Zero Trust - The New Standard Of Security

The traditional approach to computer security has long been based on perimeter defences being designed based on threat intelligence about the most likely attackers targeting a network or organization. 

These approaches have begun to struggle when faced with new types of attacks and evolutions in the threat landscape. Perimeter-based defences, such as firewalls or signature-based antivirus software are no longer sufficient to protect networks.

A Zero Trust security system is an approach to the design and implementation of information security systems that assume every user, device or application accessing an IT system is untrusted and must be treated with the same level of scrutiny. 

How can organisations adopt Zero Trust security principles?

Rolling out Zero Trust across an entire organisation requires control over identities, devices, applications, data, infrastructure and networks. Zero Trust is not a single product or appliance to buy, but an ideology of security. It involves pulling the traditional perimeter back and combining traditional network access controls with user behaviour analytics (UBA) and micro-segmentation.

If you are planning on adopting Zero Trust initiatives in your organization, this is what you need to take into account:

Identities:    Strong identities are a fundamental part of Zero Trust, and they’re critical for establishing trust and access within the environment. Strong identities are also important for supporting a Zero Trust framework because they are the basis of verifying users before accessing systems. One method of enabling strong identity is to leverage multi-factor authentication methods such as two-factor (2FA) or mobile authentication.

Multifactoral Authentification:    Multifactor or continuous authentication is not a single approach, but several methods that can be deployed together to add levels of trust on top of an identity framework. The three basic approaches to authentication are:

  • Single-factor authentication (SFA): This is based on something you know, such as a user ID and password or PIN. It’s the most common authentication method used today
  • Multi-factor authentication (MFA): This is based on something you have, such as a security token, smart card or mobile device. MFA can be combined with SFA.
  • Continuous Authentication (CFA): This is a method of confirming identity in real-time. It's accurate, convenient and prevents attacks that have been successful in the past because it doesn’t rely on static data. 

MFA and CFA are recommended levels of security within a Zero Trust framework.

Passwordless Authentication:   We recommend methods of passwordless authentication to our clients such as the YubiKey. The Yubikey is a hardware-based device that replaces passwords. It’s a durable, inexpensive and convenient method of strong authentication that can also be used as a USB HID device or NFC.

Network Segmentation:    Network segmentation and the ability to implement network controls allow for traffic policy to be implemented for each department and application. By taking advantage of micro-segmentation, a network can introduce finer levels of granular controls within the firewall or perimeter to limit access, protect against denial-of-service attacks, etc. NetSeg is a framework that enables this type of authentication framework in open source systems.

Secure ALL devices on your network:   Allowing unaudited and unpatched devices onto your network has the potential to cause a lot of damage. In the past, it was fairly easy to block all devices that weren’t part of your network policies, but today’s world involves BYOD (Bring Your Own Device) and other scenarios where users and vendors connect new or unapproved devices to the network regularly. View every user device as a potential threat and limit access to sensitive resources.

Be specific with user roles and access:   Security control should become an integral part of organisational policy. Roles and access should be as granular as possible, with clear definitions for each role. For a good example of this framework in action, take a look at AWS’s Identity and Access Management (IAM) framework. It has become one of the best examples of an effective identity framework thanks to its clear separation between roles and privileges.

If you do plan on adopting Zero Trust initiatives in your organization then bear in mind the following advice: A Zero Trust framework isn't something that can be implemented overnight. Ensure you start in a test or development environment, and once the Zero Trust model has been successfully established, aim to implement it to your entire digital architecture.

Charles Griffiths is  Head of IT and Operations at AAG-IT.com                            Image: Unsplash

You Might Also Read: 

The Costs Of A Data Breach:

 

« Securing Hybrid Workplaces From Attack
Russian Trolls Target News Websites »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Evidian

Evidian

Evidian, a Bull Group company, is the European leader and one of the major worldwide vendors of identity and access management software.

Anomali

Anomali

Anomali delivers intelligence-driven cybersecurity solutions to enhance threat visibility, automate threat processing and detection, and accelerate threat investigation, response, and remediation.

New Zealand Internet Task Force (NZITF)

New Zealand Internet Task Force (NZITF)

The New Zealand Internet Task Force (NZITF) is a non-profit with the mission of improving the cyber security posture of New Zealand.

GuardianKey

GuardianKey

GuardianKey is a solution to protect systems against authentication attacks.

Swiss Cyber Think Tank (SCTT)

Swiss Cyber Think Tank (SCTT)

The Swiss Cyber Think Tank is a business network for Cyber Risk & Insurability, providing an industry-wide networking platform for insurers, technology and security firms.

Computer Network Defence (CND)

Computer Network Defence (CND)

Computer Network Defence (CND) are a Broad-Spectrum Cyber Security Consultancy and Recruitment Agency.

DataDome

DataDome

DataDome offers real-time AI protection against all OWASP automated threats, including credential stuffing, layer 7 DDoS attacks, SQL injection & intensive scraping.

X-Ways Software Technology

X-Ways Software Technology

X-Ways provide software for computer forensics, electronic discovery, data recovery, low-level data processing, and IT security.

Artjoker

Artjoker

Artjoker is a full cycle software development partner specialized in Blockchain projects and smart contract development including full cycle information security of all projects.

HCS

HCS

HCS is an IT Company and Telecoms provider with an experienced team who are dedicated to ensuring our clients business systems are protected.

D.med Software

D.med Software

D.med Software is a company with a focus on cybersecurity for embedded software and cloud applications for the medical industry.

Gogolook

Gogolook

Gogolook is a leading TrustTech company. With "Build for Trust" as its core value, it aims to create an AI- and data-driven global anti-fraud network as well as Risk Management as a Service.

Star Lab

Star Lab

Star Lab specializes in the development and productization of embedded security technologies.

System Two Security

System Two Security

System Two Security automates detection engineering and threat hunting.

Aprio

Aprio

Aprio is a premier business advisory and accounting firm. We deliver advisory, tax, managed, and private client services to build value, drive growth, manage risk, and protect wealth.

CheapSSLWEB

CheapSSLWEB

CheapSSLWeb.com is an affordable and trusted SSL/TLS certificate provider from globally recognized CA (Certificate Authority) Comodo, Sectigo, and Certera..