By Guy Eisdorfer, co-founder and CEO of Cognni
Over the past few years, digitization has accelerated in almost every business sector. This movement was spurred in large part by the rise of work-from-home arrangements, increased cloud migration, and a greater reliance on the use of big data and AI-powered analytics. For many companies, keeping up with this digital transformation has become essential for maintaining growth and a competitive edge.
But as the pace of digitization has increased, so has the number of high-profile security breaches. According to Forbes, cyberattacks in the first half of 2022 rose by 42 percent, with most of these attacks coming from smaller, more agile hacker groups that have targeted newly digitized companies with poor network security. Such cyberattacks can have dire consequences for targeted companies, resulting in not only financial losses but also reputational harm.
One method of mitigating the risks of cyberattacks is a Zero Trust security framework. Compared to traditional security frameworks, Zero Trust provides a far higher level of security against data breaches by requiring all network users to be authenticated and continuously validated before granting access. Unfortunately, only a mere 14 percent of U.S. companies have so far adopted a Zero Trust framework.
What’s behind this slow adoption? And what can U.S. businesses do to better protect their data and operational security?
What is Zero Trust?
Traditionally, the IT industry has relied on the “castle-and-mote” framework of network security. This method presumed that an organization’s most sensitive data could be protected against outside attacks by requiring the validation of all users going in and out of a network. The problem with this approach was that there was nothing to stop a compromised user account from gaining access. Worse yet, once a bad actor was in the network, they were free to roam around at will since, under this framework, all user accounts within the network are implicitly trusted.
Additional security vulnerabilities of the castle-and-mote framework include the presumption that, for a group to work effectively together, all data should be kept in a single location. In today’s digitized business landscape, this is highly impractical as most organizations now have their data spread out across multiple cloud vendors.
For these reasons, the Zero Trust framework arose to address the security needs of today’s digitized cloud-driven organizations. Rooted in the principle of “never trust, always verify,” Zero
Trust requires all users, both outside and inside the network, to be continuously verified before being granted access to data on the network. In addition, Zero Trust also follows the principle of least-privilege access, which means users are only granted as much access as they need to complete a task, thus limiting their access to more sensitive parts of the network.
Why the slow adoption of Zero Trust?
Despite the many benefits of Zero Trust, many organizations have been slow to implement it for a variety of reasons. For a start, implementation can be highly complex since all devices, network accounts, and cloud-based assets must be cataloged for the purposes of identity verification. This can be a huge undertaking for organizations with thousands of devices, especially when it comes to remote workers who use their own private work devices.
In addition, budget constraints can limit the scope and speed of implementing a Zero Trust system. The average transition time can take anywhere from one to three years for large enterprises, the cost of which can seem prohibitive in today’s cost-conscious environment.
Another challenge is user resistance to change. Many employees and senior management at an organization may be used to the ease of access and user-friendliness of the company’s current system. Zero Trust, with its requirements for repeated logins, re-verifications, and least-privilege access can seem like a chore to deal with, especially when users don’t fully understand the necessity for upgrading the company’s security infrastructure.
How to build a Zero Trust framework
While the transition to Zero Trust can be difficult, it doesn’t have to be when an organization approaches the task in a clear and deliberate manner. To start off, the organization should devise a step-by-step plan that lays out each stage in the transition. For example, step one might be to identify all users and devices that will be connected to the network, while step 2 would be to set up access controls. Other steps include slowly rolling out the new system with a few test groups and making improvements before expanding to the rest of the organization.
If senior management is still ambivalent about the switch to Zero Trust, show them the latest cyberattack statistics and the potential losses the company might incur by not implementing Zero Trust. Any budgetary concerns will be more than offset by demonstrating the cost of even one cyberattack to the company, both in lost revenue and reputation damage. Plus, the implementation cost can be amortized over many months or years.
How else can companies improve their data security?
As any IT specialist will tell you, data security is a never-ending battle that requires constant vigilance. Even with a Zero Trust framework in place, organizations must still follow best practices
to ensure their data remains secure. For instance, the company should carry out regular security audits to identify vulnerabilities, such as risky user behavior, unencrypted data, or unprotected devices. Data backups should occur regularly, ideally with the “3-2-1 rule” that calls for three different copies of your data on two types of media, with one stored off-site.
Lastly, don’t overlook the importance of ensuring that all employees, both on-site and off-site, receive annual retraining on the latest cybersecurity threats and how to avoid them. The human element is by far the weakest link in any security system, and cybercriminals have become highly sophisticated over the last few years in their methods and capabilities.
Final thoughts
As the old proverb puts it, the best time to repair your roof is when the sun is shining. Organizations that wait until a major security breach takes place before acting on improving their network security are inviting inevitable misfortune. Therefore, it’s better to act now on implementing a Zero Trust system as well as other data security protocols that will ensure your organization’s data remains protected.
Guy Eisdorfer is the co-founder and CEO of Cognni, a leading AI-powered data classification company that provides automated information security risk assessments, privileged account monitoring, and other security products to enterprises and SMBs.
.
Follow Brilliance Security Magazine on Twitter and LinkedIn to ensure you receive alerts for the most up-to-date security and cybersecurity news and information.