Skip to content
Tiatra, LLCTiatra, LLC
Tiatra, LLC
Information Technology Solutions for Washington, DC Government Agencies
  • Home
  • About Us
  • Services
    • IT Engineering and Support
    • Software Development
    • Information Assurance and Testing
    • Project and Program Management
  • Clients & Partners
  • Careers
  • News
  • Contact
 
  • Home
  • About Us
  • Services
    • IT Engineering and Support
    • Software Development
    • Information Assurance and Testing
    • Project and Program Management
  • Clients & Partners
  • Careers
  • News
  • Contact

The Age of Zero Trust Security

It’s a perfect confluence of events for zero trust to take center stage in the world of cyber security: the rise of hybrid and remote work, the ongoing shift to cloud services, the continuing growth of mobile devices in the workplace, and an onslaught of sophisticated attacks that can impact entire supply chains.

Never have organizations faced so many challenges in protecting their data resources, and never have they needed to be more suspicious of users and devices trying to access their networks. The zero-trust model, with its principal concept that users, devices, applications and even networks should not be trusted by default — even if they are connected to a permissioned network and even if they were previously verified — is well suited to today’s typical IT environment.

There is simply too much risk that an outside entity trying to gain access actually has nefarious intent. There is too much at stake to trust anyone or anything. One of the more notable effects of the shift to zero trust is the realization that traditional virtual private networks (VPNs) are no longer fully capable of securing remote access to corporate networks.

The distributed workforce at an organization might have access to highly regulated customer data through on-premises or cloud-based customer relationship management and enterprise resource planning systems. They might also need to access commercially sensitive intellectual property—all of this from personal devices.

Organizations need an effective way to secure and authenticate these users, and unfortunately, traditional VPNs have struggled to keep up with the traffic workloads that work-from-home generates.

Research by Tanium has found that overtaxed VPNs were the second biggest security challenge for organizations transitioning to a distributed workforce. The problems with legacy VPNs have not only imperiled the security of traffic flows, but they are also contributing to a growing risk of security threats related to endpoints.

When the pandemic hit and organizations were forced to allow many employees to work from home, they relied on VPNs to support their distributed workforces, but with less-than-stellar results. While VPNs are familiar to many users and already in use for remote access, they are not the ideal tools to provide secure access for so many users relying on devices that in many cases are not as secure as they could be.

VPNs will not provide adequate defense against threats aimed at home networks. In addition, companies with a sizeable mobile or hybrid workforce will need to support a significant volume of VPNs, which can be burdensome for IT to manage and maintain. 

Zeroing in on zero trust

To truly provide secure access for a large number of remote workers, organizations need to think beyond VPNs and fully adopt the zero-trust model of cybersecurity.

With a zero-trust strategy and tools, it’s easier for security teams to provide secure access to applications because they have more granular access controls and users do not get blanket permissions. Access rights are specific and require continuous verification.

The term “zero trust” is used a lot in the cybersecurity market and can mean different things to different people. If done right, this approach should look at three things: a user’s credentials, the data that user is trying to access, and the device (the endpoint) the user is employing to gain access.

By combining the principle of least privilege with a modern approach leveraging contextual access, multi-factor authentication (MFA) and network access, enterprises can maintain a more agile security model that works well with a remote workforce and cloud-heavy environment.

They can reduce the attack surface and make sure sensitive data is only accessible by users who need it under approved, validated context. This serves to reduce risk.

Device validation is one of the keys to a successful zero-trust strategy, and with remote work making up a large portion of end-user access today, device posture is extremely important. Devices in many cases are the new “perimeter” within organizations, and their validation enables organizations to protect against stolen credentials or even stolen devices that cybercriminals can use to gain access to networks.

This is why practicing strong endpoint management is such an important part of a zero-trust approach. Without real-time and accurate endpoint management, organizations can’t enforce compliance or validate device posture as a prerequisite for access. Authentication alone can’t ensure that a device is secured.

The right tool can allow security teams to continuously check device posture against policies and ensure that the zero-trust approach really does trust no one, even after identity and access policies are in place. Ideally, organizations should be able to integrate new zero-trust solutions with the tools they already use, so they don’t have to start from scratch.

The key components of a zero-trust practice should include:

  • Device compliance monitoring and enforcement to confirm security posture for the device and give security teams the ability to take action if something is not right.
  • Identity and access management to authenticate users’ identities and compare their access against role-based rules.
  • Network access controls including restricting access to resources on network segments based on a user’s persona and the device being used.

The concept of zero trust might come across as negative — even paranoid: Don’t trust anything, whether it’s devices and other endpoints, applications, networks or individuals. However, what the model really indicates is that organizations are operating in uniquely challenging times, and much is at stake when a data breach or ransomware attack occurs.

More people are working remotely, in many cases using their own devices and networks. Companies are relying on cloud services more than ever. Attacks have become more sophisticated and can impact entire supply chains.

Organizations need to take the initiative to ensure that valuable data resources are always protected and to be certain that the users and devices trying to access their networks will not do harm. 

Implementing a zero-trust strategy is a truly effective way to achieve this level of security. Learn how Tanium can help.

Zero Trust


Read More from This Article: The Age of Zero Trust Security
Source: News

Category: NewsMay 18, 2022
Tags: art

Post navigation

PreviousPrevious post:Convergence is Key to Supply Chain Resilience: NC State University ResearchNextNext post:The New Cybersecurity Motto: Trust is Not an Option

Related posts

휴먼컨설팅그룹, HR 솔루션 ‘휴넬’ 업그레이드 발표
May 9, 2025
Epicor expands AI offerings, launches new green initiative
May 9, 2025
MS도 합류··· 구글의 A2A 프로토콜, AI 에이전트 분야의 공용어 될까?
May 9, 2025
오픈AI, 아시아 4국에 데이터 레지던시 도입··· 한국 기업 데이터는 한국 서버에 저장
May 9, 2025
SAS supercharges Viya platform with AI agents, copilots, and synthetic data tools
May 8, 2025
IBM aims to set industry standard for enterprise AI with ITBench SaaS launch
May 8, 2025
Recent Posts
  • 휴먼컨설팅그룹, HR 솔루션 ‘휴넬’ 업그레이드 발표
  • Epicor expands AI offerings, launches new green initiative
  • MS도 합류··· 구글의 A2A 프로토콜, AI 에이전트 분야의 공용어 될까?
  • 오픈AI, 아시아 4국에 데이터 레지던시 도입··· 한국 기업 데이터는 한국 서버에 저장
  • SAS supercharges Viya platform with AI agents, copilots, and synthetic data tools
Recent Comments
    Archives
    • May 2025
    • April 2025
    • March 2025
    • February 2025
    • January 2025
    • December 2024
    • November 2024
    • October 2024
    • September 2024
    • August 2024
    • July 2024
    • June 2024
    • May 2024
    • April 2024
    • March 2024
    • February 2024
    • January 2024
    • December 2023
    • November 2023
    • October 2023
    • September 2023
    • August 2023
    • July 2023
    • June 2023
    • May 2023
    • April 2023
    • March 2023
    • February 2023
    • January 2023
    • December 2022
    • November 2022
    • October 2022
    • September 2022
    • August 2022
    • July 2022
    • June 2022
    • May 2022
    • April 2022
    • March 2022
    • February 2022
    • January 2022
    • December 2021
    • November 2021
    • October 2021
    • September 2021
    • August 2021
    • July 2021
    • June 2021
    • May 2021
    • April 2021
    • March 2021
    • February 2021
    • January 2021
    • December 2020
    • November 2020
    • October 2020
    • September 2020
    • August 2020
    • July 2020
    • June 2020
    • May 2020
    • April 2020
    • January 2020
    • December 2019
    • November 2019
    • October 2019
    • September 2019
    • August 2019
    • July 2019
    • June 2019
    • May 2019
    • April 2019
    • March 2019
    • February 2019
    • January 2019
    • December 2018
    • November 2018
    • October 2018
    • September 2018
    • August 2018
    • July 2018
    • June 2018
    • May 2018
    • April 2018
    • March 2018
    • February 2018
    • January 2018
    • December 2017
    • November 2017
    • October 2017
    • September 2017
    • August 2017
    • July 2017
    • June 2017
    • May 2017
    • April 2017
    • March 2017
    • February 2017
    • January 2017
    Categories
    • News
    Meta
    • Log in
    • Entries feed
    • Comments feed
    • WordPress.org
    Tiatra LLC.

    Tiatra, LLC, based in the Washington, DC metropolitan area, proudly serves federal government agencies, organizations that work with the government and other commercial businesses and organizations. Tiatra specializes in a broad range of information technology (IT) development and management services incorporating solid engineering, attention to client needs, and meeting or exceeding any security parameters required. Our small yet innovative company is structured with a full complement of the necessary technical experts, working with hands-on management, to provide a high level of service and competitive pricing for your systems and engineering requirements.

    Find us on:

    FacebookTwitterLinkedin

    Submitclear

    Tiatra, LLC
    Copyright 2016. All rights reserved.