22 May Employing a zero-trust policy for your business for COVID-19

Zero-trust provides critical cybersecurity protection

We live in dangerous times. The Coronavirus pandemic has changed how we do things, where we go, what places we can visit, and even how we do our jobs. As a company, you’re also facing down a barrel of struggles, primarily related to cybersecurity. Mainly, that’s because you’re using a remote-work policy (or considering one). 

Remote-working and online models do have great benefits and can keep things productive, even during crisis times. But, it also increases the risk of cybersecurity breaches. Protecting company data was hard enough, but with the explosion of attack surfaces, businesses are finding themselves exposed. 

There are various ways to combat these cyber-threats. If you’ve followed our blogs thus far here at Bytagig, you know some of them. In this article, though, we’ll briefly talk about “zero-trust policies” and its efficacy as a cybersecurity strategy.

What is zero-trust?

Zero-trust is the philosophy of never trusting any connection without undergoing verification methods, whether internal or external. This normally involves rearranging the network architecture of a business to include things like encryption, multi-factor authentication, and sometimes layered networks.

Even if it’s internal or external, the governing idea is to disallow any form of network access until their credentials are verified. It’s not the be-all end-all of solutions and needs to cooperate with the security structure of a business. But when it does, it’s very powerful.

Why use zero-trust?

Given the modern circumstances, the phrase “you can’t be too careful” rings true. If that’s not enough, there’s the factor of cost. From CSO, they report from a study that the global average of cybersecurity damage was over $3 million, the study conducted by the Polemon Institute. In short, the attacks are exceptionally damaging, and the cost continues to rise every year. This is conjunction with more money spent on cybersecurity. Despite the investment, the costs continue to rack up.

Given how many smaller businesses cannot afford downtime or the disaster-result, utilizing zero-trust which – by comparison – is a vastly cheaper alternative, you can understand why it’s efficient. 

Using zero-trust

So, the philosophy is “trust until proven.” Now, how do you take that simple concept and intertwine it into both policy and work structure? There are a few ways, some easier than others, but we’ll break down a few.

Deploying zero-trust is granular. The techniques it uses vary depending on the person, what they want to connect to, and where they’re connecting from. It is, essentially, a mindset, a discipline, and a set of guidelines staff and management must follow. The technology is for helping your business achieve those disciplines and guidelines.

A brief example: two-factor authentication. Before a staff member can log onto the worker VLAN, they must enter their login, and then a TFA code their device has access to. It doesn’t matter if they’re known at work, until these two initial steps are conducted, they cannot access the VLAN.

Notice too, in our example, we said VLAN. This network environment is segmented, meaning while workers have access to it, they cannot access other parts of the VLAN. Think of it as entering a room. To enter other rooms, one has to have the credentials for it.

Thinking differently

While technology plays an obvious role, it comes down to mindset and treating network environments differently. For example, workers typically treat the network environment as “trustworthy and safe.”  In remote working scenarios, it’s easy to fall into that mindset.

“Oh, I logged in, everything should be fine.”

IT experts, firewalls, and all those anti-virus measures will keep the problems out, right? 

Not so much. Threats from within are commonplace, and that’s the zero-trust mindset that has to be adopted. If a remote worker receives an email from staff, how can they be sure it’s legitimate? Trust until verified. 

Challenges of micro-checks and segmentation

These micro-checks and segmentation strategies do require constant work from IT and staff to work efficiently. This is an important aspect to understand, that no matter what, any kind of zero-check process will require effort on all parties. Preventing work slow-down comes with constant effort.

Micro-checks and “trust until verified” are wise strategies, but when adopted poorly, they can tremendously slow down productivity. That solution involves building zero-trust cybersecurity models from the ground up, rather than trying to retroactively fix environments.

Is it right for you?

You can see the benefits that coincide with zero-trust policies. The ultimate question is whether it’s right for your company and remote working solutions.

If you need more information on zero-trust, or implementing a zero-trust policy, contact Bytagig for additional assistance.

Share this post: