Adaptive zero trust: the future of cyber-security

Bhagwat Swaroop at One Identity describes the much needed additional strength that an adaptive approach brings to the zero-trust cyber security model

 

Cyber-security is an industry in flux. Its endemic, perpetual state of evolution defines the landscape - shaping attack and defence methods, shifting power dynamics, and inspiring technology innovations.

 

The result of this constant state of change, for the good guys at least, is that much of their work is reactive. Cyber-security professionals often resemble digital fire-fighters, scrambling to extinguish the flames ignited by cyber arsonists.

 

Recent years have seen zero trust emerge as a must-have for resiliency - a tried and true model for executing resilient and selective security at scale.

 

Zero trust has proved so popular, in fact, that Microsoft found that 96% of security decision makers stated that zero trust is essential to their organisation’s success.

 

However, any successful cyber-security strategy still faces threats similar to those it did a year ago: Organisations, attackers, and threat vectors evolve constantly and will continue to do so.

 

As these threats will never stop advancing, it is critical to rethink the approach to cyber-security from narrowly scoped and static to a new dynamic and comprehensive.

 

And that brings us to adaptive zero trust.

 

For an industry in flux, you need a model that is flexible - adaptive - enough to fluctuate along with it. Adaptive zero trust brings an evolutionary mindset to the zero-trust model . It enables organisations, CISOs, and security professionals to keep pace with their ever-changing internal and external environments.

 

Adaptive zero trust’s greatest asset is its staying power. While static models quickly grow outdated, evolutionary models such as adaptive zero trust are, by their nature, constantly working to remain up-to-date.

 

That said, understanding where you need to be and knowing how to get there are two different problems. To make the shift to an adaptive zero trust model, there are a few things you need to look out for.

• Total visibility: Establishing a successful adaptive zero trust model begins with casting a wide net. It’s not enough to focus solely on people. Machine identities and the ever-expanding accounts that come with multi-generational, hybrid and edge IT landscapes must be factored into the equation.

• Total verification: Effective adaptive zero trust models deliver a continuum of rights across an organisation. This means that you can verify anyone and everything - before granting access to your most important and sensitive assets. Increased visibility and insight allow security professionals to quickly and efficiently add, remove and adjust privilege before any damage is done. This means they can restrict user access to only what’s needed when they need it. 

• Smart controls: Risk scores are one of the most dynamic aspects of the cyber-security landscape. As access and privilege requirements evolve, policies change, and new threats emerge, risk scores are disrupted multiple times over. Adaptive zero trust models should leverage contextual awareness and behavioural analytics, allowing organisations to anticipate, detect, and take corrective actions. If suspicious activity is detected, security professionals must have the insight and tools to modify or step-up authorisation. 

• Comprehensive approach: It isn’t just threat landscapes that evolve. The people, applications, and data, and even an organisation’s need to protect itself evolve too. Such evolution often requires adding in new functionality as needed, while minimising business disruption as much as possible. As organisations are forced to adapt and expose functionality, many are looking to converged platforms for identity security. This allows for a “best of both worlds” approach, enabling organisations to address access management immediately, while leveraging additional capabilities over time.

There is no longer any question as to whether the attacks and breaches that flood our news feeds daily will relent. This is our new reality. Almost without exception, the best course of action for an organisation starts with recognising that the traditional perimeter is no longer wide enough.

 

If we view breaches as an inevitability, which seems to be the case, minimising damage should be utmost priority.

It’s important to recognise that a zero-trust strategy is only as effective as it is nimble. And it must be as nimble as the threat landscape in which it operates.

 

Adaptive technology can significantly enhance an organisation’s chances of success, but this can only be realised if the fundamental characteristics of zero trust models are prioritised.

 

---

 

Bhagwat Swaroop is President and GM of One Identity

 

Main image courtesy of iStockPhoto.com