This has led to a concept that is now widely talked about in the field of cybersecurity – distrust. That is to say, enterprise systems must not trust anyone or anything, treat everyone and everything as a potential threat, and must verify them every time they try to gain access. an internal source.
Tushar Haralkar, head of security software engineering sales for IBM’s technology sales in India, noted at our webinar last week that zero trust is not a product or a technology. tools; it’s an overall security strategy that aligns with your business goals. The principle, he said, is to not trust every user, device, application or process. “We need to continually assess companies’ access to sensitive data, looking at information in context. Every connection must prove to be legitimate from a demand perspective,” he said.
Nilesh Shirke, associate partner at EY, said that in the traditional approach, companies focus on securing the perimeters and assume that every user in the network is trusted and removed access. “Today, when everyone is working remotely, workloads are moving to the cloud, and information is shared by APIs, this traditional approach seems vulnerable,” he said.
The pandemic, he said, has posed a new challenge for organizations to secure remote work and identify legitimate users from all sorts of people trying to get
into your network. “We hear about ransomware attacks every day. Being proactive is very important,” he said.
Mayank Vaish, vice president of identity and access management at cybersecurity firm Aujas, said distrust is about identity-focused security – rather than perimeter-based security. Each identity itself, he said, is today a circumference. Vaish says that due to intense automation, the identity of non-humans also becomes very important.
Haralkar said a core principle of no trust should be to allow ‘least privilege’ and provide minimal access based on job roles. “Companies are hardening devices so that only whitelisted application processes have access to data. So even if there is a ransomware attack on any endpoint, it will not be able to access the data,” he said. A big challenge today is also getting consistent security across multiple clouds, he said. Not trusting, he says, will give you visibility into where your important data is, and then you’ll start tracking it closely.
Does distrust slow down access? No, Vaish said. There are technologies like passwordless login that ensure seamless access, he said.
