{"id":5860,"date":"2020-07-26T07:09:14","date_gmt":"2020-07-26T07:09:14","guid":{"rendered":"https:\/\/web3unplugged.io\/blog\/?p=5860"},"modified":"2020-07-26T07:09:16","modified_gmt":"2020-07-26T07:09:16","slug":"zero-trust-a-practical-approach-to-cybersecurity","status":"publish","type":"post","link":"https:\/\/web3unplugged.io\/blog\/zero-trust-a-practical-approach-to-cybersecurity\/","title":{"rendered":"Zero Trust: A Practical Approach To Cybersecurity"},"content":{"rendered":"\n

Trust is a dangerous word in the information technology field, especially when that trust is implicit \u2013 when it\u2019s unqualified or unquestioned.<\/p>\n\n\n\n

Creating a large, sealed-off corporate network security perimeter and trusting everything inside of it ha<\/a>s proven time and again to be a flawed design. The old \u201ccorporate network\u201d model with static defenses is incompatible with the cloud, transient users, remote working or unknown devices. A paradigm shift is required.<\/p>\n\n\n\n

Zero trust is a holistic approach to security that addresses threats and changes in how businesses work. It’s a model and a philosophy for organizations on how to think about and how to do security. The model guides you to treat all devices as if they were internet-facing and, instead of having one single perimeter, you must create many micro perimeters (or microsegments), applying checks and controls around everything and between everything. Some of the benefits of adopting a zero trust model are<\/p>\n\n\n\n

Control of the entire IT estate<\/strong><\/p>\n\n\n\n

From inside the office all the way to the cloud platforms you use. No more lack of control outside the corporate perimeter or struggles with remote users.<\/p>\n\n\n\n

Manage and secure all users in the same way<\/strong><\/p>\n\n\n\n

By no longer seeing things as inside or outside the corporate perimeter, you can treat all users in the same way. This both simplifies IT security while also ensuring all devices and users are treated equally.<\/p>\n\n\n\n

Maintain security even when you don\u2019t own\/have full control over the infrastructure in use<\/strong> By using identity, location, device health, MFA, and overlaying monitoring and analysis, you\u2019re still able to have strong security across any kind of environment, platform, or service.<\/p>\n\n\n\n

Drastically reduce the movement of malware or attackers<\/strong><\/p>\n\n\n\n

Rather than having free rein of the entire network once they\u2019re inside, attackers only have access to the bare minimum of systems the compromised user had access to. By continuing to distrust the authenticated user, checks will be in place between those systems, further limiting the ability to spread.<\/p>\n\n\n\n

From a disease control perspective, social distancing and a complete lockdown is a concept that is extremely useful, when it\u2019s well-implemented. It\u2019s the same with zero trust in the cyber security world. Currently cybersecurity experts suggest trust nothing. Ever. For when you trust nothing, you are forced to seek relevant security measures wherever there is a risk. Verify everything. Do not assume that passing a check naturally affords trust. Having credentials doesn\u2019t mean you are trustable. It just means you have credentials. And credentials can be stolen. Zero trust is the ultimate security model that will protect organizations from all kinds of cyber threats and assist in business continuity during the pandemic.<\/p>\n\n\n\n

It takes a lot of technologies to secure all the resources and assets you\u2019ll have on a network. A zero trust technology stack needs to address two major areas \u2013 the management of zero trust, and the security and control of your various resources and assets.<\/p>\n\n\n\n

Management is broken into three sub-areas:<\/p>\n\n\n\n