Data breaches have created chaos and confusion for businesses and organizations alike, prompting them to take necessary steps to mitigate its effects. Data breaches cost organizations millions of dollars, leaving countless people impacted. While the number of data breaches has decreased, the severity has risen over time, causing enterprises to create better measures to protect themselves from such attacks.
The castle-and-moat approach is a well-known paradigm where no one outside the network has access to the data within it. Consider the organization network as the castle and the network perimeter as the moat around the stronghold. The public has no access to the fortress. The civilians may undergo security checks as they cross the bridge into the castle grounds. Soon after, the accepted civilians have unrestricted access to the castle.
However, this approach is ineffective as it dedicates various resources to block off external forces, such as intrusion detection and prevention systems, yet it is inadequate in blocking internal attacks. Attackers can breach the network by gaining unauthorized access to the user’s credentials and exploiting a security flaw. Once the attacker infiltrates the network, the movement will be hard to detect. It is high time we ditch the castle-moat approach to adopt the zero-trust approach.
Zero-trust security is an approach taken to prevent data breaches by enforcing a principle of perceiving everyone as potentially malicious. This approach implies that security risks exist both outside and inside the network perimeter. Strict verification is enforced for every individual and device trying to access resources within a network.
Principles of Zero-trust security
First, the zero-trust approach focuses on repeated verification and validation. It verifies the user identity and access rights. Users will be required to authenticate themselves at regular intervals as connections timeout periodically.
Secondly, zero-trust security permits only essential access controls to individuals. It entails carefully managed user permissions and limited access to sensitive network areas.
Next, strict device access control is required to achieve zero-trust security. It is to ensure that compromised devices do not access the network.
Additionally, zero-trust security employs micro-segmentation. It is a method of dividing the network into small zones and securing them separately. It aids in network surface attack prevention, data breach containment, and regulatory compliance enforcement. It also prevents users or programs from accessing other zones as each zone has its authorization and authentication.
Furthermore, zero-trust security prevents the lateral movement of the attacker. Since the network is micro-segmented, access to the network zone must be re-established regularly. It helps in containing the attacker and quarantining the network zone once the presence is detected.
Finally, zero-trust security exercises multi-factor authentication that requires the user to provide more than two verification methods to access a particular zone in the network.
Implementing zero-trust security in organizations is no easy task. This implementation requires commitment as well as continuous monitoring and administration. Access control and permissions need to be updated regularly to ensure that only the appropriate people can access the data. If not, unauthorized users might have access to sensitive data in case these aren’t updated. Howbeit, enforcing zero-trust can also harm employee productivity as it could hamper the workflow process. Organizations could devise several strategies to implement zero-trust, but flaws in the process could weaken and cause lapses in network security.
Nevertheless, zero-trust security has proven to be an effective way for organizations to regulate access to a network, applications, and sensitive data. It has determined effective containing of data breaches, thus helping to reduce potential damage.
iEDPS – Infosys Enterprise Data Privacy Suite is a platform that focuses on providing privacy solutions to its users. It carries out data discovery of sensitive data elements within databases and helps guide the user in assigning mask algorithms to help obfuscate sensitive data.
Author -Riya Samuel is a developer working in the iEDPS team. She focuses on developing new database adapters in iEDPS and has worked with clients to propose different masking solutions.
