Making Your Organisation Cyber Resilient with Zero Trust
Guest blog: There are many journeys to zero trust. Ensure yours leads to greater agility, appropriate security access, and a frictionless experience by Steven Aitken, Customer Success Manager, CyberRes, Micro Focus as part of our #Cyber2021 week
Balance Business Agility with Appropriate Security Access
As organisations adapted to the rapid change in working practices in response to the COVID-19 pandemic, they quickly recognised the need to support agility while enforcing required governance processes. In this shift, more and more organisations have realized that perimeter-based security models, which rely on assumed trust, are no longer enough. What they need are new and better ways of providing security and validating the appropriateness of access.
Increase Cyber Resilience through Zero Trust
The details on how organisations have adapted during this time vary widely, but we’ve seen several specific trends that have enabled some organisations to adapt better than others. One such trend is increasing their cyber resilience through delivering initiatives such as zero trust operating models and ensuring that they have a good view of how risk flows through their IT estate.
Identifying risk and introducing compensating controls to effectively manage that risk have always been important. However, with the rate of business and policy change we’ve seen over the last 12 months, do we have a good handle on what people are allowed to do and not do? How can we manage risk effectively?
Addressing this question is core to enforcing the least privilege model, which in turn, is a core concept of delivering the zero trust operating model. Merely trusting that people have the correct access privileges is no longer enough—much in the same way that trusting a credential and single-factor authentication from an external network isn’t enough. When we move to zero trust, we must continually verify what is appropriate, in the context in which it is presented.
Apply Adaptive, Frictionless Security Controls
In the here and now, this context is typically driven by the continued pressure to maintain a successful business presence while a high percentage of our staff are working remotely. This challenge has led organisations to introduce new technology too quickly or to repurpose existing implementations. In some cases, this has happened outside of standard IT control, which presents unique risks where credentials are being used outside of the internal security zone and on personal devices due to BYOD initiatives.
By using techniques such as device fingerprinting, and risk weighting the identities and systems they access, we can profile access requests for risky activity in real time and apply appropriate security controls at the point of access. These additional layers of security should be as unobtrusive as possible and provide a seamless and frictionless experience for users. This is where adaptive, step-up authentication mechanism comes in. Using this technique, users will only be prompted for a second authentication factor if their risk profile demands it or if they have used a second factor outside an allotted time window—keeping their experience seamless and frictionless wherever possible. It might also be beneficial to look into centralised tools for federated access, ensuring that all sites can be protected by a common set of security controls.
To learn more, visit our Identity and Access Management page on Cyberres.com
Dan Patefield
Head of Cyber and National Security, techUK
Dan Patefield
Head of Cyber and National Security, techUK
Dan leads the techUK Cyber Security programme, having originally joined techUK in August 2017 as a Programme Manager working across the Cyber and Defence programmes. He is responsible for managing techUK's work across the cyber security eco-system, bringing industry together with key stakeholders across the public and private sectors. Dan also provides the industry secretariat for the Cyber Growth Partnership, the industry and Governmnet conduit for supporting growth across the sector. A key focus of his work is to strengthen the public-private partnership across cyber security to support further development of UK cyber security policy.
Before joining techUK he worked as Forum Lead for the Westminster eForum. In this role he had a focus on the technology and telecoms space, on issues ranging from Broadband and Mobile Infrastructure, the Internet of Things, Cyber Security, Data and diversity in tech. Dan has a BA in History from the University of Liverpool.
Raya Tsolova is the Programme Manager for National Security at techUK.
Raya is responsible for all National Security related activities across techUK, specifically in the established programmes of Defence, Cyber Security and Justice & Emergency Services. Raya will leverage relationships with existing stakeholders across the three programmes, and will build new relationships between techUK and key stakeholders who are of interest to member companies.
Prior to joining techUK, Raya worked in Business Development for an expert network firm within the institutional investment space. Before this Raya spent a year in industry working for a tech start-up in London as part of their Growth team which included the formation and development of a 'Let's Talk Tech' podcast and involvement in London Tech Week.
Raya has a degree in Politics and International Relations (Bsc Hons) from the University of Bath where she focused primarily on national security and counter-terrorism policies, centreing research on female-led terrorism and specific approaches to justice there.
Outside of work, Raya's interests include baking, spin classes and true-crime Netflix shows!
Freddie MacSwiney is the Programme Manager for Defence and Cyber Security at techUK.
Prior to joining techUK, Freddie worked as a Government Adviser for a firm dealing in International Relations, where he briefed Politicians, Ministers, Heads of State, Diplomats around the world on key issues from Defence, Security and other key issues and aligned them with the UK.
Jill Broom
Programme Manager, Cyber Security and Central Government, techUK
Jill Broom
Programme Manager, Cyber Security and Central Government, techUK
Jill is techUK’s Programme Manager for Cyber Security and Central Government, supporting the work of both programme teams and promoting better engagement between the public and tech sectors.
Prior to joining techUK, Jill worked as a Senior Caseworker for an MP, advocating for local communities, businesses and individuals, so she is particularly committed to techUK’s vision of harnessing the power of technology to improve people’s lives. Jill is also an experienced editorial professional and has delivered copyediting and writing services for public-body and SME clients as well as publishers.
With an MA(Hons) in American Studies from the University of Edinburgh, Jill continues to be fascinated by the history and politics of the USA. Otherwise, outside of work, she can be found up a hill, swimming in a loch or curled up with a good book.
The techUK Annual Dinner will take place on Wednesday, 13 July 2022. Our Annual Dinner is the established, must-attend business dinner in our calendar. The evening will begin with a drinks reception, allowing ample networking opportunities, followed by a fabulous dinner and speeches from the country's leading technology stakeholders.