What CISOs Should Understand About the Zero Trust Security Model

CISOs and CTOs have a more complicated job amid COVID-19 as McKinsey research reported that 58% of employees in the United States, which is around 92 million people, are currently working remotely at least part of the time. On top of the rise of remote work, bring-your-own-device (BYOD) policies, and employers giving employees more flexibility insofar as where, when, and how the work gets done, the modern workforce is always on the move, bringing new dangerous and advanced cybersecurity risks to organizations.

CISOs understand that intellectual property, customer data, and other valuable information should be protected while avoiding business system downtime and protecting key applications. It’s the juggling act of needing to protect everything without getting in the way of day-to-day employee responsibilities.

A traditional cybersecurity approach for organizations assumes that any user, device, or infrastructure that falls under the umbrella of the corporate network is automatically considered trustworthy. This approach is no longer the case (just need one common example). Applications have come out from behind the firewall, and end users can access sensitive data and information from a personal device through their own personal network from home.

A conventional security approach for organizations is a perimeter-based model, where the IT team creates a network security perimeter where important assets are protected, and hackers will have a hard time accessing the applications or data. However, this approach also presents some issues as it requires trust that the security perimeter is actually secure, including all the end users involved. This approach also assumes a centralized on-premises network that is not based on Cloud architecture or digital workspace that may also include SaaS applications and programs.

Traditional security approaches have evolved, and the Zero Trust Security Model was meant for this moment - regardless of size and scope - to support remote and hybrid work environments and minimize cybersecurity risks by limiting the exposure to fast-moving attacks and 0-day threats that can evade traditional security approaches. In essence, zero trust is a security model that does not permit access to, for example, IP addresses until the user is authorized. While the idea of zero trust architecture has been present in our lives for over a decade, the recent changes in how and where people work has increased the importance of the zero trust model.

According to a recent global survey, 41 percent of respondents have reported plans to adopt a zero trust strategy and are already in the early stages of enacting this model. In the same survey, generally, 80 percent of respondents have plans of adopting zero trust in the future or have already adopted it. Organizations are already starting to understand the utmost importance of keeping secure data by moving towards zero trust, especially as more employees are working remotely in response to the pandemic.

Summarized as "never trust, always verify," zero trust requires any user or IT resource to be properly verified prior to authentication to prevent unauthorized users or malicious actors from reaching the environment. Adoption can protect against top security issues – such as phishing attacks, malware, and data theft – by protecting users, their devices, and the applications they have access to. When zero trust is in place within the organizations, CISOs should adhere to the following principles:

It should be important to note that work environments are integrating on-premise with multi-Cloud infrastructures and SaaS applications that can leave multiple entry points open for cyber intruders to move seamlessly and easily within a network. This leaves users more susceptible than ever to malware and different forms of phishing attacks and malware, which all organizations need to be cognizant about. The way forward for C-level buyers to the new era of work is by implementing a zero trust security model to enhance the organizational cybersecurity posture.

Michael Gray is the CTO of Thrive.

Related articles: