Zero-Trust Powers Digital Transformation
Security Trends
Cirrus networks advocate for the Zero-Trust security approach as a more efficient way for enterprise customers to combat today’s increasingly sophisticated attacks and threats. Disruption is the hallmark of 2021. Combining the digital transformation and sudden outbreak of the COVID-19 pandemic has forced organisations to adapt quickly to enabling employees to work remotely at unprecedented speed and scale. That creates ‘chaos with no control’, not necessarily because organisations have more employees but because they are all in different geolocations, operating from various networks, on multiple devices, which cybercriminals exploit and subsequently has led to tremendous growth in cyberattacks worldwide.
No sector is safe from cybersecurity breaches due to the vast supply of real-time data and potential human errors. The malicious hackers observe the weak links and grasp every opportunity to demand ransomware for confidential data leakages such as credentials, sensitive data, financial records, medical reports and many more.
To better understand how organisations have adapted and responded to this paradigm shift from a cybersecurity perspective, let us look at customers’ main challenges, primarily around how increased complexity in their infrastructure leads to an increased attack surface, especially with gaps in visibility.
- Bringing remote users onto the network is easy, but what about secure access with the Multifactor authentication (MFA), 3rd party access like contractors with weak security practices accessing internal apps?
- Securing access to private apps that are now spread across datacentre and cloud
- Gaining visibility into apps and user activity for anomalies
- Internal users with overprivileged access
- Shadow IT (Unsanctioned Bring-Your-Own-Devices (BYOD), or 3rd party Software-as-a-Service (SaaS) applications outside the purview of the IT department.
- Manual processes are complex, for instance, lack of version control, audit trails, scalability and lack of consistent data management, and;
- Internet-based attacks (i.e. DDoS, Man in the Middle, Ransomware).
The obvious security threat vectors are multi-dimensional, from the end devices to the core infrastructure and cloud. Organisations invest in technologies designed to make network infrastructures safe and reliable. In an attempt to mitigate the security risks, a phased-approach security architecture is needed to address a hierarchical enterprise security framework that covers the physical facility layer, virtual infrastructure layer, applications lifecycle, hosting platforms, user plane function and management system security.
This article highlights the following security requirements: entity authentication, identity verification, network security with traffic separation, application integrity assurance, malware detection within the functional layer, data encryption, and tamper-proof equipment.
Some of these aspects are built-in, inherent, secure characteristics of the enterprise architecture itself. With the advent of XaaS, Multi-Cloud, and distributed edge networks, myriads of new businesses, new cybersecurity technologies and new service delivery models will gain momentum globally. As a result of the cybersecurity boom and its critical role in the technology evolution and sustainability, the Zero-Trust technology model will soon become a prime defence for malicious actors who want to leverage their stealthy subtle to disrupt business growth and, in turn, use it to launch attacks against a broader user base globally. The impacts of breaches in this new generation of the connected world can be vast and impactful.
If you are not already aware of the Kaseya ransomware incident, I think you should be. It is most likely the critical cybersecurity event of the year. Imagine, more extensive than the Exchange hacks in January, more significant than the Colonial Pipeline ransomware in June and JBS in May incidents. And, yes, more important than the SolarWinds intrusions in 2020.
On Friday, July 2nd 2021, REvil, the hacking group, has named its price for Kayseya to pay 70 million USD in Bitcoin. Holy Moly!
Zero-Trust Approach
What is the Zero-Trust approach?
A Zero-Trust Architecture model was introduced in 2010 by John Kindervag, who also coined the term “Zero-Trust,“ where he was a principal analyst at Forrester Research. The concept assumes that an adversary may already be on the network, so local devices and connections “communication channels” should never be trusted implicitly, and verification is always compulsory.
The Zero-Trust approach connects the breadth of the integrated security controls and the entire security infrastructure for a consistent experience that enables automation, unifies visibility, and strengthens the security across the network, users, devices, and applications.
