Posted on

Implementing Zero Trust Architecture on Azure Hybrid Cloud

This article outlines an approach to model NIST’s Zero Trust Security Architecture while migrating to MS Azure but still working with hybrid cloud deployments, and using tools and services offered by Azure.

What Is a Zero Trust Architecture (ZTA)?

The term ZTA has been in use in the domain of enterprise security models and architectures for organizations since 2010 when Forrester coined the term but became popular after NIST published it as a framework (SP 800-207, final version published in Aug. 2020). ZTA further got a lot of visibility after the US govt recently mandated all Federal agencies to adopt ZTA.

Posted on

Why USB Security Policy Matters

Honeywell released a report that over 40% of USB portable storage devices contain at least one risky file and over 25% of those threats could lead to operational issues. In 2018, IBM’s chief information security officer, Shamla Naidoo, released a statement focused on digital hygiene and IBM’s steps towards banning portable storage devices, including USBs. Similarly, the French National Assembly has worked to raise cybersecurity awareness with a similar aim to ban USB sticks during their meetings. With companies, and even countries, working to ban the use of USBs, it can be difficult for enterprises to know what decision they should make when it comes to USB policy. One way or another, enterprises need to address the issue and strictly enforce these policies to avoid catastrophic breaches. Recent security breaches and mishaps with USBs should serve as a warning to enterprises still using them freely and without restrictions.

Edward Snowden

In recent years, the way the US government handles sensitive documents has come under scrutiny. This enhanced scrutiny comes, in part, from the actions of Edward Snowden, a systems administrator contractor for the NSA. Using simple USBs, Snowden was able to copy sensitive information about a government surveillance program called Prism and leak it to the media. Snowden’s case serves as a lesson for companies around the world. Without proper endpoint security any company or organization could have sensitive data lifted with something as simple as a USB.

Posted on

Tips for Achieving Network Security in a Timely Manner

The number of cyber threats faced by businesses and individual internet users seems to increase by the minute. As such, individuals and enterprises that treat cybersecurity as an afterthought are often prime targets for hackers, data thieves, and malware spreaders.

When such unsavory characters are able to find their way onto private networks, the damage they do can be far-reaching.

Posted on

Why Attribute-Based Access Control Will Become the Standard Model for Large Enterprises

Today, data is often characterized as the new oil of the digital age. Organizations are leveraging their data to enhance operational efficiency, better the customer experience, increase revenue, and boost growth. In addition, virtually every organization is now collecting data, whether it be from banks and financial institutions or healthcare organizations and industrial manufacturers.

Not only are these businesses all about collecting data, but they are also collecting it from a wide variety of sources at an accelerated pace, resulting in an increasingly complex data environment. Not to mention the business complexities collecting data brings like privacy protection, IP protection, and brand protection. However, data is only useful if it can be securely shared and leveraged across not only an entire organization but also across business partners and third-party suppliers. 

Posted on

Between the Lines: The State of Enterprise Security

We live in an era where cyberattacks come part and parcel with doing business. Companies are routinely hit with attacks big and small, and their customers are feeling the impact as well. While your company may not have suffered a major security attack yet, that doesn’t mean it won’t. Cyberattacks have never been more prevalent or dangerous — and they could end up costing your company millions of dollars and potentially scores of customers.

These trends are making the IT departments that are tasked with endpoint defense, investigation, and remediation filled with dread, and they are looking for ways to get ahead of the problem. Based on conversations I’ve had with customers and partners over the past several months as well as talks taking place at a slew of industry events, here are some of the things I’ve noticed about the state of enterprise security today — the good, the bad, and the ugly.