Making Your Organisation Cyber Resilient with Zero Trust
Balance Business Agility with Appropriate Security Access
As organisations adapted to the rapid change in working practices in response to the COVID-19 pandemic, they quickly recognised the need to support agility while enforcing required governance processes. In this shift, more and more organisations have realized that perimeter-based security models, which rely on assumed trust, are no longer enough. What they need are new and better ways of providing security and validating the appropriateness of access.
Increase Cyber Resilience through Zero Trust
The details on how organisations have adapted during this time vary widely, but we’ve seen several specific trends that have enabled some organisations to adapt better than others. One such trend is increasing their cyber resilience through delivering initiatives such as zero trust operating models and ensuring that they have a good view of how risk flows through their IT estate.
Identifying risk and introducing compensating controls to effectively manage that risk have always been important. However, with the rate of business and policy change we’ve seen over the last 12 months, do we have a good handle on what people are allowed to do and not do? How can we manage risk effectively?
Addressing this question is core to enforcing the least privilege model, which in turn, is a core concept of delivering the zero trust operating model. Merely trusting that people have the correct access privileges is no longer enough—much in the same way that trusting a credential and single-factor authentication from an external network isn’t enough. When we move to zero trust, we must continually verify what is appropriate, in the context in which it is presented.
Apply Adaptive, Frictionless Security Controls
In the here and now, this context is typically driven by the continued pressure to maintain a successful business presence while a high percentage of our staff are working remotely. This challenge has led organisations to introduce new technology too quickly or to repurpose existing implementations. In some cases, this has happened outside of standard IT control, which presents unique risks where credentials are being used outside of the internal security zone and on personal devices due to BYOD initiatives.
By using techniques such as device fingerprinting, and risk weighting the identities and systems they access, we can profile access requests for risky activity in real time and apply appropriate security controls at the point of access. These additional layers of security should be as unobtrusive as possible and provide a seamless and frictionless experience for users. This is where adaptive, step-up authentication mechanism comes in. Using this technique, users will only be prompted for a second authentication factor if their risk profile demands it or if they have used a second factor outside an allotted time window—keeping their experience seamless and frictionless wherever possible. It might also be beneficial to look into centralised tools for federated access, ensuring that all sites can be protected by a common set of security controls.
To learn more, visit our Identity and Access Management page on Cyberres.com
Dan Patefield
Dan Patefield
Dan leads the techUK Cyber Security programme, having originally joined techUK in August 2017 as a Programme Manager working across the Cyber and Defence programmes. He is responsible for managing techUK's work across the cyber security eco-system, bringing industry together with key stakeholders across the public and private sectors. Dan also provides the industry secretariat for the Cyber Growth Partnership, the industry and Governmnet conduit for supporting growth across the sector. A key focus of his work is to strengthen the public-private partnership across cyber security to support further development of UK cyber security policy.
Before joining techUK he worked as Forum Lead for the Westminster eForum. In this role he had a focus on the technology and telecoms space, on issues ranging from Broadband and Mobile Infrastructure, the Internet of Things, Cyber Security, Data and diversity in tech. Dan has a BA in History from the University of Liverpool.
- Email:
- [email protected]
- Phone:
- 020 7331 2165