Making Your Organisation Cyber Resilient with Zero Trust
Guest blog: There are many journeys to zero trust. Ensure yours leads to greater agility, appropriate security access, and a frictionless experience by Steven Aitken, Customer Success Manager, CyberRes, Micro Focus as part of our #Cyber2021 week
Balance Business Agility with Appropriate Security Access
As organisations adapted to the rapid change in working practices in response to the COVID-19 pandemic, they quickly recognised the need to support agility while enforcing required governance processes. In this shift, more and more organisations have realized that perimeter-based security models, which rely on assumed trust, are no longer enough. What they need are new and better ways of providing security and validating the appropriateness of access.
Increase Cyber Resilience through Zero Trust
The details on how organisations have adapted during this time vary widely, but we’ve seen several specific trends that have enabled some organisations to adapt better than others. One such trend is increasing their cyber resilience through delivering initiatives such as zero trust operating models and ensuring that they have a good view of how risk flows through their IT estate.
Identifying risk and introducing compensating controls to effectively manage that risk have always been important. However, with the rate of business and policy change we’ve seen over the last 12 months, do we have a good handle on what people are allowed to do and not do? How can we manage risk effectively?
Addressing this question is core to enforcing the least privilege model, which in turn, is a core concept of delivering the zero trust operating model. Merely trusting that people have the correct access privileges is no longer enough—much in the same way that trusting a credential and single-factor authentication from an external network isn’t enough. When we move to zero trust, we must continually verify what is appropriate, in the context in which it is presented.
Apply Adaptive, Frictionless Security Controls
In the here and now, this context is typically driven by the continued pressure to maintain a successful business presence while a high percentage of our staff are working remotely. This challenge has led organisations to introduce new technology too quickly or to repurpose existing implementations. In some cases, this has happened outside of standard IT control, which presents unique risks where credentials are being used outside of the internal security zone and on personal devices due to BYOD initiatives.
By using techniques such as device fingerprinting, and risk weighting the identities and systems they access, we can profile access requests for risky activity in real time and apply appropriate security controls at the point of access. These additional layers of security should be as unobtrusive as possible and provide a seamless and frictionless experience for users. This is where adaptive, step-up authentication mechanism comes in. Using this technique, users will only be prompted for a second authentication factor if their risk profile demands it or if they have used a second factor outside an allotted time window—keeping their experience seamless and frictionless wherever possible. It might also be beneficial to look into centralised tools for federated access, ensuring that all sites can be protected by a common set of security controls.
To learn more, visit our Identity and Access Management page on Cyberres.com
Jill Broom
Head of Cyber Resilience, techUK
Jill Broom
Head of Cyber Resilience, techUK
Jill leads the techUK Cyber Security programme, having originally joined techUK in October 2020 as a Programme Manager for the Cyber and Central Government programmes. She is responsible for managing techUK's work across the cyber security ecosystem, bringing industry together with key stakeholders across the public and private sectors. Jill also provides the industry secretariat for the Cyber Growth Partnership, the industry and government conduit for supporting the growth of the sector. A key focus of her work is to strengthen the public–private partnership across cyber to support further development of UK cyber security and resilience policy.
Before joining techUK, Jill worked as a Senior Caseworker for an MP, advocating for local communities, businesses and individuals, so she is particularly committed to techUK’s vision of harnessing the power of technology to improve people’s lives. Jill is also an experienced editorial professional and has delivered copyediting and writing services for public-body and SME clients as well as publishers.
Programme Manager, Cyber Security and Central Government, techUK
Annie Collings
Programme Manager, Cyber Security and Central Government, techUK
Annie joined techUK as the Programme Manager for Cyber Security and Central Government in September 2023. In this role, she supports the Cyber Security SME Forum, engaging regularly with key government and industry stakeholders to advance the growth and development of SMEs in the cyber sector.
Before joining techUK, Annie was an Account Manager at a specialist healthcare agency, where she provided public affairs support to a wide range of medical technology clients. She also gained experience as an intern in both an MP’s constituency office and with the Association of Independent Professionals and the Self-Employed. Annie holds a degree in International Relations from Nottingham Trent University.
Prior to joining techUK, Raya worked in Business Development for an expert network firm within the institutional investment space. Before this Raya spent a year in industry working for a tech start-up in London as part of their Growth team which included the formation and development of a 'Let's Talk Tech' podcast and involvement in London Tech Week.
Raya has a degree in Politics and International Relations (Bsc Hons) from the University of Bath where she focused primarily on national security and counter-terrorism policies, centreing research on female-led terrorism and specific approaches to justice there.
Outside of work, Raya's interests include baking, spin classes and true-crime Netflix shows!
Tracy supports several areas at techUK, including Cyber Exchange, Cyber Security, Defence, Health and Social Care, Local Public Services, Nations and Regions and National Security.
Tracy joined techUK in March 2022, having worked in the education sector for 19 years, covering administration, research project support, IT support and event/training support. My most outstanding achievement has been running three very successful international conferences and over 300 training courses booked all over the globe!
Tracy has a great interest in tech. Gaming and computing have been a big part of her life, and now electric cars are an exciting look at the future. She has warmed to Alexa, even though it can sometimes be sassy!