Zero trust is a security model that is becoming increasingly important in the world of cybersecurity. In 2023, we will see more vendors offering complete zero trust products and services, and more businesses attempting to implement it. Zero trust is a shift away from the idea of a defensible data center perimeter, and instead focuses on individual defensible asset perimeters. The OMB memorandum requires agencies to achieve specific zero trust security goals by the end of Fiscal Year 2024, and this will require extensive activity within federal agencies through 2023. Zero trust is not a destination, but rather a journey of information security that requires technology, but also a shift in the way organizations view and approach risk. Zero trust network access is a common route to zero trust, but organizations must be aware of the complexity of their network. An effective zero trust implementation requires knowledge of all servers, applications, and users authorized to use those applications. Zero trust should not be considered a complete solution on its own, and must be integrated with anomaly detection. The Covid-19 pandemic has increased the importance of a zero trust architecture, as the number of endpoints has increased and many are accessed remotely. A zero trust approach will become more essential than ever, as it limits an attacker's ability to move within the larger business network and reduces the attack surface. However, this could raise privacy issues if employers impose conditions on personally owned computers. Enterprises should look to adopt a zero trust architecture and security model, which assumes that every user, device, or network is hostile and requires them to prove who they are before access is authorized. In 2023, we will see more IT teams shift to incorporate ZTNA across the entire network, and organizations will transition away from a pay-per-user model. Zero trust is a major extension of identity and access management, and organizations must put in an identity data foundation before they can justify building new projects. We will also see an increase in MFA push notification fatigue attacks, as attackers attempt to gain access to critical business applications. Pegasus spyware is a prime example of a phone-based threat to identity management, and organizations must provide multiple factors such as biometrics, government-issued identity documents, and information from reliable sources to prove their identities. Modern security solutions that remove the implicit trust from users, devices, services, and workloads will become the norm, and organizations must investigate and remediate everything. Achieving a solid zero trust architecture will take time, but offers numerous benefits to organizations of all sizes and industries.
This Cyber News was published on www.securityweek.com. Publication date: Mon, 06 Feb 2023 12:56:02 +0000