As 2019 comes to an end, our security experts are looking ahead to the new year to predict cybersecurity trends that will shape the landscape in 2020. Imperva CTO Kunal Anand blogged about his “Top 5 Cybersecurity Trends to Prepare for in 2020,” last week. This week, we’re digging deeper into his #2 cybersecurity trend for 2020 – zero trust.
The last few years have seen businesses and consumers become increasingly reliant on digital technologies as more and more organizations transition to the cloud and the adoption of Internet of Things (IoT) devices continues to grow. Big tech and digitalization have driven consumers to share their personal data at an unprecedented rate and, as a result, the amount of data captured by organizations has grown exponentially. Data is now a valuable commodity for businesses and cyber criminals alike.
As enterprises manage their data across multiple applications and environments, on-prem or hosted in the cloud, and as users have more access to data at more interfaces, a network’s perimeter becomes porous and less defined. This causes the threat surface to expand as the edge becomes indefensible.
Cyber attackers are transcending the desktop to connected devices to get to your critical data. It is no longer enough for security leaders to protect their networks only at the edge. As the perimeter lines become blurred, defending your organization’s network and critical assets requires a much more comprehensive approach, which includes focusing on the data itself and adopting a zero trust security model when it comes to accessing the data.
“Zero trust is a fundamental transformation of corporate security from a failed perimeter-centric approach to one that is data-centric.” – Forrester Research 2019
As discussed in the webinar “Take on 2020 with Vision,” Imperva CTO Kunal Anand considers the zero trust model to be like a marriage between applications, data and identity, that is fully aligned with the contemporary IT landscape. The traditional approach to security was to implement perimeter-based security defenses and generally trust insiders with legitimate access to data assets. However, as networks and applications become more decentralized, it becomes increasingly difficult to defend against a breach.
Despite organizations having robust edge security measures in place, breaches still occur due to events from inside your organization as well as from the outside. Insider breaches can be more difficult to detect and can occur due to lack of care when handling data, or because the security teams that monitor critical applications are overwhelmed by the sheer numbers of events, also known as alert fatigue. Fifty-four percent of companies have admitted that they tend to ignore security alerts when they are overwhelmed.
Breaches can also be caused by the actions of a malicious insider. The zero trust model doesn’t place a huge amount of relevance on the distinction between insider and outsider. Instead, it suggests that you trust no one.
In a 2018 survey of CISOs by The Ponemon Institute, a lack of skilled security professionals stood out as a major issue. Sixty-five percent of respondents reported “‘inadequate in-house expertise” as a top reason they would be likely to have a data breach. The same survey showed that 60 percent of respondents were concerned about IoT devices causing a breach. Sixty-five percent believe they would experience credential theft due to a careless employee being compromised.
A 2018 Insider Threat Report by U.S. Cybersecurity Magazine found that 66 percent of organizations consider malicious insider attacks or accidental breaches more likely than external attacks with a high percentage also considering them more damaging. So how do you prevent a breach from occurring on the inside? Knowing where your personal data is stored is not enough. The zero trust model demands that you also know what that data is, who has access to it, and why.
To fully adopt the zero trust model, security professionals need to take a “cradle to the grave” approach to tracking data access requests – by people or devices – with no bearing on whether that request originates from inside or outside the network perimeter.
Using data analytics and insights to capture a comprehensive data flow starting from the initial access request, traversing all applications and middleware in between, and recording what is done with the data and by whom once it is reached, will highlight unusual behaviors and flag up potential threats. The zero trust model is a completely new mindset that requires having granular visibility of data access across the entire network estate.
Zero trust is the second of five security trends we’re highlighting through the new year in a series we call Take on 2020 with Vision. To follow the series, subscribe to the Imperva blog here or follow #ImpervaPredicts on LinkedIn, Twitter, or facebook.
Featured Webinar: Take on 2020 with Vision. Imperva CMO David Gee sits down with Imperva CTO Kunal Anand to discuss all the trends you should watch for in 2020. Watch here.
Try Imperva for Free
Protect your business for 30 days on Imperva.
