What Is Zero Trust?

The accelerated move to the cloud, increased use of BYOD, IoT and shadow IT, and an abrupt shift to working from home have exponentially complicated the IT security landscape. Cybersecurity professionals must provide secure access to company resources from any location and asset, protected interactions with business partners, and shield client-server and inter-server communications from malicious or unauthorized usage.

At the same time, adversaries are more sophisticated and targeted in their approach. As a result, they are infiltrating deeper, dwelling longer, imposing an incalculable cost, and doing significantly more damage.

As organizations look to defend increasingly complex IT environments against more sophisticated threat actors, the concept of a Zero Trust Architecture (ZTA) is growing in prominence and prevalence. Several high-profile cyber intrusion events involving the software supply in 2020 led NSA and DISA to issue guidance specifically recommending that US government organizations and their industry partners implement ZTA to combat active threats to systems and data. The White House recently issued similar guidance.

Zero Trust in Action

Insider Threats: Traditional identity and access management strategies operate on the idea of least privilege access, where a user who is authenticated inside the firewall is generally considered safe. However, the biggest threat to cybersecurity is your employees. Nearly 70% of enterprises state that they are worried about an inside cyberattack. ZTA handles the insider threat by continually verifying a user’s access to the system and challenging each request to data and applications to ensure roles and authorization.

Data Loss Prevention (DLP): As more data is stored in the cloud and on endpoint devices, and data growth compounds exponentially, companies need effective strategies for monitoring data at rest, in use, and in transit, along with handling requests that come from both within and outside the corporate firewall. When it comes to detecting data loss, suspicious user behaviors and anomalous access patterns are your primary indicators of threat. An effective ZTA strategy monitors each data access request, even after a user or process has been authenticated, and tracks usage patterns, so anomalies are detected in real-time. With actionable threat- and behavior-based analytics, you can detect attacks earlier in the attack lifecycle with greater confidence

Changing Risks: Cyber threats are a constantly evolving and shifting landscape, and your ZTA needs to be flexible enough to handle changing risks. Malware, vulnerabilities, phishing attempts, and more add new elements and adversaries that need to be detected, caught, managed, and eradicated before they can damage your environment or steal your data or IP. Stopping outside or anomalous attacks are only half of the strategy; ZTA must also account for viruses and phishing attacks that take advantage of the users and accounts that have trusted and verified access to your data and applications. In these cases, it’s imperative that you have automated detection of suspicious activity that alerts your SOC or system owners as it happens.

Fidelis Cybersecurity and Zero Trust

Predictive defense: 

• Identify interesting events and activities to help focus and direct threat hunter activities where they should be looking. Threat intelligence keeps these threat hunters and automated attack detection rule sets current.
• At the same time, frameworks like MITRE ATT&CK help analysts string together seemingly random events and put them in the context of a broader attack campaign.

Proactive Defense: 

• Adding smart Deception in your environment with decoy assets and users.
• Gaining pervasive and continuous visibility on your terrain with identification and tracking of assets as well as assessment of risk on the terrain.
• Enabling threat hunting within your environment through the lens of an attacker — to detect, investigate, analyze, mitigate, and track anomalous activity for threats that might have breached perimeter defense.

Retrospective Analysis: 

• Apply threat intelligence based on newly identified threats against historical metadata—automatically and continuously to flag a past compromise. Security analysts can then apply proactive defense and response techniques to eradicate the attacker.