Transforming into a cyber resilient organisation

Ralph Berndt, Sales and Marketing Director at inq. SA.

---

The premise behind zero trust is well-documented. Corporate networks should never blindly trust any device or user. Instead, the focus is on verifying and authenticating each interaction and communication before allowing access. But is complete zero trust possible or will it remain an elusive goal when it comes to building a cyber resilient business?

Of course, implementing zero trust is a complex and challenging process. This requires companies to make significant changes to their existing security infrastructure and processes. From rethinking traditional trust models and investing in new technologies to developing robust identity and access management systems, there is much to be done. And yet, zero trust is not a silver bullet for network security to overcome all operational challenges around the cyber secure environment. Business must view it as part of an ongoing journey that requires them to continuously assess their security posture, update their systems and processes and adapt to new threats and attack vectors.

There are several things to consider when it comes to embarking on the zero trust journey. Firstly, implementing a robust identity and access management (IAM) system that can accurately identify and authenticate users, devices and applications, should be the cornerstone. This will encompass multi-factor authentication, device management and encryption to secure access.

From an identity management perspective, companies need to include Active Directory, Azure AD and the myriad lesser known options to ensure a completely integrated environment. These must be reviewed periodically, especially from a security group perspective. Organisations need to remember to leave administrative group memberships empty, only adding members during maintenance windows.

From there, the thinking moves towards the concept of least privilege. This sees them only granting access to sensitive data and systems to those who need it to do their jobs. Least privilege immediately helps to reduce the attack surface and minimises the impact of a breach. 

Segmentation, where the network is segmented into different security zones, and micro-segmentation, a technique for creating multiple security zones within a network, are other important considerations. These empower companies to enforce different security policies based on the level of trust associated with different devices, users and applications.

Employee training and awareness campaigns are also vital in the transition to zero trust. Businesses must remain cognisant of the role employees play in protecting sensitive data and systems. Performing frequent simulated phishing and other cyber attack exercises to test employees' ability to recognise and respond to such attempts can prove to be invaluable in becoming more cyber resilient.

Technologies like machine learning (ML), automation and the internet of things (IOT) can play an important role in achieving zero trust. These can be leveraged to assist businesses to detect, prevent and respond to threats more effectively.

For example, ML algorithms can be used to analyse large amounts of data and identify patterns and anomalies that may indicate a threat. For its part, automation can be used to streamline security processes and reduce the risk of human error. So, security teams can use automation to quickly respond to alerts, update security policies or isolate affected systems.

The growth of IOT devices present companies with unique security challenges. To address these, IT teams must implement secure IOT device management while also incorporating all these edge devices into their overall zero trust strategy.

By integrating ML, automation and IOT into their security architecture, businesses can build a more resilient security posture that is better equipped to detect and respond to threats. However, it is not a once-off process.

Companies must use these technologies to continuously monitor their networks and security posture. In doing so, they will be able to identify areas for improvement and adjust their security architecture and policies as needed to stay ahead of evolving threats.