20 Apr 2021

Making Your Organisation Cyber Resilient with Zero Trust

Guest blog: There are many journeys to zero trust. Ensure yours leads to greater agility, appropriate security access, and a frictionless experience by Steven Aitken, Customer Success Manager, CyberRes, Micro Focus as part of our #Cyber2021 week

Balance Business Agility with Appropriate Security Access

As organisations adapted to the rapid change in working practices in response to the COVID-19 pandemic, they quickly recognised the need to support agility while enforcing required governance processes. In this shift, more and more organisations have realized that perimeter-based security models, which rely on assumed trust, are no longer enough. What they need are new and better ways of providing security and validating the appropriateness of access.

Increase Cyber Resilience through Zero Trust

The details on how organisations have adapted during this time vary widely, but we’ve seen several specific trends that have enabled some organisations to adapt better than others. One such trend is increasing their cyber resilience through delivering initiatives such as zero trust operating models and ensuring that they have a good view of how risk flows through their IT estate.

Identifying risk and introducing compensating controls to effectively manage that risk have always been important. However, with the rate of business and policy change we’ve seen over the last 12 months, do we have a good handle on what people are allowed to do and not do? How can we manage risk effectively?

Addressing this question is core to enforcing the least privilege model, which in turn, is a core concept of delivering the zero trust operating model. Merely trusting that people have the correct access privileges is no longer enough—much in the same way that trusting a credential and single-factor authentication from an external network isn’t enough. When we move to zero trust, we must continually verify what is appropriate, in the context in which it is presented.

Apply Adaptive, Frictionless Security Controls

In the here and now, this context is typically driven by the continued pressure to maintain a successful business presence while a high percentage of our staff are working remotely. This challenge has led organisations to introduce new technology too quickly or to repurpose existing implementations. In some cases, this has happened outside of standard IT control, which presents unique risks where credentials are being used outside of the internal security zone and on personal devices due to BYOD initiatives.

By using techniques such as device fingerprinting, and risk weighting the identities and systems they access, we can profile access requests for risky activity in real time and apply appropriate security controls at the point of access. These additional layers of security should be as unobtrusive as possible and provide a seamless and frictionless experience for users. This is where adaptive, step-up authentication mechanism comes in. Using this technique, users will only be prompted for a second authentication factor if their risk profile demands it or if they have used a second factor outside an allotted time window—keeping their experience seamless and frictionless wherever possible. It might also be beneficial to look into centralised tools for federated access, ensuring that all sites can be protected by a common set of security controls.

To learn more, visit our Identity and Access Management page on Cyberres.com