Making Your Organisation Cyber Resilient with Zero Trust
Balance Business Agility with Appropriate Security Access
As organisations adapted to the rapid change in working practices in response to the COVID-19 pandemic, they quickly recognised the need to support agility while enforcing required governance processes. In this shift, more and more organisations have realized that perimeter-based security models, which rely on assumed trust, are no longer enough. What they need are new and better ways of providing security and validating the appropriateness of access.
Increase Cyber Resilience through Zero Trust
The details on how organisations have adapted during this time vary widely, but we’ve seen several specific trends that have enabled some organisations to adapt better than others. One such trend is increasing their cyber resilience through delivering initiatives such as zero trust operating models and ensuring that they have a good view of how risk flows through their IT estate.
Identifying risk and introducing compensating controls to effectively manage that risk have always been important. However, with the rate of business and policy change we’ve seen over the last 12 months, do we have a good handle on what people are allowed to do and not do? How can we manage risk effectively?
Addressing this question is core to enforcing the least privilege model, which in turn, is a core concept of delivering the zero trust operating model. Merely trusting that people have the correct access privileges is no longer enough—much in the same way that trusting a credential and single-factor authentication from an external network isn’t enough. When we move to zero trust, we must continually verify what is appropriate, in the context in which it is presented.
Apply Adaptive, Frictionless Security Controls
In the here and now, this context is typically driven by the continued pressure to maintain a successful business presence while a high percentage of our staff are working remotely. This challenge has led organisations to introduce new technology too quickly or to repurpose existing implementations. In some cases, this has happened outside of standard IT control, which presents unique risks where credentials are being used outside of the internal security zone and on personal devices due to BYOD initiatives.
By using techniques such as device fingerprinting, and risk weighting the identities and systems they access, we can profile access requests for risky activity in real time and apply appropriate security controls at the point of access. These additional layers of security should be as unobtrusive as possible and provide a seamless and frictionless experience for users. This is where adaptive, step-up authentication mechanism comes in. Using this technique, users will only be prompted for a second authentication factor if their risk profile demands it or if they have used a second factor outside an allotted time window—keeping their experience seamless and frictionless wherever possible. It might also be beneficial to look into centralised tools for federated access, ensuring that all sites can be protected by a common set of security controls.
To learn more, visit our Identity and Access Management page on Cyberres.com
Dan Patefield
Dan Patefield
Dan leads the techUK Cyber Security programme, having originally joined techUK in August 2017 as a Programme Manager working across the Cyber and Defence programmes. He is responsible for managing techUK's work across the cyber security eco-system, bringing industry together with key stakeholders across the public and private sectors. Dan also provides the industry secretariat for the Cyber Growth Partnership, the industry and Governmnet conduit for supporting growth across the sector. A key focus of his work is to strengthen the public-private partnership across cyber security to support further development of UK cyber security policy.
Before joining techUK he worked as Forum Lead for the Westminster eForum. In this role he had a focus on the technology and telecoms space, on issues ranging from Broadband and Mobile Infrastructure, the Internet of Things, Cyber Security, Data and diversity in tech. Dan has a BA in History from the University of Liverpool.
- Email:
- [email protected]
- Phone:
- 020 7331 2165
Jill Broom
Jill Broom
Jill is techUK’s Programme Manager for Cyber Security, working across the cyber eco-system to bring industry together with key stakeholders across the public and private sectors.
Prior to focusing in on techUK's cyber security work, Jill was also part of techUK's Central Government programme team, representing the supplier community of technology products and services to Whitehall departments.
Before joining techUK, Jill worked as a Senior Caseworker for an MP, advocating for local communities, businesses and individuals, so she is particularly committed to techUK’s vision of harnessing the power of technology to improve people’s lives. Jill is also an experienced editorial professional and has delivered copyediting and writing services for public-body and SME clients as well as publishers.
- Email:
- [email protected]
- Twitter:
- @honeybroom
- Website:
- www.techuk.org
- LinkedIn:
- https://www.linkedin.com/in/jill-broom-19aa824
Annie Collings
Annie Collings
Annie joined techUK as the Programme Manager for Cyber Security and Central Government in September 2023.
Prior to joining techUK, Annie worked as an Account Manager at PLMR Healthcomms, a specialist healthcare agency providing public affairs support to a wide range of medical technology clients. Annie also spent time as an Intern in an MPs constituency office and as an Intern at the Association of Independent Professionals and the Self-Employed.
Annie graduated from Nottingham Trent University, where she was an active member of the lacrosse society.
- Email:
- [email protected]
- Twitter:
- anniecollings24
- LinkedIn:
- https://www.linkedin.com/in/annie-collings-270150158/