By Tim Boivin
“The world changes, the world evolves, and the risks change as well…the risks that we keep our eyes on the most now are cyber risks; that’s really where the risk is now, rather than something that looked like the global financial crisis.”
– U.S. Federal Reserve Chairman Jay Powell
When my son was first learning how to drive a car, my advice to him was simple: Bad news doesn’t get better with time.
If he got a ticket, if he had an accident, if he was backing up and hit a light standard in the high school parking lot, leaving a scratch the length of the car…well, it is always better to let your parents know about it right away.
Bad news doesn’t get better with time.
The same maxim holds true for managing risk across your infrastructure. But if you believe the headlines, it seems the news is only getting worse – much worse – all the time.
It doesn’t have to.
Here at PortSys, we scratch our heads about the state of risk management and cybersecurity today. In our opinion, this truly has become an economic, political and military battlefield. Yet many organizations – in virtually every vertical industry – are still moving much too slowly to address the root cause of the problem: inadequately secured access to enterprise resources, both local and cloud.
- Solar Winds hackers gained access to tens of thousands of organizations
- GDPR swamped with 121,165 data breach notifications – a 19% increase
It’s truly frustrating when we see such a huge increase in mind-boggling headlines about the size, scope and cost of cyberattacks year after year, with no let-up in sight. Especially when we know this pain could be avoided if enterprise organizations took a Zero Trust approach to access control.
What will it take?
The headlines alone should be enough to get your attention. But do they? Or do you read them day after day, shrug your shoulders, cross your fingers, hope for the best, and continue to go about your normal workday?
- 52% of organizations hit by malware from remote device in 2020 – a 41% increase
- Move to remote workforce helps fraudsters flood collaboration tools with malware
Here’s the problem with that approach: Your attack surface has grown exponentially over the past three decades – and even more so since the beginning of the pandemic – with much of your workforce logging in remotely to do their jobs and expanding your attack surface.
The movement for employees to work from home (WFH) literally opens the doors to your infrastructure from pretty much everywhere. The simple truth is that despite repeated, big-ticket IT security investments over the past 30 years, with today’s WFH digital ecosystem, hackers can – and do – take advantage of the rapidly growing exposed vulnerabilities now available to them across your infrastructure to launch damaging, costly attacks. There are far too many unsecured devices tapping into the poorly protected resources and applications of today’s hybrid enterprise.
Economic losses from those cyberattacks can – and often do – quickly add up. Looking at IT security as just a cost of doing business ultimately has a profound, significant impact on your bottom line – whether through lost productivity, acceding to ransomware demands, or paying fines to regulatory authorities for lax security.
- Malware attack expected to cost Office Depot subsidiary CompuCom $20M
- National Securities Corporation to pay a $3 million fine to New York State for data breaches
Your organization’s daily cybersecurity challenge quickly becomes even more exacerbated when you factor in all the shadow IT, business partners, vendors, cloud providers and other third parties to whom you grant access to your network resources and applications – knowingly and unknowingly.
- 2 mega-breaches highlight 3rd-party cyber risks
- Investigators think hackers tapped into water system by exploiting weak password protection
And that situation will only continue to get worse with the ongoing global cybersecurity skilled staffing shortage.
Bottom line: Chances are your organization doesn’t have all the resources – human, financial, or technical – it needs to effectively secure your enterprise.
Now for the Good News – Zero Trust Access
So that’s the bad news, and there’s plenty of it. But there is good news as well.
Many – if not most – of the challenges mentioned above can be quickly, cost-effectively and comprehensively addressed through a Zero Trust Access (ZTA) approach to securing your enterprise. ZTA can consolidate access to all your resources, local and cloud – including web and legacy applications, cloud, software as a service, SSH and other types of access – into one solution.
That’s where Zero Trust comes in, but it’s a confusing marketplace. Last year, after all, there were more than 90 companies offering Zero Trust solutions at RSA.
But why focus on access control?
We break down the Zero Trust solutions into three categories: identity-focused, data-focused, and access-focused. Much like Goldilocks and the Three Bears, the challenge here is to get the focus of your Zero Trust solution just right.
- OMDIA – On the Radar: PortSys offers a zero-trust access solution
- TAG Cyber – Go in-depth on Zero Trust Access
Identity-focused Zero Trust solutions, in most cases, are just too light of an approach to effectively defend against today’s relentless onslaught of threats. They principally rely on shoring up usernames and passwords, which they may enhance with some form of multi-factor authentication, to try to do the job. But identity alone is not security in today’s perimeterless world. Hackers can easily use phishing, password cracking, brute force and business email compromise (BEC) attacks to launch the digital equivalent of jiu-jitsu – using your own credentials against you.
Data-focused Zero Trust solutions, on the other hand, are often too heavy of a lift for many organizations. It’s time-consuming to implement, often taking many months or even years, with the potential need for doing a costly rip-and-replace of your entire security infrastructure. If you can’t deploy a security technology effectively in a timely manner, it cannot protect you.
An access-focused approach to Zero Trust combines and greatly expands upon the best of both the identity- and data-focused approaches, greatly improving security across your extended enterprise without having to rip and replace your existing architecture. Instead, access-based solutions, such as Total Access Control (TAC), allow an accelerated, phased migration as you implement Zero Trust. TAC also seamlessly integrates with your existing infrastructure, applications and network – and can replace and/or enhance your existing security products.
Zero Trust Access (ZTA) solutions enable you to enforce consistent security policies to protect all your resources wherever they may be, local or cloud. They can also allow you to close ports to the outside world for VPN, RDP and other connections as well, significantly reducing your attack surface.
For instance, TAC provides you with the power to consider multiple factors of authentication to evaluate your users’ complete context of access before granting access – including device type, operating system, patch level, antivirus, registry keys, certificates, domain-joined status and more.
- Access Control’s Critical Role in NSA Zero Trust Guidelines
- Mapping TAC’s Zero Trust Architecture to NIST SP 800-207 Standards
TAC then only provides access to resources for which users are authorized, instead of dropping them on your network with free rein to go wherever they want. This approach keeps hackers out, while restricting any approved user to just the resources they have been authorized for under their current context of access, and nothing else.
- Global marketing firm solves Microsoft 365 security issue with Total Access Control
- University Hospital extends secure mobility to improve patient care (Video)
Meanwhile, your authenticated end users only gain access to specific resources from any approved device – including connections to your locally hosted data and applications (including legacy apps), cloud hosted data and applications, thick client solutions and VDI infrastructures like Citrix, RDP and more – providing they meet the requirements for each resource. And, a solution like TAC also provides Single Sign-On and portal-based access too. This type of ZTA approach enables you to unite and strengthen security for all those connections through one common interface – creating a much more predictable and less complicated access experience for your end users so they can do their jobs more efficiently and effectively every day. That goes not only for your internal users, but also for third parties who need access, such as vendors and business partners.
Write Your Own Headlines with Zero Trust Access
As you can see, the news doesn’t have to be all bad when it comes to cybersecurity. You can write your own headlines with an access-based Zero Trust approach that you can quickly implement and strengthen the organization’s security posture and getting a better handle on who is accessing what throughout your entire enterprise. With Zero Trust Access, you can protect your organization the way you want by making your local and cloud security policies consistent, while making your end users more productive.
And you’ll be able to do all this without requiring a huge investment in new technology across your infrastructure – in fact, TAC can provide significant cost savings over the long term as you consolidate the number of security products your organization needs to patch, manage and update into one Zero Trust access-focused solution.
Now those are the kinds of news headlines that will make your C-suite, board and shareholders happy.
