May 12, 2022 | By stephen

Share

A Guide to ‘Zero Trust’ Approach to Managing Cyber Risk

• Tech(know)logy

Zero trust is one of the most popular buzzwords in today’s cybersecurity industry. What is it? How does it work? What are its benefits? Why is everybody talking about it? How do you implement it? This article answers this and several other related questions.

According to Cybersecurity Ventures, the cost of cybercrimes on the global economy soars by 15% each year and will reach $10.5 trillion annually by 2025. Another 2020 study by RiskBased estimates that cyber actors breach and expose approximately 36 billion records every six months. And according to similar research by IBM, data breach costs have jumped to over $3.86 million per incident. All statistics point to one thing—hacks and breaches are increasing in volume and becoming more severe by the day.

IT Spending to Top $4 Trillion in 2022—Gartner

Ironically, studies also show that organizations worldwide are spending more on their cybersecurity efforts than ever before. For example, Gartner predicts that the global information security market will reach $170.4 billion by this year. So, why doesn’t the increased investment in data security lead to lower cybercrime rates? There’s only one possible explanation—the existing approaches aren’t good enough, and businesses need to find better solutions, such as zero trust.

According to Robert Cunningham, an IT specialist at USPTO, the internet took off “because everyone could share everything all the time. But it’s also a fail point: If you trust everything, then you don’t have a chance of changing anything security-wise.”

What’s Zero Trust Policy?

The earliest evidence of the term “zero trust” is in a 1994 paper on securing IT systems by an associate professor at the University of Ontario Institute of Technology called Stephen Marsh. However, the term only got famous after NIST’s 2018 “Zero Trust Architecture” special publication. The publication described zero trust as a “term for an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources.” It “assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location (i.e., local area networks versus the internet) or based on asset ownership (enterprise or personally owned).”

Zero Trust Is Both a Methodology and a Mindset

While zero trust loosely translates to “no trust,” the term doesn’t literally mean that. Instead, it means zero implicit trust where organizations do not automatically trust any user or anything, within or without its perimeter, based solely on ownership and network or physical location. Instead, the business develops policies to regulate when and how users or devices can access corporate resources. And according to the NIST publication, these policies shouldn’t be static, meaning that their enforcement shouldn’t stop immediately after access. Instead, you should apply them continually as the user or device still accesses the company’s resources.

Zero trust is not a technology tool you can install once and move on, but a philosophy. It often requires a culture shift and can significantly enhance your organization’s cybersecurity posture.

Why Zero Trust Security Framework?

According to SEG, 94% of businesses use public clouds. Digital modernization has transformed companies’ conventional approach to IT infrastructure from using static, legacy systems to adopting cloud-native, dynamic solutions. The increased use of interconnected devices and databases expands organizations’ potential attack surfaces and makes the firewall-based cybersecurity perimeter no longer enough. The perimeter, and the most crucial defense line against cybercrime, is the people.

Companies now need to fend off attackers from many endpoints

That explains why the bad guys increasingly focus on exploiting employee negligence to gain unauthorized access to corporate networks. For instance, Cybint estimates that 95% of data breaches arise from human error.

You might be thinking—but am I not supposed to trust my team implicitly? Yes, you can, but you should also exercise caution. A zero trust security architecture won’t authorize any user, whether the CEO or an entry-level intern if they don’t meet the access prerequisites. It creates a level playing field and prevents cyber actors from using trusted devices or stolen logins to access your files. And more importantly, it instills a culture of security and empowers every employee to be more cyber-conscious.

How Can Organizations Turn Zero Trust Into Reality?

Introducing a zero-trust philosophy may require a substantial cultural shift, but it’s doable. What’s crucial is getting started and having the goodwill of other executives and the support of your staff. Below are some tips you can use to streamline the process:

• Define what you’re protecting: Before introducing the policy, assess your network components, audit the IT infrastructure, and create an inventory of your cybersecurity apps and tools. Next, determine your highest-value assets, their locations, who manages them, and safety policies.
• Educate users in every step: Employees are often against change, especially if it involves significant adjustments. That’s why it’s crucial to explain the policy to your staff and help them understand its importance and their roles in the implementation process. Make the education engaging and less of a task to make the team feel invested in the process.
• Make a flexible plan: You must not figure out everything at once. Segment the journey into smaller, more manageable tasks and be open to change along the way. Zero trust programs continually evolve, so there’s no need for an endpoint.
• Don’t go it alone: It may help connect with other like-minded organizations and learn from their experiences. You can also engage leading IT service providers who can use hindsight and experience to guide you on the journey.

LeadingIT offers 24/7, all-inclusive, fast and friendly technology and cybersecurity support for nonprofits, manufacturers, schools, accounting firms, religious organizations, government, and law offices with 20-200 employees across the Chicagoland area.