Zero Trust - Now More Important Than Ever

The cyber threat landscape is changing

So far in 2022, 39% of UK businesses have reported suffering a cyber attack. Changes in the workplace mean that more employees are connecting to office networks remotely and using personal electronic devices for work purposes. This opens up new vulnerabilities that cyber criminals can exploit.

With 81% of FTSE 100 companies reporting at least one credential compromised in the last year, businesses need to be aware of the changing threats facing their networks. New policies must be implemented to combat more sophisticated attacks that can slip through ‘traditional’ cyber security measures.

What is a Zero Trust security system?

A Zero Trust security system assumes every user, device or application accessing an IT system is untrusted and must be treated with the same level of scrutiny.

Computer security traditionally featured perimeter defences based on threat intelligence about the most likely attackers targeting a network or organisation.

These traditional networks now struggle when faced with new attack vectors and evolutions in the threat landscape. More traditional perimeter-based defences, such as firewalls or signature-based antivirus software are no longer sufficient to protect networks.

How can organisations adopt Zero Trust security principles?

Zero Trust is not a single product or appliance to buy, but an ideology of security. It involves pulling the traditional perimeter back and combining traditional network access controls with user behaviour analytics (UBA) and micro-segmentation.

Rolling out Zero Trust across an entire organisation therefore requires control over identities, devices, applications, data, infrastructure and networks.

To adopt Zero Trust initiatives in your organisation, you need to take into account:

Identities

Strong identities are a fundamental part of Zero Trust, and they’re critical for establishing trust and access within the environment. Strong identities are also important for supporting a Zero Trust framework because they are the basis of verifying users before accessing systems. One method of enabling strong identity is to leverage multi-factor authentication methods such as two-factor (2FA) or mobile authentication.

Multi-factor Authentication

Multi-factor or continuous authentication is not a single approach, but several methods that can be deployed together to add levels of trust on top of an identity framework. The three basic approaches to authentication are:

Single-factor authentication (SFA): This is usually a user ID and password or PIN. SFA is the most common authentication method used today.

Multi-factor authentication (MFA): This adds a second authentication layer, usually in the form of a one-time code. This is sent via a security token, smart card or mobile device. MFA can be combined with SFA.

Continuous Authentication (CFA): This is a method of confirming identity in real-time. It’s accurate, convenient and prevents attacks that have been successful in the past because it doesn’t rely on static data.
MFA and CFA are recommended levels of security within a Zero Trust framework.

Passwordless Authentication

We recommend methods of passwordless authentication to our clients such as the YubiKey. The Yubikey is a hardware-based device that replaces passwords. It’s a durable, inexpensive and convenient method of strong authentication that can also be used as a USB HID device or NFC.

Network Segmentation

Network segmentation and network controls allow for traffic policy to be implemented for each department and application.

By taking advantage of micro-segmentation, a network can introduce finer levels of granular controls within the firewall or perimeter, such as limiting access to sensitive files. This makes it easier to identify potentially compromised data should a threat actor access a user account.

NetSeg is a framework that enables this type of authentication framework in open source systems.

Secured devices

Unaudited and unpatched devices in your network are easy targets for cyber criminals. In the office, updates and patches could be rolled out company-wide by IT teams, and it was simple to isolate any unsecured device.

However, changes in the workplace mean more organisations are adopting BYOD (Bring Your Own Device) policies, and there are more scenarios where users and vendors connect new or unapproved devices to the network regularly. View every user device as a potential threat and limit access to sensitive resources.

Be specific with user roles and access

Security control should become an integral part of organisational policy. Roles and access should be as granular as possible, with clear definitions for each role. For a good example of this framework in action, take a look at AWS’s Identity and Access Management (IAM) framework. It has become one of the best examples of an effective identity framework thanks to its clear separation between roles and privileges.

Zero Trust protects your network in the digital age

Business is increasingly moving online, and while an interconnected business world has advantages, there are significant risks and potential vulnerabilities that cyber criminals take advantage of. Zero Trust ensures that employees can only access the files and programs they need to do their jobs. It also means that only authorised devices can connect to the network.

However, a Zero Trust framework isn’t something that can be implemented overnight. Ensure you start in a test or development environment, and once the Zero Trust model has been successfully established, aim to implement it across your entire digital architecture.