CISOs say that enterprises that plan to stay ahead of the cyber attackers will have to go beyond user trust and device to outwit their adversaries effectively
Security leaders acknowledge that zero-trust is not a new concept; however, understanding the measure and how it is applied by the organization has continued to evolve.
Implementing zero-trust, or “just enough access” and lean trust principles to devices and users, is a good start, but in the current situation, the constantly changing threat landscape needs expansion of zero-trust to more elements. Domains like application, session trust, and data are observing higher importance, and enterprises hope to stay a step ahead of the modern malicious actors. It requires going much deeper into the trust stack to outwit the cybercriminals.
Zero-trust has received renewed interest and market traction due to the sudden events of 2020 and the sudden shift to the work from home model. Zero-trust doesn’t entail a single element of technology, and rather it refers to the concept that end-users should have only the bare minimum access required to perform a task.
Read More: The Evolution of the CISO’s Role and Responsibilities
Understanding and reframing of zero-trust policies
CIOs say that when an organization follows zero-trust in practical terms, they should trust no entity that is accessing their network. The entity is required to continuously prove that it has the required permissions and rights for accessing a given asset or area.
Even when an end-user validated an account through a password and username, the system doesn’t automatically assume the user to be trusted. With effective ZTA, the network will be able to give access only to those specific areas that a user has permission for. The correct security can identify the behavior of a user if it’s suspicious and raise an alarm if they try to access something that goes beyond their normal purview.
Security leaders say that for zero-trust to be effective, it is important to pay attention to key factors: transport/session trust, data trust, device trust, and user trust. In the current scenario, most zero-trust technology focuses on the device and user trust areas, which is understandable as the protection of individual user accounts and devices greatly impacts how enterprises work with cybersecurity.
Also, other areas, like data trust and application trust are also rapidly gaining more importance in the current landscape. Instead of addressing zero-trust solely from an identity standpoint that most organizations are actively developing into their programs, security departments need to add breadth to the programs by ensuring addressing it from a controlled access standpoint.
Ensuring that zero-trust works
Experienced security leaders highlight major areas where technology like deception and concealment can make a huge difference for defenders. The fields of application trust and data trust need to stand uniquely as specifically important points to be considered when expanding zero-trust programs.
Leaders point out that zero-trust in terms of the requirement for controlled access management does not have a negative impact on the business. Enterprises need to establish a zero-trust environment that restricts access to personnel with required authority, which doesn’t impact the daily operations.
For more such updates follow us on Google News ITsecuritywire News. Please subscribe to our Newsletter for more updates.
