Just as knights used to guard their castles, IT managers used to guard their digital environments. They knew exactly what was going on inside their IT “castle” and could spot the enemy coming from a distance. Today, however, such a transparent environment no longer exists. Cybersecurity so it must evolve as well. The use of mobile devices, web applications, and access to the network by customers, suppliers, or patients means you need to adopt a completely different kind of strategy. A Zero Trust strategy …
Zero Trust as a Mindset
In 2009, John Kindervag therefore introduced his Zero Trust security strategy. ‘Zero Trust’ can be translated quite literally as ‘no trust.’ The term seems to carry a very negative connotation, but it’s simply the reality. The control we used to have over our systems simply no longer exists. You can no longer be certain that you can keep threats out of your fortress, so you must leave nothing to chance. At the heart of Zero Trust are the principles of ‘verification,’ applying ‘least privileged access,’ and ‘always assume a breach.’.
So zero trust is a mindset, and of course you still have to put it into practice. The best way to do that is by having open conversations: How do we work right now? Are we already using enough—or the right—tools? Do we know who all has access? Despite its negative connotations, you can still put a positive spin on it.
A multi-layered approach
In our view, the best Zero Trust strategy is based on a multi-layered approach. In this blog post, we’d like to explain the areas where you should take action:
Identity
Zero Trust starts with ‘identity‘, which verifies that only the people, devices, and processes that have been granted access to your resources actually have access to them.
- Secure access to resources and data using strong authentication and centrally configurable access policies without affecting the user experience.
- It offers a simple, fast sign-in experience to keep your users productive, save time managing passwords, and increase end-user productivity.
- Manage all your identities and access all your apps from a central location—whether they're in the cloud or on-premises—to improve visibility and control.
- Efficiently manage access to apps and data for all users and administrators using automated identity management to ensure that only authorized users have access.
Endpoints
Next, you need to verify that the endpoints—the hardware that has access to your data—comply with security requirements. If endpoints are not up to date or are not adequately protected, they are at risk of having their data compromised by unknown apps or services.
- Microsoft Endpoint Manager: Get endpoint device management and security on an integrated management platform with Microsoft Intune and Configuration Manager.
- Microsoft Defender for Endpoint: Discover and secure endpoint devices across your entire enterprise using multiple platforms.
Network
The network is the third layer in the Zero Trust security model. Ensure that devices and users are not trusted simply because they are connected to an internal network. With modern architectures and hybrid services that encompass on-premises and multiple cloud services, virtual networks—or VNETs—and VPNs, there are a number of control options:
- Segment the network to limit the reach and lateral movement of attacks on your network.
- Threat protection to safeguard the network perimeter against DDoS or brute-force attacks, and the ability to quickly detect and respond to incidents
- Encryption for all network traffic, whether internal, incoming, or outgoing
Data
Make sure you identify where your data is located, who uses it, how sensitive it is, and how employees, partners, and customers use your data. If you don’t do this, you won’t be able to protect your data properly. Identifying data also simplifies the process of classifying it. In other words: What are our most valuable assets, and how do we manage them?
Infrastructure
The key considerations for infrastructure are configuration management and software updates, to ensure that all deployed infrastructure meets your security and policy requirements.
Protect Your Business
Today, modern businesses therefore need a security model that adapts perfectly to a complex modern environment, embraces the hybrid workplace, and protects people, devices, and data, regardless of location.
Are you planning to implement this zero-trust strategy within your organization as well? If so, be sure to contact Get in touch with our Security team, and they'll be happy to help you get started.
