What’s your network’s weakest link? The answer is simple: your users.
That’s why there’s a lot of talk about Zero Trust security.
It seems it is on everyone’s radar right now. But what does it actually mean?
“Don’t trust those on the other side!”
“Don’t trust any precautions!”
“Don’t trust anyone!”
… or something else?
All of the above answers are valid on their own.
But Zero Trust security refers specifically to the way you set up your IT environment. And from this point of view, Zero Trust means “I don’t trust this user, on this device, accessing this resource”.
Ok, that’s quite specific, so let’s unpack it.
It’s a type of security approach that assumes risk coming from the inside of your environment, just as much as the outside.
Security is no longer a single-action process, where you allow a user to access a resource, and things end there. On the contrary – here, security measures are enforced constantly.
More importantly, you don’t use the same processes for everyone. Every user has a different risk profile, depending on their permissions (e.g. standard vs administrator), device (laptop vs mobile), location, etc., and what they access.
This ecosystem is then divided into segments, each with its own policies and services for protecting it. But you still need to monitor the whole, gather all the signals, and have these services perform automatic actions to keep the entire environment secure.
This evaluation is a constant process on every access to the resource, be it file or application, and in the context of each resource. I as a user reading a file is much different than I as a user with Global Admin rights reading the file.
What we need here is a constant loop feeding the information in a cycle of “Observe – Orient – Decide – Act”, supported by technology. Here are the two latest things added to this process:
We got to the point where technology delivers. Now it is your move.
Every user is an entry point to your network. It’s no longer just the firewall or the access ports. Any user on your network, accessing one of the gazillions of apps on the internet, creates a potential vulnerability.
At this point, many companies (94% according to Microsoft Digital Defense Report 2020) are now stepping up their game and implementing the Zero Trust approach. If you haven’t looked at it yet – now is the time to get started.
To apply Zero Trust principles, you need to introduce protection across four areas:
If you’d like to know more, here are some resources to get you started:
There’s a lot more we could discuss on this topic. What do you think about it? Have you got any questions? Let me know and I’ll include it in the next post.
Sometimes it feels like I'm pushing too much with security and software development, but then you prove me wrong. Rec...
We talk a lot about perimeter security, zero trust, etc. And there’s a good reason for it. Malware attacks don’t jus...