the specific network segments necessary for their roles, reducing the risk of exposure to sensitive data.
Application and Workload - Limit applications' access to sensitive data and systems, similar to how human users' access is restricted. Regularly audit applications for security updates and monitor them closely to prevent unauthorized access.
Data - Identify and classify data based on its sensitivity. Restrict access to sensitive data to only those users who require it for their roles. Encrypt data both at rest and in transit to protect it from unauthorized access and adhere to least privilege principles in data management.
WHY DO WE NEED ZERO TRUST?
Here are the top 10 reasons why businesses, including SMEs, need a Zero Trust strategy:
Perimeter-Based Security is Ineffective - Traditional perimeter security can't keep up with the complexities of modern enterprises.
Cloud Data Centres Require Shared Responsibility - Cloud environments demand a shared approach to security between providers and enterprises.
Third-Party SaaS and PaaS Applications Can't Be Fully Trusted - Blind trust in third-party applications is risky, necessitating more stringent security measures.
The Internet is an Unsecured Network - The open nature of the internet means it cannot be relied upon for secure communication.
Expanding Workforce Shouldn't Have All-Access - Not every employee needs access to all resources, especially as the workforce grows.
WFH Environments Lack Universal Security - It's impossible to ensure that all work-from-home environments are secure.
BYOD is Less Secure than Work Devices - Personal devices introduce more security vulnerabilities than managed work devices.
Cyberattacks Are Increasing - The frequency and severity of cyberattacks are on the rise.
APTs Are Becoming More Sophisticated - Advanced Persistent Threats are evolving, making them harder to detect and mitigate.
Security Stakes Are Higher - The potential damage from security breaches is greater than ever, demanding a robust defence.
WHO NEEDS ZERO TRUST?
As we said, legacy security solutions are not equipped to support a Zero Trust network. These outdated systems are limited in their ability to handle cloud security because they rely on a closed perimeter model. This model assumes that all applications are delivered from a single network location and that all users access these applications from a central enterprise entry point. With Zero Trust security in place, we can secure access from any location, on any device our colleagues choose to use. Security is further enhanced by integrating access management as the foundation of the Zero Trust architecture, creating an extended Zero Trust ecosystem. This architecture verifies at both the device and application levels, regardless of the device, network, or how frequently the user switches between applications. Whether you’ve already started implementing Zero Trust architecture or are simply exploring the concept, the Microsoft Zero Trust Maturity Assessment Quiz can help identify potential vulnerabilities within your organisation taking into account identities, endpoints, apps, infrastructure, data and network. You can then decide on the best strategies you can use to implement the Zero Trust model.
SMES AND ZERO TRUST
SMEs may find the whole concept of Zero Trust overwhelming, let alone its implementation. It does have to be. You can focus on these seven steps to point your small to medium sized enterprise in the right direction:
Take stock of digital assets
Focus on identity and access management
Enable Multi-Factor Authentication (MFA)
Use strong passwords and password managers
Prioritise Mobile Device Management (MDM)
Reduce your attack surface
Prioritise patch management
WHAT WILL ZERO TRUST DO FOR ME?
Your business can benefit from Zero Trust which it can help you achieve more with fewer resources, allowing you to move forward confidently:
Enhancing productivity in remote or hybrid work environments.
Minimising or preventing business damage from breaches.
Safeguarding sensitive business data and identities.
Proactively ensuring compliance with regulatory requirements.
Allowing Zero Trust to handle security so your organisation can focus on innovation.
HOW DO WE IMPLEMENT ZERO TRUST ARCHITECTURE?
You can use these steps as a guide to implement your first Zero Trust strategy:
Assess your environment - Examine your network infrastructure, applications, and data to identify potential vulnerabilities.
Identify critical assets - Determine which data, applications, and services are most valuable and essential to your network. This will help you prioritise where to start and develop appropriate security policies.
Define the attack surface - Identify sensitive data, assets, applications, and services within your framework to ensure that your most critical resources are protected.
Create policies - Understand which areas require protection and the level of security needed to safeguard traffic flow.
Establish an identity and access management (IAM) programme - Define user roles and permissions, implement multi-factor authentication, and enforce strong password policies.
Monitor your network - Implement monitoring and alerting tools to gain visibility into your system and ensure that security policies are enforced and effective.
Continually monitor, update, and improve - Zero Trust is an ongoing process that demands regular monitoring, updates, and improvements. Technologies like XDR can assist by verifying devices, preventing attacks, and auditing the Zero Trust architecture.
CYBER LONDON AND ZERO TRUST
Cyber London is at the heart of technologies that will be in demand over the next few years. We work with our strategic partners to promote technological innovation in the UK capital and beyond, identifying opportunities for collaboration, inward investment and ongoing support to put London at the forefront of technology. On Zero Trust, one of our Directors and Co-Founders, Professor Raj Muttukrishnan, tells us:
“With the increasing challenge of data loss in recent times it’s important to continuously authenticate the users so that the data is safe at rest and in transit. Zero Trust provides the additional layer of security to continuously check the access privileges. However, it comes with its own challenges as many of the devices are pervasive in modern IT infrastructures and mobile hence making it harder to apply the perimeter-based security techniques. New technologies using devices unique fingerprints and channel/Wi-Fi features can be used to develop novel continuous authentication schemes which can be useful to mitigate automated bot attacks and AI-based attacks on future pervasive environments.”
To get involved, contact us or become a Cyber London member today.
Comments