Zero trust: Rethink security, and redefine resilience

In recent years, amid the rise of remote and hybrid work arrangements, organizations have grappled to secure their newfound digital territories, providing cybercriminals with fresh hunting grounds in unsecured home networks, personal devices, and weak authentication practices. Cybercriminals have capitalized on the opportunity to exploit these vulnerabilities, leading to a surge in cyber-attacks targeting individuals and organizations. Data from CERT-In reveals that India encountered over 13.91 lakh cyber-attacks in 2022, underscoring the urgency to address vulnerabilities in IT infrastructure. Cybersecurity has now become a top priority for organizations as they seek to safeguard their assets, user data, and reputation against these evolving cyber threats.

To navigate the hybrid world securely, traditional cybersecurity approaches may no longer suffice in protecting organizations from the increasing sophistication of cyber threats. According to a recent Cisco report, while 80 percent of respondents in India said they had experienced a cybersecurity incident in the past 12 months, 81 percent of them confided that it cost them at least $100,000. As businesses press forward with transformation, security must emerge as an indispensable partner driving this change. The borderless nature of our digital interactions requires an adaptive and comprehensive approach – one that combines resilience and an evolving security paradigm. This is where the Zero Trust approach to security becomes crucial.

Zero Trust foundational to building security resilience

Zero Trust is foundational to building security resilience and strengthening the ability to withstand unpredictable threats or changes and emerge stronger. Through zero trust, the identity and security posture of users, devices, and applications are continuously checked and verified to prevent network intrusions — and to also limit impact if an unauthorized entity does gain access.

The Zero Trust principle of "never trust, always verify and enforce least privilege" are being widely adopted by organizations as they undergo transitions like moving to the cloud, hybrid workforce, and increasingly face sophisticated attacks. While the concept has been discussed for many years now, but it has only recently gained traction with organizations to better secure their environments. According to the CISA, “The five pillars of the Zero Trust Maturity Model are: Identity; Devices; Network, Data, and Applications and Workloads.” This is an example of the key aspects of an enterprise that need to be protected. 

To put a finer point on it, trust is ephemeral and impermanent. Take for example, passwords. They are a control but not a security one. Typically, we can point to the analogy of the house key. A person can lock the front door when they head off to work in the morning knowing that their accumulated possessions will have some level of protection. The problem here is that this does nothing in the event of someone of negative intent who finds the key or, worse still, picks the lock. Technologies such as multifactor authentication can help obviate this problem. 

Communication is integral in strengthening foundations of Zero Trust 

The success of implementing a Zero Trust security framework is dependent not only on technical aspects but also on effective communication across the organization. A cohesive and collaborative communication strategy is essential for Zero Trust to be successfully implemented and sustained as the architecture is built on the principles of continuous verification, strong identity management, and granular access controls.

An important thing to be kept in mind is creating a shared vision across the organization. Implementing Zero Trust involves a fundamental shift in the organization's security mindset and requires all stakeholders – right from the leadership to IT teams - to understand and embrace the concept. Each member needs to understand what Zero Trust means for the organization, the benefits it offers, and the responsibilities of different teams in its roll out.

While support and buy-in of top-level executives are essential, it is also important that various departments, including IT, security, HR, legal, and other business units, collaborate well and that everyone understands their roles and responsibilities on the Zero Trust journey. Organizations must also invest in educating employees on the security practices. The staff needs to be aware of the best practices, recognize the importance of strong authentication, and understand that access controls are critical. Organizations should conduct regular security awareness training and communication to build a security-conscious culture and reduce the likelihood of insider threats or human errors.

Embracing Zero Trust for a Secure Tomorrow

Organizational resilience has never been more critical for the survival and success of businesses, and the ability to adapt and innovate would be key to thriving in a dynamic business environment. As cyber threats continue to evolve, Zero Trust is set to play a critical role in safeguarding organizations and ensuring a resilient cybersecurity posture for the digital age.

The article has been written by Samir Kumar Mishra, Director, Security Business, Cisco India & SAARC