What can you trust online in this crime ridden digital age we live in? If you can't fully trust anything then the simplest answer to your cyber security needs is to stop trusting everyone and everything all of the time. Currently the only way to accomplish that goal is by implementing Zero Trust security.
Zero Trust is a security model that takes for granted that threats are omnipresent inside and outside networks. Zero trust instead relies on continuous verification via information from multiple sources. In doing so, this approach assumes the inevitability of a data breach. Instead of focusing exclusively on preventing breaches, zero-trust security ensures instead that damage is limited, and that the system is resilient and can quickly recover.
It's particularly important for networks filled with remote workers, dynamically adapting environments, and multitudes of new users to take a serious look at Zero Trust.
It’s not hard to see the benefits of the zero-trust model outweigh the few negatives. If the Colonial Pipeline company had adopted it, for example, the ransomware attack would likely have failed. And if zero-trust security was widespread, the ransomware epidemic would be a lot less damaging to things such as public institutions.
But there are at least four main barriers to achieving zero trust in government and privatized computer systems.
Firstly, legacy systems and infrastructure are often nearly impossible to upgrade to zero-trust. Achieving zero-trust security requires a multi-layered defense, which involves building multiple layers of security. But this is challenging in systems that were not built with this goal in mind, because it requires independent verification at every layer.
Second, even if it’s possible to upgrade, it wont be cheap by any means. It is costly, time-consuming and potentially disruptive to redesign and redeploy systems, especially if they are custom-made from the ground up. The U.S. Department of Defense alone operates more than 15,000 networks in 4,000 installations spread across 88 countries.
Third, peer-to-peer technologies, like computers running Windows 10 on a local network, run counter to zero trust because they rely mostly on passwords, not real-time, multifactor authentication. Passwords can be cracked relatively easily by checking many possible passwords – brute-force attacks – whereas real-time, multifactor authentication requires passwords and one or more additional forms of verification, typically a code sent by email or text. Google recently announced its decision to mandate multifactor authentication for all its users.
Fourth, migrating an organization’s information systems from in-house computers to cloud services can boost zero trust, but only if it’s done right, which it is normally not. This calls for creating new applications in the cloud rather than simply moving existing applications into the cloud. But organizations have to know to plan for zero-trust security when moving to the cloud.
Rather than allowing devices to freely connect to corporate resources, Zero-Trust should be adopted and implemented by government institutions and large corporations alike, but it should be done right. Cyber ignorance has caused enough headlines over the past few months we don't need anymore.