In a world of complex cybersecurity threats and mobile workforces armed with multiple apps and devices, security in Zero Trust aims to provide comprehensive protection.

The Zero Trust approach never assumes that a request comes from a trusted source, even if it originates from inside the corporate firewall, for example.

Everything is treated as if it came from an open, unsecured network, and trust itself is seen as a responsibility within the zero-trust framework.

Zero-trust security can also be called non-perimeter security. This term shows how it is the opposite of traditional security models, which follow the “trust, but verify” principle and consider users and endpoints already authenticated within the company perimeter or those connected via VPN (Virtual Private Network) as secure.

But this implicit trust increases the risk of data breaches caused by insider threats, as it allows for extensive, unverified sideways movement across the entire network. Keep reading and learn more about Zero Trust-based security.

What is Zero Trust-based Security?

Zero Trust is a security framework that requires all users, inside or outside the organization’s network, to be authenticated, authorized, and continuously validated for security configuration and behavior before receiving or maintaining access to applications and data.

Zero Trust assumes that there is no traditional network edge. Networks can be on-premises, in the cloud, or a hybrid combination with resources anywhere, as well as workers anywhere.

The execution of this framework combines advanced technologies such as multi-factor authentication, IAM (Identity and Access Management), identity protection, and state-of-the-art endpoint security technology to verify user identity and maintain the system’s security.

This approach also requires considering data encryption, email protection, and asset and endpoint hygiene verification before connecting to applications.

Therefore, zero-trust-based security requires organizations to continuously monitor and validate that a user and their device have the correct privileges and attributes.

Also, it requires the organization to know all of its services and privileged accounts and be able to establish controls over what and where they connect. One-time validation is simply not enough, as threats and user attributes are subject to change.

How to Implement Zero Trust-based Security?

The concept of zero trust can be built on your existing architecture and does not require you to eliminate and replace existing technology.

There are no Zero Trust products. Some products work well in Zero Trust environments and others that do not. Zero Trust is also quite simple to deploy, implement, and maintain using a simple five-step methodology. This guided process helps you identify where you are and where to go.

Identify the protection surface of your environment.

1. Map data transaction flows.
2. Build an architecture using zero trust concepts.
3. Create, communicate, and educate based on a zero-trust policy.
4. Continuously monitor and maintain processes and technologies.

How Important is Zero Trust-based Security?

Zero Trust is one of the most effective ways for organizations to control access to their networks, applications, and data. This concept combines a wide range of preventive techniques, including identity verification and behavioral analysis, micro-segmentation, endpoint security, and least-privilege controls to stop potential intruders and limit their access in the event of a breach.

It is not enough to establish firewall rules and block by packet analysis. A compromised account that goes through authentication protocols on a network perimeter device must still be assessed for each subsequent session or endpoint it tries to access.

Having the technology to recognize normal versus anomalous behavior allows organizations to tighten authentication controls and policies rather than taking over the connection via VPN or SWG (Secure Web Gateway), which means the connection is completely secure and reliable.

This additional layer of security is critical as companies increase the number of endpoints on their network and expand their infrastructure to include cloud-based applications and servers, not to mention the boom of service accounts on microsites and other locally-hosted machines, VM, or via SaaS.

These trends make it more difficult to establish, monitor and maintain secure perimeters. Additionally, a borderless security strategy is vital for organizations as a global workforce that offers employees the ability to work remotely.

What Are the Benefits of a Zero Trust Approach?

The main benefits of a zero-trust model for protecting systems, information, and other valuable assets for businesses are:

Superior risk mitigation by closing security breaches and controlling lateral movement in the net.

• Improved cybersecurity and support for mobile and remote workers.
• Strong protection for applications and data, whether in the cloud or on-premises.
• Reliable defense against advanced threats such as APT (Advanced Persistent Attack).

Finally, by segmenting the network by identity, groups, and role and by controlling user access, zero-trust-based security helps the organization contain breaches and minimize potential damage. This is an important security measure, as some of the more sophisticated attacks are orchestrated by invasive credentials (internal or compromised).

As the classic approach to enterprise security is no longer viable, companies must shift to meet their users’, applications’, and data’s needs wherever they are.

Today, that means the cloud, which offers greater and better flexibility, collaboration, connectivity, and performance.

Learn about senhasegura and check our services! Also read about the 7 Signs Your Business Needs to Improve the Security of Sensitive Data.

This May, the Center for Internet Security (CIS) has launched version 8 of the security control tool for critical systems, especially marked by structural progress aimed at cloud and mobile environments. The concentration of online tasks and the remote work model are becoming increasingly popular due to mobility restrictions caused by the pandemic, which generates, proportionally and positively, technological evolution to ensure the execution of work, social and entertainment activities.

What Is Different?

 CIS Controls v8 is based on the activities performed, not on the user who controls the devices or on the devices themselves. Whereas previous versions focused on a centralized network that grouped all coordination and security endpoints, version 8 tracks virtual changes and assimilates new cyberattack modalities based on real threats cited in Verizon’s 2021 Data Breach Investigations Report.

 Until the previous version (7.1), the set consisted of 20 main controls and 171 sub controls, but the modernization of the system condensed the total to 18 controls and 153 safeguards (yes, the term has also changed!) divided into 3 Implementation Groups (IGs), which work as a practical guide to help organizations of all sizes with their particular needs and to adapt them to current regulations. 

 As IG1 is the primary Implementation Group, every company needs to start with it, as it is considered the set of “basic cyber hygiene” and serves to preserve the information system from the most recurrent attacks. In the current version, it supports 56 safeguards in total, while IG2 has 74 and IG3 has 23 safeguards, making up the complete package.

To ensure essential protection, the following controls must be adopted: 

4: Secure configuration of company assets and software

5: Account management

6: Access control management

14: Security awareness and skills training

 

v8 Extra Points: 

CIS CSAT Pro self-assessment capabilities, with location tracking, optional data sharing, separation of roles and user behavior;

Community Defense Model (CDM) v2.0, with safeguards mapping and consultation of reports released by the industry, which indicate the main threats and frequent attacks;

CIS Controls Mobile Companion Guide and CIS Controls Cloud Companion Guide, which are guides for implementing CIS security best practices for mobile devices such as mobile phones and tablets; and for cloud environments, respectively.

What Does the Launch of Controls v8 Mean? That CIS understood the defense priorities of the critical data environment and streamlined the cybersecurity process. For businesses, the result is the quality of critical system security options and the practicality of complying with regulatory data protection requirements (PCI-DSS, SOx, HIPAA, and others).

Source: https://www.cisecurity.org/blog/18-is-the-new-20-cis-controls-v8-is-here/

Text: Priscilla Silva