Cyber-attacks are a relentless threat facing your business. According to McAfee Lab’s Threat Report, nearly 500 new cyber threats emerged every minute in Q4 of last year. Considering the increasingly risky cyber environment, is it ever possible to truly know which devices, applications and users you can trust?
The Zero Trust approach, which originated out of Forrester Research nearly a decade ago, believes that organizations should not assume that anything inside — or outside — their network perimeter can be trusted. However, when the approach was originally developed, the focus was largely on security risks outside of company walls, leading organizations to deploy firewalls to keep the bad guys out.
The traditional thinking for many years was that everything inside the firewall was trustworthy – your network, your employees, your devices — while everything on the outside was suspect. But, today this frame of mind leaves IT with a false sense of security.
Leaving the Door Open for Attacks
In our always-connected world, with countless devices connected to your business and your networked systems connected to the internet, attackers have open doors at their fingertips. One only must scan the headlines to see data breaches made possible by an attacker gaining access to a firewall or other vulnerable entry point. For example, many of the well-documented hacks on industrial control systems — nearly every one of them — has involved a multi-stage attack, with attackers leveraging the weakest link. This trend began with the infamous cyber-attack on a Ukraine power company — the first known instance of an attack disrupting electric grid operators — with attackers accessing a corporate network to then work their way into the overarching SCADA network.
Attackers are masters are identifying human-mediated interfaces, such as a human machine interface (HMI) within industrial organizations, and then progressing to lower layers of the network to figure out what’s there and attack the true target, such as control systems. The HMI has the same vulnerabilities as a person sitting at their desk checking email, and the damage can be extensive.
Sixty three percent of all ICS-related vulnerabilities cause processing plants to lose control of operations, and 71 percent can obfuscate or block the view of operations immediately according to the Dragos Industrial Control Vulnerabilities 2017 in Review. And, according to the Cybersecurity Ventures’ 2017 Annual Cybercrime Report, cybercrime will cost the world $6 trillion a year by 2021.
Whether you’re responsible for critical services powered by industrial control systems or for behind-the-scenes networking at a medium-sized enterprise, our hyper-connected way of doing business today makes it increasingly difficult to trust anyone or anything.
Limiting Access, Limiting Risk
If you have adopted a Zero Trust approach, is there any way to measure success? Of course, a track record of never being breached would be one positive result. But, how confident are you that couldn’t be breached tonight or next month?
There is no such thing as saying, “I’ve achieved Zero Trust,” as cyber security work is never done. Regardless, it’s time to do away with the “inside is good, outside is bad” mentality and instead focus on more specific decisions based on who or what is trying to gain access and whether they should be allowed to do something with the information. These types of granular controls have been available for years in operating systems and devices but trying to combine privileges and controls can quickly become complex, particularly with the fast pace of business operations and rapid change rates. If you accept the fact that most of networks will eventually get hacked, due to the increased connectedness and complexity of business operations, embracing Zero Trust is a great way to limit the damage — if you evolve the original definition.
The Critical Role of Segmentation
The reality is that there are certain parts of your business that have no reason to be visible to the rest of the world and shouldn’t be connected to even the most secure perimeter. Segmentation is a must-have element to a Zero Trust approach, limiting the risk that comes with access and limiting access to the portions of information you can control.
In industrial settings, many critical systems were never designed with security in mind but are now connected to public networks to boost convenience and productivity. But, they simply can’t withstand that type of exposure, leaving them poorly defended. When embarking upon Zero Trust, shifting to a network segmentation philosophy has the quickest impact and the highest payoff, allowing you to protect systems in which security wasn’t traditionally a requirement.
Where Do You Start?
Start small. It doesn’t need to be a massive undertaking. Maybe there are three to five operational networks that shouldn’t be talking with each other — only to themselves. Start with those. Right away, by segmenting that part of the business, you significantly reduce potential attack vectors that could then run amuck across your entire network.
Weigh multiple options. Segmentation with SDNs, for example, are an attractive option. Implemented on the cloud or within data centers, you gain operating system-level control, while providing easier management and control access at the network level. But what about at the network edge? Industrial organizations should consider implementing segmentation based on a hardware root of trust that extends security out to the network edge to prevent them from ever leaking into the cloud.
Have your cake and eat it, too. When done right, segmentation shouldn’t impact productivity to enhance security. Neither should take a hit. IIoT should be able to deliver on its economic imperative in terms of connectedness, insight and productivity, and systems should be protected without impacting uptime and day-to-day operations. Your employees, customers and partners should still have secure connectivity wherever and whenever it’s needed.
Don’t break a sweat. It’s easy to deny there’s a security problem until it’s essential to make a change. A breach can do just that, causing organizations to look for the quickest way to remediate risk. But, that doesn’t mean the answer has to be complex. Segmentation should give you the peace of mind that your most critical infrastructure is secure without requiring network configuration changes, significant IT management oversight or dependence on external network infrastructure
At the end of the day, there is no one magic solution to achieving Zero Trust. The approach continues to evolve, as do the cyber-attacks that make Zero Trust so important. By taking advantage of and expanding on Zero Trust principles, you can trust that you are taking critical steps needed to protect your infrastructure today from the looming threats of tomorrow.