InsightaaS: IT World Canada is the country’s leading IT trade publisher. It provides a “pulse of the industry” view that is valued by buyers and sellers alike, and also produces longer-format pieces on key IT issues.
Today’s featured post is based on an interview with Forrester principal security analyst John Kindervag (who, parenthetically, was featured last year on ATN, with a really unique take on IoT rendered in the style of Dr. Seuss). In the IT World Canada piece, Kindervag walks through a framework for development of a “Zero Trust network” that protects against threats inside as well as outside the enterprise.
It’s pretty well recognized that employees themselves (as a consequence of errors, negligence or malfeasance) can be an important vulnerability source: the InsightaaS whitepaper “Success and Profitability: Security and the value of IT/business solutions,” published last August, presents a four-layer model of security which includes protection against employee vulnerabilities, and it in turn follows on other research and expert commentary highlighting employees as a source of exposure inside the network security perimeter. Kindervag’s breakthrough isn’t in shining new light on a recognized issue, but instead, on separating individual personalities from the actions that security frameworks need to address. Kindervag is quoted in the IT World Canada article as saying that the issue isn’t people or trust, but “something much more profound in this digital age, and that’s people aren’t packets. You don’t need trust to move a packet from Point A to Point B. You just need routing protocols” – and these protocols, he says, hold the key to a more effective and holistic approach to security. Kindervag offers five steps to a zero trust” approach to security: identify and classify data, understand and optimize the ways in which data flows across the network, architect the solution based on these flows, create automated rules to enforce access controls and flag unexpected patterns, and “monitor the network to see where more insight is needed.” This focus on understanding and optimizing data flows and then focusing on variances creates a facility to protect against a wide range of threat sources – internal and external. It’s good advice for security professionals looking for ways to keep pace with the accelerating sophistication of attackers and attacks.
There’s a way CSOs can boost network security without costing a nickel — trust no one.
That’s the advice of John Kindervag, principal security analyst at Forrester Research, who for several years has been advocating organizations set up a Zero Trust network architecture as the first step in a strong defence against external and internal attacks.
Simply, the idea is to limit access to sensitive data to only those that need it.
The concept is getting more support with every successful publicized data breach.
It could have stopped the latest breach, in which tens of millions of personal accounts were stolen from U.S. private health care provider Anthem Inc., Kindervag said in an interview.
Zero Trust “is data centric, so its designed to stop data breaches. Because it’s at the center of the data center where you can see things it has the greatest hope of architecturally being able to stop it across all egress points…”
Read the entire article on the IT World Canada website: Link
