Content-centric solutions that evaluate each message based on how likely it is to be bad create a gap through which identity-based email attacks can slip. A zero-trust email security model is vital to closing that gap. Zero-trust may also be characterized as zero-assumption.
Basketball can teach us a lot about managing the cybersecurity of an enterprise: it takes teamwork. This is perhaps most evident as organizations seek to adopt zero trust principles. The zero trust concept is not new, but I hear more organizations discussing it than ever before — driven by a desire for greater security, more flexible access, and accelerated by the shift to remote work due to COVID-19. At its core, zero trust focuses on providing least-privilege access to only those users who need it. Put it this way: don't trust anyone and even when you do, only give them what they need right now. This security philosophy would make Jordan proud, but in that vein, zero trust would not work without another player: identity management (perhaps it’s the Pippen factor!).
Between distributed workforces and scattered schedules, there’s no doubt the work environment has faced enormous disruption over the past few months, forcing enterprises to modernize their security measures. The solution? Jason Soroko, Chief Technology Officer (CTO) at Sectigo, believes it's a Zero-Trust Security Strategy. Here we talk to Soroko about the importance of a zero-trust strategy, especially during the ongoing COVID-19 pandemic.
New research finds that the main difference between those who were successful in moving their Zero Trust initiatives forward were those that started out with formalized Zero Trust projects. Those that had dedicated budgets and formal initiatives (69%) were far more likely to continue accelerating those projects throughout the pandemic, while those that had ad hoc Zero Trust projects were more likely to stall progress or stop entirely.
Today, Zero Trust is the subject of much discussion and debate; for instance, is Zero Trust doable in reality or more so in theory?
As many are aware, Zero Trust is a concept that deems everyone (employees, freelancers and vendors) and everything (datacenters, applications and devices) must be verified before being allowed into a network perimeter – whether they are on the inside or the outside of an organization.
Organizations may consider adopting an adaptive risk-based trust approach to securing their privileged access. This approach uses least-privilege, zero-trust as a baseline for how organizations build trust scores which will then be used to determine the level of security which is required to gain access to the cloud, and specific applications and systems.
COVID-19 has slowed the adoption of many technologies, as budgets require organizations to reconsider business priorities. However, a new poll from Deloitte shows that for organizations shifting to a security-centric business model, zero trust may be even more of a priority than before.
I was chatting with a chief information security officer (CISO) recently, and we started talking about motivation and the role of love and hate in driving ourselves towards our goals. In cybersecurity, we tend to think about external opponents, most notably white hats vs. black hats, but rarely discuss the internal factors that guide our day-to-day decisions. Humans are dynamic beings that aren’t driven solely by love or hate (despite what the chatter on social media may have you believe). We do, however, have predilections based on our personalities and environment. How we choose to deal with those influences shapes who we become. A good strategy is a combination of love and hate where organizations work towards a grand vision of their future while eliminating things they hate one after the other.
Zero Trust model creator John Kindervag puts it like this: “The point of Zero Trust is not to make networks, clouds, or endpoints more trusted; it's to eliminate the concept of trust from digital systems altogether.” He came up with the model in 2010, at a time when many businesses were just beginning to put foundational cybersecurity controls in place and over-relied on the assumed security inside their enterprise-owned network boundaries.
You are a new Chief Information Security Officer (CISO) in the financial services industry. You are excited about the job but anxious due to the scale of the cyber threat from a range of actors: lone-wolf hackers, organized crime syndicates, governments and their proxies, and insiders. As you think through your game plan for addressing these threats, what’s your most important first step?
