Rethink cybersecurity – the Zero Trust evolution

The latest studies leave no room for doubt: employees circumvent security systems in order to work in a faster and more convenient way. Can it be prevented? And how? The key information is that it does not require a modification of the entire IT infrastructure.

Cisco surveyed 2000 professionals from 19 countries in EMEAR (Europe, Middle East, Africa and Russia) and the results of this cybersecurity questionnaire can actually come as a surprise to entrepreneurs. 65% of users aged from 18 to 24 circumvent the company security systems. 54% of employees from the age group of 35–44 do so as well. Such behaviours are motivated by the need of easy access to the work tools and effective performance of duties.

Many companies have invested a lot of time and money to implement the cutting-edge systems for the protection of their resources. Now they find out that these solutions do not work as they should. Why? Well, one of the reasons is that a human being is still the weakest link in the security ecosystem. Today, it is not about replacing IT systems with new ones, but adding new modules that use machine learning and artificial intelligence as well as implementing good security practices and monitoring the compliance with such practices, explains Krzysztof Andrian, CEO at Concept Data.

What companies need is not a revolution, but an evolution. Moreover, it should be an evolution based on the zero trust concept introduced in 2010 and assuming the strict access control and the default mistrust towards everyone who operates in the network or tries to get access. This includes employees, particularly those who enjoy special privileges.

CyberArk Zero Trust

Cisco surveys show that employees like comfort. They do not want to log into systems via multi-step processes or wait for the assignment of access privileges and account creation. That is why they sometimes make errors which can cause costly losses for their employers, e.g. they share their logins and passwords with others or they connect to the company systems outside VPN channels. The next thing you know is a security incident and a data leak.

As estimated by the FBI, the losses resulting from cybersecurity incidents reported to the specialist centre operating at the Federal Bureau of Investigation in 2019 amounted to USD 3.5 billion. A lot of money is at stake here.

Today companies need to ensure full security of the logging process and full control over when and who has access to what information. This is made possible via the new modules included in the offers of IT system manufacturers. One of such solutions is CyberArk Zero Trust from our portfolio, says Krzysztof Andrian.

The Zero Trust Access module by CyberArk enables quick, easy and secure access to sensitive information and data. It eliminates the use of passwords which are easy to intercept or the VPN agents and channels. It introduces multi-factor authentication based on dynamically generated QR codes and biometrics. An employee uses a fingerprint or a facial scan to get access to systems.

Security policies and database protection

Companies are particularly exposed to the threats caused by users with special rights in the systems, i.e. privileged users. They should be given only the necessary and relevant rights, but they must also be monitored in terms of what they do and which data they access. IT solutions can come handy in this respect as well.

Imperva’s systems that we offer provide real-time monitoring and control of all operations in databases and of users who log into databases locally and remotely. As a result, companies get full visibility of who used particular information and when, where and how it was done. In addition, they monitor responses from databased in the context of leaks or security breachers, they detect anomalies and, if needed, they can block such responses, explains Krzysztof Andrian.

The entire IT infrastructure must operate in line with security principles which define user privileges and guidelines for the configuration of individual elements of the IT environment. Relevant IT tools also help to detect irregularities and vulnerabilities in security policies as well as to automatically update the rules and implement modifications. Imperva has equipped its solutions with machine learning algorithms so administrators do not have to set up the policies manually.

Even the most advanced and error-proof systems cannot prevent data leaks if they occur due to the fault of employees. That is why the existing solutions should be extended with modules enabling controlled access to information, applications and databases. Manufacturers of IT systems know this and, following the new approach to the IT environment and its safety, i.e. the rethink cybersecurity rule, they offer impressive solutions that help to improve corporate safeguards. They certainly come with multiple benefits, says Krzysztof Andrian.

More about Zero Trust:

If not VPN then what? The undeniable benefits of Zero Trust solutions

Secure access to data. Why is it so important now and how to implement it in a business setting