Zero Trust - The New Standard Of Security

The traditional approach to computer security has long been based on perimeter defences being designed based on threat intelligence about the most likely attackers targeting a network or organization. 

These approaches have begun to struggle when faced with new types of attacks and evolutions in the threat landscape. Perimeter-based defences, such as firewalls or signature-based antivirus software are no longer sufficient to protect networks.

A Zero Trust security system is an approach to the design and implementation of information security systems that assume every user, device or application accessing an IT system is untrusted and must be treated with the same level of scrutiny. 

How can organisations adopt Zero Trust security principles?

Rolling out Zero Trust across an entire organisation requires control over identities, devices, applications, data, infrastructure and networks. Zero Trust is not a single product or appliance to buy, but an ideology of security. It involves pulling the traditional perimeter back and combining traditional network access controls with user behaviour analytics (UBA) and micro-segmentation.

If you are planning on adopting Zero Trust initiatives in your organization, this is what you need to take into account:

Identities:    Strong identities are a fundamental part of Zero Trust, and they’re critical for establishing trust and access within the environment. Strong identities are also important for supporting a Zero Trust framework because they are the basis of verifying users before accessing systems. One method of enabling strong identity is to leverage multi-factor authentication methods such as two-factor (2FA) or mobile authentication.

Multifactoral Authentification:    Multifactor or continuous authentication is not a single approach, but several methods that can be deployed together to add levels of trust on top of an identity framework. The three basic approaches to authentication are:

  • Single-factor authentication (SFA): This is based on something you know, such as a user ID and password or PIN. It’s the most common authentication method used today
  • Multi-factor authentication (MFA): This is based on something you have, such as a security token, smart card or mobile device. MFA can be combined with SFA.
  • Continuous Authentication (CFA): This is a method of confirming identity in real-time. It's accurate, convenient and prevents attacks that have been successful in the past because it doesn’t rely on static data. 

MFA and CFA are recommended levels of security within a Zero Trust framework.

Passwordless Authentication:   We recommend methods of passwordless authentication to our clients such as the YubiKey. The Yubikey is a hardware-based device that replaces passwords. It’s a durable, inexpensive and convenient method of strong authentication that can also be used as a USB HID device or NFC.

Network Segmentation:    Network segmentation and the ability to implement network controls allow for traffic policy to be implemented for each department and application. By taking advantage of micro-segmentation, a network can introduce finer levels of granular controls within the firewall or perimeter to limit access, protect against denial-of-service attacks, etc. NetSeg is a framework that enables this type of authentication framework in open source systems.

Secure ALL devices on your network:   Allowing unaudited and unpatched devices onto your network has the potential to cause a lot of damage. In the past, it was fairly easy to block all devices that weren’t part of your network policies, but today’s world involves BYOD (Bring Your Own Device) and other scenarios where users and vendors connect new or unapproved devices to the network regularly. View every user device as a potential threat and limit access to sensitive resources.

Be specific with user roles and access:   Security control should become an integral part of organisational policy. Roles and access should be as granular as possible, with clear definitions for each role. For a good example of this framework in action, take a look at AWS’s Identity and Access Management (IAM) framework. It has become one of the best examples of an effective identity framework thanks to its clear separation between roles and privileges.

If you do plan on adopting Zero Trust initiatives in your organization then bear in mind the following advice: A Zero Trust framework isn't something that can be implemented overnight. Ensure you start in a test or development environment, and once the Zero Trust model has been successfully established, aim to implement it to your entire digital architecture.

Charles Griffiths is  Head of IT and Operations at AAG-IT.com                            Image: Unsplash

You Might Also Read: 

The Costs Of A Data Breach:

 

« Securing Hybrid Workplaces From Attack
Russian Trolls Target News Websites »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall And Why Does It Matter

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall And Why Does It Matter

See how to use next-generation firewalls (NGFWs) and how they boost your security posture.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

National Centre of Incident Readiness & Strategy for Cybersecurity (NISC) - Japan

National Centre of Incident Readiness & Strategy for Cybersecurity (NISC) - Japan

NISC was established as a secretariat of the Cybersecurity Strategy Headquarters in collaboration with the public and private sectors to create a "free, fair and secure cyberspace" in Japan.

Soracom

Soracom

Soracom offers secure, scalable, cloud-native connectivity developed specifically for the Internet of Things.

Mission Secure (MSi)

Mission Secure (MSi)

MSi is a specialized provider of next generation cyber defense solutions protecting control systems and critical physical assets in energy, transportation and defense.

C3.ai

C3.ai

The C3 AI Suite supports configurable, pre-built, high value AI applications for predictive maintenance, fraud detection, anti-money laundering, sensor network health and more.

GoCyber

GoCyber

GoCyber is a new, highly innovative cyber security training app that uses action based learning to significantly improve the online behaviour of all employees in less than a month.

Quantstamp

Quantstamp

Quantstamp are experts in Smart Contract Security Audits. We provide verification that your decentralized system works as intended.

Security Innovation Network (SINET)

Security Innovation Network (SINET)

SINET is dedicated to building a cohesive, worldwide Cybersecurity community with the goal of accelerating innovation through collaboration.

BoldCloud

BoldCloud

BoldCloud's award winning Cybersecurity Advisory services and Layered Security approach adds new critical layers of protection for your data and your business.

Clario Tech

Clario Tech

Clario is a simple, comprehensive, personalized protection app. It comes with a full suite of intelligent security software and intelligent people to help you live a better, safer digital life.

Siege Technologies

Siege Technologies

Siege Technologies is a pioneer of multi-purpose cybersecurity products and services that enable customers to leverage both offensive and defensive technologies.

Com Olho

Com Olho

Com Olho provides the measurement, analytics, quality assurance, and fraud protection technologies brands need for their business and customers.

Moore ClearComm

Moore ClearComm

Moore ClearComm is part of Moore Kingston Smith a leading UK firm of accountants and business advisers. Our services include Data Privacy, Cyber Security, Business Continuity and Information Security.

UK Cyber Cluster Collaboration (UKC3)

UK Cyber Cluster Collaboration (UKC3)

UKC3 has been launched to support Cyber Clusters and encourage greater collaboration across regions and nations of the UK.

Varutra Consulting

Varutra Consulting

Varutra Consulting is an Cyber Security Consulting, Solutions and Training services firm, providing specialized security services for software, mobile and network.

NewEvol

NewEvol

Don’t React, Evolve! Outsmart threats with real-time AI-powered dynamic defense capability of NewEvol all-in-one cybersecurity platform.

HTX (Home Team Science & Technology Agency)

HTX (Home Team Science & Technology Agency)

HTX brings together science and engineering capabilities to transform the homeland security landscape and keep Singapore safe.