This has brought to fore a concept that’s now widely talked about in cybersecurity – zero trust. What it means is, enterprise systems must not trust anyone or anything, must consider everyone and everything a potential threat, and must verify them every single time they try to access an internal resource.
Tushar Haralkar, security software technical sales leader for IBM’s technology sales in India, noted at our webinar last week that zero trust is not a product or a tool; it’s the overall security strategy aligned to your business goal. The principle, he said, is to distrust every user, device, application, or process. “We need to continuously evaluate access to firms’ sensitive data, looking at contextual information. Every connection must prove to be legitimate from a need perspective,” he said.
Nilesh Shirke, associate partner at EY, said in the traditional approach, firms focus on defending the perimeters and assume that every user inside the network is trusted and cleared for access. “Today, when people are working remotely, workloads are moving to the cloud, and information is shared by APIs, this traditional approach seems vulnerable,” he said.
The pandemic, he said, has thrown a new challenge for organisations to secure remote work and identify legitimate users from all types of people trying to get
into your networks. “Every day we get to hear about ransomware attacks. Being proactive is critical,” he said.
Mayank Vaish, vice-president of identity and access management at cybersecurity firm Aujas, said zero trust is about identity centric security – instead of perimeter based security. Every identity itself, he said, is today a perimeter. Vaish said that given the massive automation happening, identities for non-humans have also become very important.
Haralkar said a core principle of zero trust must be to enable ?least privilege’ and provide minimum access based on the job role. “Firms are hardening devices so that only whitelisted application processes have access to data. So, even if there is a ransomware attack on any end point, it will not be able to access the data,” he said. A big challenge today, he said, is also to get consistent security across multiple clouds. Zero trust, he said, will help you get visibility into where your critical data is lying, and then you will start monitoring it closely.
Does zero trust slow down access? No, said Vaish. There are technologies like password-less sign-in, he said, that ensure seamless access.