IE 11 Not Supported

For optimal browsing, we recommend Chrome, Firefox or Safari browsers.

Increase Your Cybersecurity Posture With Zero Trust

You need the staff to do the work.

In our 21st century, and going forward, cyberscurity will be with us until our dying day. We can bemoan that fact or adapt to the reality. See the article below that shares a concept of zero trust in cybersecurity.

Two more issues to contemplate: “Business are being targeted more and more each day as cyberthreats and ransomware attacks rapidly rise. 43% of cyberattacks are aimed at small businesses, but only 14% are actually prepared to defend themselves.” And, as is called out in the article, there is an absolute dearth of cybersecurity professionals.

If you like the work and are good at it, you will never be unemployed!

In a World of Emerging Cyberthreats, a Confident Defense Starts with Zero Trust

By Ron Tosto, CEO and Founder of Servadus

In the world, as we know it today, there is a list of daily breaches and privacy flaws like no other time in history – and they come from the globally connected society via the Internet. Companies and government organizations have been unable to protect their employees, customers, and other stakeholders. Governments are scrambling to set the proper regulation and laws to set the standards to protect their citizens. There are more options for collaboration, more opportunities to share, and more hackers knocking at the door – especially when the initiation of hacking is done by a bot that carries out tens of thousands of attacks simultaneously without human intervention. It sounds like a real doomsday story.

There are plenty of tools to help organizations with their cyber program, and there are plenty of theories on what is the best approach to a good cyber defense. While there is a diversity of tools and views, one thing is common; it is setting out the security of an organization to support the business and those who work with it. Every organization must have a strategy for cyber-defense. To have a best-in-class cyber-defense program, an organization must understand the weaknesses; technically and at the human level. Understanding the threat vector or the direction the attackers will approach the network is another critical element. These two pieces of information lead to the known risk and an estimate of unknown risk to an organization. The fundamental approach is to reduce the risk to an organization, and our organizations must take a strategy to reduce that risk.

A common phrase is a good offense is a good defense, and there is plenty of evidence that shows how companies want to ensure all organizations can defend themselves.

Having a sustainable cybersecurity program and the implementation of the Zero Trust model go hand in hand and are essential to understand and address.

Maintaining a Sustainable Cybersecurity Program

Best practices within the cyber community have shown that a program with good policy and processes executed with sustainable controls is an excellent approach to protecting the organization. One of the critical items is having such a program that works routinely. The threats constantly evolve along with some of the approaches, and the vulnerabilities change daily. A good security program considers the consistent change in its processes and applies it to cyber operations. The cycle of verifying which vulnerabilities exist, entering them into a change management program, and ensuring the needed patches go to all systems are three vital elements of the daily lifecycle of cybersecurity.

One of the significant challenges with cyber-defense today is the lack of qualified and competent resources. There are not enough experienced cybersecurity professionals in the world. There are approximately 500,000 cybersecurity openings just in the United States (Cyber Seek, 2021), and organizations developing an excellent defensive strategy must consider resources to execute the program.

Shifting to a Zero Trust Model

What is Zero Trust? One example in modern warfare is of two communications operators on the battlefield. The operators establish voice communications using preestablished Call Signs.

Once the two operators can hear one another, they immediately go through a “challenge and reply” routine to authenticate each other. The first operator initiates a challenge and the second provides the appropriate authentication code and then starts a counter challenge to the first operator to provide an authentication response. In this type of operation, they are both using codebooks produced by a third party. The distribution of those codes only goes to trusted organizations within the military. While this is an elementary view of Zero Trust, it is an excellent example of the model.

When we use terms like cloud and working remotely, it is easy to conceptualize that there are no network boundaries, and there should be no trust between any devices regardless of their technical settings or physical location within the network.

Zero Trust implementation is a very different concept from today’s network architecture that has trusted zones and perimeter defenses. It is common for organizations designing Zero Trust to overlap the two architectures with a network perimeter still in place. It does make sense that an organization will have a strategy to maintain a good business-as-usual approach to cyber defense with traditional controls as a part of a great defense while designing and implementing a Zero Trust model.

Several elements of Zero Trust must be in place. The single challenge is the systems that authenticate all other systems. It must maintain its trustworthiness to ensure Zero Trust works and part of that trustworthiness is the security of data in transit.

The two types of data in the Zero Trust model are the authentication data, which is the information that two devices use to establish the trust relationship, and the data sent between two trusted devices. In both cases, the data must have an appropriate encryption methodology, but determining that encryption is a moving target. As the processing power within technology increases, it is a much shorter process to determine a password within information systems. It is an encryption key that allows two systems to communicate, and as passwords have gotten more complex, encryption keys have gotten increasingly longer.

For Zero Trust to be a viable solution to cybersecurity, there will need to be a constant evaluation of the encryption process for authentication and encryption of data in transit to support business operations.

These two topic areas represent a symbiotic relationship. Having a maintainable or sustainable cybersecurity program means a part of the business that happens every day. It can be considered the short-term plan to the long-term strategy.

Having a good cybersecurity program implementing Zero Trust requires qualified people to work through cyber operations daily. There will be technologies to support, however, there are no tools that provide the magic formula for cyber-defense. It’s all about due diligence and perseverance to protect all stakeholders within and outside the business.

###
Disaster Zone by Eric Holdeman is dedicated to sharing information about the world of emergency management and homeland security.