By Adam Case ( Technical Offering Manager – Cloud Identity, IBM Security )
Risk never sleeps. As mobile devices flood the enterprise (especially for a younger generation of workers), the Internet of Things (IoT) expands, and cybercriminals grow in both numbers and sophistication, many security professionals think Zero Trust is the safest approach to defending against constantly evolving network and data security threats.
Network vulnerabilities can be found in the most unlikely places. Bloomberg Businessweek, for example, described a case in which an internet port in a hotel room’s motorized, remote-control curtains offered access to the hotel’s internal computer systems. Fortunately, a cybersecurity contractor discovered that particular security gap during an audit, but the lesson rings true: In today’s connected world, unlocked doors, backdoors and trap doors could be almost anywhere.
What Is Zero Trust Security?
The term Zero Trust was coined by John Kindervag, an analyst at Forrester Research, in 2010 when the model for the concept was first presented. A few years later, Google announced that they had implemented Zero Trust security in its network, which led to a growing interest in adoption within the tech community. ZT further gain traction when in 2013, Forrester Research submitted a report submitted to the National Institute of Standards and Technology (NIST) seeking input from technology experts as part of a U.S. government cybersecurity initiative. Forrester, citing a new environment in which “changes like mobility and big data have made ‘building stronger walls’ an expensive farce that will not adequately protect networks,” introduced the concept of Zero Trust, urging organizations to “make security ubiquitous throughout the network, not just at the perimeter.”
Achieve Zero Trust Security in 3 Steps
According to Forrester, organizations should ideally rebuild their networks “from the inside out,” starting with the “system resources and data repositories that we need to protect as well as the places where we need to be compliant.” However, while rebuilding the network may be a desirable long-term goal, there are myriad ways organizations can gain the benefits of zero trust without embarking on a project of that magnitude.
Here are three steps you can take to introduce zero trust security principles into your organization.
1. Strengthen Identity Validation
Although passwords are the first line of defence for most networks, 59 percent of users have the same password for multiple accounts — and it’s a good bet that the remaining 41 percent vary their passwords by only a few characters. Identity and Access M
2. Segment Sensitive Data
Segmenting or microsegmenting your network enables you to keep large portions of the network safe in the event of a breach, thereby minimizing the damage. The human resources system, for example, is an obvious choice since it contains Personally Identifiable I
3. Scrutinize Access Behaviours
In addition to guarding the network, an effective zero trust strategy includes monitoring access behaviour and using analytics to search for patterns and trends. Analytical tools, tracking access behaviour, and identifying patterns, trends and potential threats can reinforce data privacy — supporting compliance and increasing customer confidence.
The Success of Your Business Is at Stake
A network data breach puts not only customer information, such as credit card numbers but also the corporate intellectual property, employee records and more at risk. In addition to financial damage, loss of reputation and customer confidence — as well as potential legal liability if a breach is found to violate the General Data Protection Regulation (GDPR) or other privacy laws — are at stake.
Malicious hackers never rest, but neither do the good guys on corporate cybersecurity teams. The Zero Trust approach offers a myriad of weapons for the fight.
To learn more, listen to the SecurityIntelligence podcast, “Zero Trust and the Evolving Role of Identity and Access Management.”