Zero Trust: a priority from the board of directors
Many clues show that 2021 has been another difficult year for cybersecurity. Cyberattacks and data breaches are on the rise and it seems that cybercriminals are getting bolder with each breach. The continuing fallout from COVID-19 is forcing many organizations to struggle to maintain their defenses in the face of a remote and disparate workforce. Dynamic data centers, distributed workloads, vulnerable endpoints, and a complex application landscape are massively interconnected attack surfaces that are increasingly vulnerable.
About the Author
Vats Srivatsan, President and COO, ColorTokens.
With the start of a new year comes a new focus. My belief, having worked in the industry for many years, is that cybersecurity should no longer be isolated from technical or IT teams. This needs to be a priority from the conference room level down.
Cybersecurity – an issue for CEOs
To date, CIOs and CISOs have been responsible for cybersecurity. However, given the impact that any cybersecurity breach can have on a company’s customers, brand, employees, and ecosystem, CEOs will need to educate themselves quickly on their company’s cybersecurity measures.
Cybersecurity should be on the agenda of any conversation between CEO and board. It’s no longer about whether a company will be exposed to a breach – it’s about when, where and how you are ready to respond.
Cyber threats threaten multiple sectors
Nearly a third of all reported data breach victims belong to organizations that operate in the manufacturing or healthcare sectors. If you are responsible for your company’s cybersecurity in these areas, you need to act now before your attacker turns to your organization.
These two industries remain particularly attractive targets due to the prevalence of valuable personal information on the one hand, and a significant footprint of legacy systems on the other. Other industries are not immune, as attackers are not limited to industry boundaries. No industry has been or will be immune to attack.
The key elements of your IT that must be protected
Messaging and education on endpoint security and phishing attacks has been widely adopted by enterprises as a whole. To a lesser extent, identity management and authentication methods such as two-factor authentication are increasingly being adopted. However, this does not mean that organizations are safer.
As endpoints are protected, attack patterns will shift to other areas such as misconfigurations, unpatched vulnerabilities in common systems or even rarely used systems that connect to your gems of the crown by a lateral movement.
Where should you focus your security spending? What should be repaired or repaired first? Unfortunately, without applying some form of 80/20 rule on what to fix, companies will never be able to win this asymmetric cyberwar. After all, an attacker only needs one win while the defender needs to win all the time. In this context, it is impossible to protect your company in all scenarios and against all possible combinations of attacks, given the low capacity of your security resources.
Prioritization is therefore imperative for good execution. To make this work, first identify your organization’s “crown jewels,” your most valuable digital assets (and any associated systems that can access your crown jewels in one or more hops). This is where you prioritize your security investment. The connected nodes that currently surround your crown jewels will undoubtedly need a higher level of security than you currently have.
Zero Trust Investment
Perhaps you have already studied the concept of Zero Trust. Remember that this is not a one-size-fits-all product or solution that can be purchased off-the-shelf. Rather, Zero Trust is a holistic approach by which organizations seek to cripple any threat attempting to gain access to their system.
In a Zero Trust environment, you trust no one. Traditional security approaches protect one weak area at a time. However, as soon as one area is protected, another appears as a pressure point. This game of “hitting a mole” will ensure that any attacker will always be one step ahead. Stop being reactive, be proactive and start adopting Zero Trust now, at least for your most valuable assets and data.
Dealing with new attack vectors
Keep an open mind when it comes to cybersecurity protection – be prepared for non-traditional attacks, not just known attacks. Attackers are constantly changing their game, creating new headaches for your IT security team. For example, supply chain attacks are on the rise and tend to spread damage throughout the ecosystem. They can come from a compromised supply chain partner who has access to your systems or who is the weakest link in your supply chain.
The notorious SolarWinds attack was an example of a software supply chain attack and arguably provided the impetus for cybercriminals to take a similar approach to other supply chains. The recently released Log4j java attack exploits a common design vulnerability in the Java logging system to attack servers. Patching after the fact protects you from this particular mode of attack, but protecting critical servers from running “unwarranted processes” prevents you from similar attacks in the future.
Do I only need to protect my cloud?
Most organizations will invest heavily in the cloud with brand new infrastructure built there using a public, private, or hybrid model of cloud storage and computing. And there will be a commensurate investment in cloud security. However, companies must also ensure the protection of their brownfield environments, not just their cloud.
Most companies will have hybrid environments with some workloads in the cloud and others in their own data centers. From a security perspective, you need to protect both at the same time, so invest in a cloud-based security approach that delivers end-to-end zero trust, designed to control and secure all traffic, communications, and data. processes on a hybrid infrastructure.
What we can expect in the coming year is more headlines about breaches and attacks. And just like death and taxes, you can count on some kind of security issue coming up sooner or later. It’s up to security professionals to adopt the cybercriminal mindset – constantly evolving and updating.
We’ve featured the best business VPN to get you online securely.