Posted on August 3, 2018
A Zero Trust security strategy adopts a mindset of ‘we don’t trust anybody’. It is built on the belief that both internal and external networks cannot be trusted and therefore relies on extensive authentication and authorisation processes dotted throughout an existing infrastructure to add multiple layers of security.
There has been a significant increase in the number of high profile cyber attacks over the years. Cybercrime dominates the news and 76% of UK business leaders say cybersecurity is the second biggest risk they face today. The biggest problem with tackling cybercrime is that threats are constantly evolving which makes it very difficult for businesses to secure their networks. Whilst no business can ever be 100% secure having the right measures in place to protect against the most persistent threats can pay dividends.
Traditionally businesses have relied upon VPNs, Firewalls, web gateways to provide a sufficient level of IT security, however this model is no longer working and persistent hackers are constantly finding ways to penetrate an organisation’s network. This is where the Zero Trust model comes into play.
Zero Trust is designed to recognise and verify every server, application, device and application that may access sensitive information. It also uses machine learning to understand user behaviour. For example, if a user always logs in at a certain time of the day and then suddenly logs into the network at a different time on an unfamiliar device this model would use extra authenticity to verify the user, or if necessary block the access completely. Using the ‘always verify’ approach adds an additional layer of security and protection that isn’t always there with a traditional security approach.
Using a Zero Trust model is a good opportunity to re-examine your existing policies. Your new policies can incorporate any new infrastructure changes, for example, include new cloud services, web application and platforms that you may use within your organisation. Identifying zero trust controls within your policies will allow you to carefully scrutinise how your users are using your network and will help you to identify new ways to increase your cyber-security defences.
In order to implement a Zero Trust model, you need to have a detailed inventory of every device, network, connections and servers, and applications that access your network. Once you have a detailed inventory database you can assign authorisation status to each asset. For example, whether or not a user needs verification to access a web application.
Zero Trust is based on constant verification. Using machine learning and authentication processes allows for you to limit and control who has access to what. Ask yourself questions like: If my network was attacked, what would they have access to? Or would information would an attacker have access to if a user lost their work device? What authentication is there to stop instant access?
A Zero Trust security model is not a new concept but one that is building momentum as traditional methods of securing your business are not robust enough to protect against the latest threats. We have partnered with Centrify to offer our clients a zero trust security approach using next-generation access.
“Centrify utilises machine learning to discover risky user behaviour and apply conditional access- without impacting user experience.”
Contact one of our sales team today to talk about how you can implement a Zero Trust Security strategy into your organisation on 01344 758700.