Businesses need data to operate. From sensitive to highly confidential, this diverse range of personal data is extremely valuable to astute cyber-criminals – and it is each organisation’s legal responsibility to guard it.
Whilst large-scale ransomware and Denial-of-Service (DoS) attacks make the headlines, the hackers do not solely go after the big players; far from it. Data breaches affect businesses of all sizes; often with crippling consequences.
According to IBM’s Cost of a Data Breach Report, in 2021 global data breaches cost companies an average of $4.24 million. Increasing by almost 10% from 2020, it was the largest single-year increase in the last seven years.
As you might expect, this upsurge is attributed to our digital transformation; the rapid move to remote and hybrid working, along with the use of SaaS applications and cloud-based storage, all of which creates an increased attack surface and new vulnerabilities.
More than 80% of all cyber-attacks involve credentials use or misuse*.
The average number of credential theft incidents almost tripled over the past two years, as cyber-criminals took advantage of the pandemic**.
Insider threats are one of the most common reasons that a data leak occurs. Whilst insiders can be malicious, Proofpoint’s 2020 research reports that 62% can be connected to a negligent employee**.
Their 2020 Global Report of the Cost of Insider Threats states that the overall average cost of a negligent insider incident was $4.58 million with it taking over 2 months, 77 days, to contain the breach.
In today’s fast-paced companies, it is surprisingly easy to accidentally open your organisation up to data theft. Employees may not be fully aware of the procedures they should follow to ensure that their company device or BYOD, are secure, they may have snoozed important security OS updates; they may unknowingly send tremendously sensitive data to an unsecured location or fall victim to a social engineering scam. Even when you have delivered regular team training regarding internal policies, regulatory and legal requirements, employees may simply forget or knowingly cut a corner or two to make life, quicker and easier.
The digital challenges of today’s businesses demands a new approach to cybersecurity as the perimeter approach becomes far less effective. There is increased focus on the zero-trust security model to secure the modern enterprise’s IT infrastructure.
What is the zero-trust model?
As the name suggests, the data-centric zero-trust model treats every user, device and resource with the utmost suspicion; nothing should be trusted.
Traditional security frameworks have been a contributory factor in a number of serious breaches. After all, once inside and beyond the boundary of the firewall, for example, users can freely roam the network.
The continual access checks of the zero-trust approach will prevent an attacker from moving through your network, completely undetected. With no traditional network edge, the zero-trust security framework requires all users to be authenticated, authorized, and continuously validated before being granted or retaining access. This covers all networks, whether local, in the cloud or hybrid, plus all users and devices wherever they are located.
Zero trust is not a one-size-fits-all approach; every business is different. It is a combination of advanced technologies including next-generation endpoint security, encryption, identity protection and risk-based multi-factor authentication, which verifies a user or systems identification.
What are the three principles of the zero-trust architecture?
Continuous verification. Always verify access, for all users, devices and resources, all of the time. To work effectively this must allow verification without restricting the user experience unless risk changes.
Limit the “blast radius.” By limiting the scope that credentials provide, identity-based micro-segmentation provides time for mitigation should an attack occur. The principle of least privilege is also applied to enable the task to be completed with the minimum access required.
Automate context collection and response. Behavioural data from user credentials, workloads, networks and endpoints, amongst others are used to gather context to inform the most appropriate response.
What are the benefits of the zero-trust model?
As one of today’s best cybersecurity models, every organisation can benefit from this approach. If your organisation operates using multi-cloud and hybrid structures, SaaS, legacy systems or has unmanaged devices, you will see immediate benefits from zero-trust model deployment. CISOs find it essential when addressing threats, including ransomware, supply-chain attacks and insider threats.
Prevent insider attacks.
By assuming that even those classed as authorised users present a significant risk, the biggest benefit of the zero-trust model is the prevention of insider threats. Its granular security repeatedly asks for verification at multiple checkpoints, which usually request different forms of security clearance.
Think of it like the multiple passport checks as you travel through an airport – The more ‘security gates’, the greater the chance of stopping criminals from running rampant through your network.
Reduce risk.
As everything accessing your network has passed multi-factor authentication, security authorisation requirements and micro-segmentation, the risk of an attack or worse, a data breach is substantially reduced. Anything suspicious is immediately shut down, lateral movement is prevented and hackers cannot gain access to the secure areas – helping you to protect company data and prevent a serious breach.
Increase visibility and control over cloud environments.
Our widespread transition to the cloud brought with it increased vulnerabilities but improved monitoring and alerts provide real-time visibility. Under the zero-trust model, protection travels with the workload; its level of security remains the same when the environment changes from an on-premises network to the cloud.
Remain compliant.
Zero-trust segmentation defines perimeters around sensitive data, lowering the risk of a data leak and improving detection time, should it occur. The approach offers another layer of protection, preventing unlawful access to your data. Helping you avoid any data governance issues through demonstration of your compliance with any industry-specific legislation and the national data protection laws, such as the EU and UK GDPR.
Zero-trust can also save companies from non-compliance fines, the average cost has increased by 45% in the last decade+.
Streamline your security policy.
Within traditional frameworks, each security method is configured separately. Zero-trust creates one universal policy throughout the entire corporation, alleviating administrative pressures. This streamlines the process but it also reduces the likelihood of any security gaps.
Save money.
By reducing security complexity and management, businesses will save operational costs, but by far, the biggest cost-savings delivered by zero-trust is the prevention of any loss of data, non-compliance fines and associated damage to the company’s reputation. Even if you are unfortunate enough for a breach to still occur, by limiting impact, you will be saving your company thousands.
IBM suggests that organisations with full zero-trust security deployment
save 43% in costs from data breaches – on average, saving $1.76 million per breach^.
Maintain an accurate infrastructure inventory.
Under this model, administrators must know exactly what users, devices, data, applications and services are incorporated in the IT infrastructure. It also helps with device lifetime management, upgrade planning and ensures that your IT asset disposal policy is followed.
Your asset management processes need to reflect the change in your security model, highlighting the importance of data destruction and secure IT asset disposal. The zero-trust should extend to the data security of end of life IT assets such as laptops; it should consider mobile device recycling and data centre decommissioning.
Cloud storage and remote working can still leave an awful lot of sensitive data residing on redundant IT assets. This equipment should always undergo professional sanitisation by IT asset disposition services or a trusted ITAD partner. Crucially, this also provides an ITAD chain of custody and an IT asset disposal accreditation for each piece of redundant IT equipment.
The zero-trust model provides an extended security ecosystem covering employees, devices and workload security along with the protection of your network and data.
The security perimeter is no longer confined to physical office walls. Replacing traditional models, zero-trust is one of the best cybersecurity approaches, it prevents data breaches, insider threats, and data modification, delivering numerous operational benefits, cost savings and a great return on investment for your highly effective data security strategy.
Providing comprehensive data erasure services and IT asset disposal, tier1 provides environmentally friendly ITAD and data destruction, helping businesses remain compliant with data protection legislation – avoiding any future data security issues.
Find out more about our secure data erasure services – contact us on 0161 777 1000 or visit tier1.com
* Crowd Strike. ** Proofpoint. 2020 The Cost of Insider Threats Report, + Soft Activity, ^ IBM Security. The Cost of a Data Breach Report 2021.
Resources.
Cyber Talk, Crowd Strike, Soft Activity, Exclusive Networks, Proofpoint, Tech Target, Retire IT, CCR Cyber, IBM Security, Upguard,
