Gartner predicts that 21 billion mobile devices, wearables, medical devices and other IoT things will connect to the internet by 2020.
So, how can you be sure who or what is on your network?
Watch our on-demand webinar ‘Never Trust. Always Verify’ with Malcolm, Network Utilities’ Technical Director and Paul, Channel SE from Pulse Secure to learn how a Zero Trust model gives you the visibility needed to mitigate risk.
During the webinar you’ll discover:
What’s driving the interest in Zero Trust
The principles of a Zero Trust model
Trends shaping the delivery of Secure Access
How the Software Defined Perimeter works
The critical elements of any successful Zero Trust Secure Access solution
How Pulse Secure delivers Zero Trust Secure Access for hybrid IT
The following 14 core technical capabilities were created to help guide and prioritise cybersecurity investments.*
With cyber threats constantly evolving, it’s important to identify the gaps in your security posture and being prepared for cybercriminals to get through your defences in this changing environment is essential. You need to determine where to start and what is most important.
1. Asset Management
Identify assets by leveraging automated tools and discovery solutions (to also discover rogue systems), including:
Installed software (including on endpoints, mobile (leverage Mobile Device Management (MDM or EMM) solutions) and servers)
Deployed hardware (including endpoints, mobile, cloud and “on- premise” systems)
2. Network Segmentation
Ensure networks are properly segmented, particularly separating the business side from the infrastructure networks.
Focus initially on high value assets and critical systems. Move away from solutions that focus only on “on premise” segmentation and deploy network segmentation solutions, such as Software Defined Perimeter that allows for granular role-based segmentation of on-premise and Cloud-based systems, including legacy systems. Additionally, leverage Network Access Control (NAC) when possible.
3. Network Security
Leverage intrusion detection and prevention systems (IDS/IPS) across enterprise and system enclave boundaries (including ingress, egress points), including using cloud-based appliances whenever possible to monitor cloud traffic.
Select solutions that can protect both on-premise and
cloud-based traffic and consolidate alerts/logs on a single dashboard
Consider leveraging Deep Packet Inspection/Packet
Capture (DPI)
Consider deploying cloud access security brokers
(CASBs) at cloud boundaries
Leverage Domain Name Server Security (DNSSEC) to
secure your Domain Name Server (DNS)
Consider specific distributed denial of service (DDoS)
protections to protect servers, applications, and networks
Consider solutions that protect communication systems
against telephony denial of service (TDoS) and DDoS attacks
4. Identity Management
Manage user access and roles by:
Deploying a centralised identity management solution with access control management and identity proofing
Leveraging a Single Sign-On solution across the enterprise and its applications
Deploying multi-factor authentication across the organisation, particularly for critical systems and privilege access
Using identity management best practices to ensure “need to know” and “least privilege”
Properly disabling or deleting accounts according to the organisation’s policy requirement
5. Privilege Access
Privilege access management solutions should be deployed to manage and control critical infrastructure systems’ administrative accounts, including:
Requiring multi-factor authentication for all administrative accounts, including on servers and endpoints
Using solutions, such as Software Defined Perimeter, to enforce multi-factor authentication policies across the enterprise while implementing patching, need to know, and least privilege, among others
6. Patching and Vulnerability Management
Conduct proper monitoring and patch installation, including testing prior to patch deployments
Prioritise patches based on risk and critical impact
Regularly perform automated scanning (daily ideal or weekly), including credentialed, passive, internal, and external scans. Include database configuration and web services configuration scans
Install agents on servers and endpoints to facilitate scans whenever possible
Scan applications both statically and dynamically
Perform source code review when necessary
7. Continuous Monitoring
Continuous monitoring is recommended 24 hours a day, 7 days a week, including:
Employ alerts and Security Information and Event Management (SIEM) solutions with a customised dashboard to monitor critical systems using proper log management
Create/manage a security operation centre (SOC) to continuously monitor critical systems
8. Endpoint Protection
Employ endpoint protection solutions to:
Mitigate against viruses, ransomware, and malware using solutions such as Application Segmentation (Micro Virtual Machine isolation), Advanced Endpoint Protection, and Antivirus/Anti-malware
Deploy these solutions across all endpoints and servers, including mobile devices
Leverage a File Integrity Solution to protect against file tampering/rootkits etc.
9. Public Key Infrastructure (PKI)/Key Management
Deploy both symmetric and asymmetric encryption key management solutions, including:
Managing public and private keys used for application
programming interfaces (APIs), email signing, and encryption using a PKI
solution
Employing key management solutions to store keys,
including Secure Shell (SSH) keys and other encryption keys
10. Log Management
Centralise, correlate and consolidate logs, including:
Ingress and egress logs
Application logs
Endpoint protection logs
Firewall logs
Security logs such as authentication failure, misuse, unauthorised access, insider threat
Server logs
Database logs
Webserver logs
IDS/IPS logs
Ensure proper timestamp by leveraging Time Synchronisation (Network Time Protocol (NTP)) solutions across every system.
11. Phishing Protection
Implement phishing training and plugin solutions, including:
Mandating regular phishing training for all employees,
including senior executives
Deploying email validation system (Domain-based
Message Authentication, Reporting and Conformance (DMARC), Sender Policy
Framework (SPF) and DomainKeys Identified Mail (DKIM)) to detect and prevent
email spoofing
Deploying phishing plugin solutions on email servers
and endpoints to allow phishing email detection, prevention, and reporting
Conducting real-life phishing campaigns to all your
employees to measure openings/clicks, and target training to employees opening
those emails
12. Configuration Management
Adopt a configuration management solution to properly enforce configuration requirements on servers and endpoints, including:
Prioritising solutions that can synchronise logs with SIEM and that support multiple operating systems
Leveraging application whitelisting solutions to limit access to necessary applications on endpoints and mobile devices. Whitelisting is recommended instead of blacklisting because new malicious software is too difficult to track
13. Application Security
Application security is the use of software, hardware and procedural methods to prevent vulnerabilities in applications and protect sensitive information from external threats. Applications may include desktop, server, and mobile technology. Software security should be built into applications during their development phase:
Fuzz testing (fuzzing) should be leveraged as a quality assurance technique, using a software tool called a fuzzer to discover coding errors and security loopholes in software, operating systems or networks. The technique involves inputting fuzz (massive amounts of random data) to the test subject to make it crash, find vulnerabilities, and identify potential causes
Dynamic analysis can be used as the testing and evaluation of a program by executing data in real-time to find errors in a program and flaws in the source code while it is running, rather than by repeatedly examining the code offline. Dynamic code analyser software finds security issues caused by the code’s interaction with other system components like SQL databases, application servers or Web services to debug a program in all the scenarios for which it is designed
Static code analysis is also available as one of the security tools the enterprise can use to identify flaws and malicious code in applications before they are bought or deployed. The process provides an understanding of the code structure, and can help to ensure that the code adheres to industry standards
Leverage Web Application Firewalls (WAF) solutions to secure your web applications
14. Data Security
Implement solutions to secure data, including:
Properly protect data, in particular, personally identifiable information (PII), personal health information (PHI), payment card industry (PCI), and sensitive, classified, and/or financial data, by using Data Loss Prevention solutions:
Leveraging solutions to detect and prevent data leaks and massive data exports on servers, databases, and endpoints, when possible
Deploying backup solutions across the organisation endpoints, servers, databases, and critical systems
Establishing off-site backup, whether in a separate datacentre or on the cloud
Mandating encryption for all PII, PHI, PCI, sensitive, and confidential data whenever possible. Examples include:
Requiring full disk encryption solutions for mobile devices, laptops, and removable media
Using encryption on databases and files whenever required
The Requirements of a Secure Access Solution – Balance Security and Productivity
With a Secure Access
solution in place, organisations can enforce policy compliance by employees,
guests and contractors regardless of location, device type, or device
ownership. Users enjoy greater productivity and the freedom to work anywhere
without sacrificing access to authorised network resources and applications. IT
can mitigate malware, data loss and IoT risks. And IT is empowered to optimise
their resources and enable digital transformation across the organisation.
Integrated mobile security
First, a Zero Trust Secure Access solution must enable enterprise mobility to boost workforce productivity. This requires enabling visibility and compliance controls in a transparent way across different devices and operating systems. It involves simplifying the secure use of mobile devices by offering automated, self- service on-boarding of devices – whether they are laptops, smartphones, or tablets – regardless of user location and device ownership. Mobility enablement also requires the ability to ensure compliance by isolating work applications and data from private applications in BYOD scenarios. Lastly, a Secure Access solution must support always.
Simple and easy-to-use UX
A Zero Trust Secure Access solution must also take into consideration users’ consumer-based expectations for a simple, integrated user experience (UX). For example, end users want the convenience of Single Sign On (SSO) to applications across devices, operating systems and application infrastructures. IT administrators demand an intuitive and flexible way to orchestrate all elements of access security – freeing them from the need to correlate data and actions across multiple security systems and consoles. Additionally, a best-in-class solution will optimise the user experience by leveraging an integrated Application Delivery Control (ADC) solution, guaranteeing timely response to meet any demand, regardless of whether users access applications on site or remotely.
End-to-end hybrid IT security and visibility
The increase in cyberattacks coupled with the move to hybrid IT environments means that a Zero Trust Secure Access solution must offer end-to-end hybrid IT security and visibility. The solution should provide user, device and access operational intelligence to allow for informed policy development, threat response and reporting. Such a solution should combine multi-factor authentication with role-based and device-compliant authorised access to applications, whether the applications are hosted in enterprise data centres, private clouds, or public clouds. An integrated platform, incorporating both perimeter-based (VPN) and Software Defined Perimeter (SDP) architectures provides versatility to address a broad number of business needs while offering deployment flexibility and management economies.
Unified and scalable platform
The difficulties associated with multiple security silos can be mitigated by adopting a unified Zero Trust Secure Access platform. A unified platform provides appropriate application access that supports physical and virtual IT resources across on-premise and cloud environments. It must also provide endpoint coverage across classic PCs, mobile and even IoT devices, requiring the application of agent and agentless Client technology. Given the growth in users and devices, a unified platform must be sufficiently scalable to handle the steady
Unified policy engine for users, devices, and applications
Policy unification is another way to combat the gaps that can be created by multiple security silos. Unlike siloed solutions, policy unification enables rules to be written once and automatically applied enterprise-wide. SDP architectures offer a unified and centralized policy engine that is context-aware, enabling enforcement of granular policies based on user, role, device, location, time, network and application, as well as endpoint security state. To minimize IT administrative workloads and ensure interoperability with third-party solutions, policy enforcement should be standards-based.
Seamless integration across multiple vendor solutions
Establishing a unified platform and policy engine is made easier and effective by partnering with a single vendor who can orchestrate Zero Trust Secure Access controls across multiple vendor solutions. To minimise IT administrative workloads, bi-directional interoperability should be standards-based and support a variety of third-party solutions. Applying this approach allows a single vendor to incorporate new technologies as they become available and enable greater enterprise availability, resiliency, elasticity and scalability.
Extensibility to new endpoints, services, and applications
Finally, as demonstrated by the growing need for IoT and multi-cloud security, a Zero Trust Secure Access solution must be intelligent and adaptable. The solution must be able to discover, segment and monitor sanctioned and unsanctioned IoT devices on the network and private cloud employing advanced device profiling, classification, analytics and threat response. Furthermore, as IOT devices interface with corporate application including IT and OT (Operational Technology) convergence, Secure Access functionality must be sufficiently flexible to accommodate future use cases without compromising availability, performance, compliance, or security.
IT teams are on a constant treadmill of change, which is driven by five major trends shaping the delivery of Secure Access.
1. The consumerisation of IT is revolutionising.
It has completely changed the nature of today’s workplace and contributing to digital business transformation. Enterprises are confronted with proliferation of smart devices and online apps. Millennials, who will represent almost fifty percent of the workforce by 2020, are tech savvy and accustomed to a rich, on-the-go personal digital experience – and they expect a similar digital experience at work using their own mobile devices. Enterprises are challenged to support workforce dynamics and deliver this consumer-like user experience for their employees without compromising key compliance and security requirements.
2. Networks are increasingly under attack.
With new cyberthreats and data leakage in the headlines, security breaches have reached crisis proportions. Reducing the Mean-Time-to-Detect (MTTD) and Mean-Time-To-Respond (MTTR) to vulnerabilities and incidents has never been more important for organisations. Visibility, real-time prevention and automated response are critical for IT to combat threats that are the result of insider activity, privilege misuse, non-compliant and unsanctioned devices and device loss.
3. Cloud computing and hybrid IT environments are the norm.
The traditional data centre environment has morphed into a blended enterprise, cloud and cloud service environment. In this new world, IT resources are typically deployed in an enterprise’s own private cloud or leverage third-party public clouds, including Software as a Service (SaaS), Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) offerings. Even though multi-cloud has become the new normal, cloud security still may not be as trusted as traditional data centre protection. After all, the primary product offering of cloud providers such as Google and Amazon Web Services (AWS) is space, processing power and bandwidth – not security. To ensure appropriate and protected connectivity to applications and information, businesses need Secure Access solutions that can extend proven data centre security to the cloud.
4. Use of multiple security silos for enterprise access.
Hybrid IT environments contribute heavily to this trend as IT extends existing data centre security policies to cover IaaS and SaaS situations. Unfortunately, the use of point solutions to address access security within different computing environments frequently leaves gaps, limits visibility and yields inconsistent policies. This also often results in a complex and frustrating user experience. In a 2017 report by ESG, 66% of cybersecurity and IT professionals agreed or strongly agreed that security analytics and operations effectiveness is limited because it is based upon multiple independent point tools.
5. The Internet of Things (IoT) is exploding.
Printers, smart TVs, personal WiFi, security cameras, sensors, and other peripheral devices are becoming commonplace. These devices are all connected via laptops, desktops, smartphones, or directly on enterprise networks and often further connected through IP networks to other corporate and third-party resources. The security of these systems, from changing default passwords to installing patches, is often an afterthought at best – frequently leaving IoT devices vulnerable to attack and misuse. Typically, organisations are unaware of these devices, and the myriad of ways they are connecting to their internal systems and data. With the rise of Industry 4.0, which uses IoT and cloud to boost manufacturing output, cybersecurity concerns are now bleeding over from IT into the operational technology (OT) domain. Hackers now view IoT as a new opportunity for targeted attacks, taking advantage of security weaknesses and employee ignorance alike. To gain control of the risks posed by IoT, organisations need to redesign their security architecture for IT and OT end-to-end visibility, contextual awareness, and real-time action.
Secure Access ensures that in a Zero Trust world only authenticated users with compliant devices can connect to authorised applications and information at any time, from any location, over any network.
You can’t secure what you can’t see, so visibility is key.
Enabling the modern, mobile
workforce is hard work! Users are demanding and require access to applications
regardless of their location. Not to mention the increased sophisticated
malware and hackers that keep beating down the door.
In an ideal world you want to
know your mobile workforce is entirely visible on your network, however, in
this ever-changing world we live in making assumptions about user identity is a
security risk in itself.
Mitigate your security risk with
a Zero Trust Secure Access model.
Secure Access ensures that in
a Zero Trust world only authenticated users with compliant devices can connect
to authorised applications and information at any time, from any location, over
any network. However, with new cyber threats and security breaches in the headlines
every day companies must ensure a balance between productivity and security. With
the rise of digital transformation Secure Access is critical to your workforce
and will enable you to empower your employees, customers and partners to work,
communicate and collaborate seamlessly.
Traditionally this has been a
difficult goal. IT administrators enforce rules to meet the business requirements
and adhere to compliance.
This traditional approach can
result in poor user experience (UX), causing users to seek alternatives in
order to get their jobs done. The growth of shadow IT proves just that, with no
trouble at all users are leveraging unsecured personal devices and unsanctioned
cloud services to address the very tasks they need to do to get the job done.
Secure Access, in contrast,
is designed with a seamless, simple user experience in mind that also provides
Zero Trust protection.
It’s a model based on enablement rather than restriction. The objective is to deliver simple and frictionless access to enterprise information, applications and services without compromising security – all while making it easy and flexible for IT to implement, manage and adapt security policies that align with an ever-changing environment.
Zero Trust assumes that nothing inside or outside of the enterprise perimeter should be trusted and the network must verify anyone and anything trying to connect before granting access. Connectivity is only granted after identity is authenticated, the security posture of the connected device is verified, and the user or thing is authorised to access the desired application, service or information*.
Get a first-hand view on the State of Privileged Account Management (PAM), the benefits of Cyber Essentials and why reducing organisational risk in this ever-changing threat landscape is crucial to your business.
Many industry analysts have started to pay attention to Privileged Account Management over the past few years.
Privileged
accounts are difficult to secure and one of the reasons for this is because
they are unknown, if they are unknown then they are definitely unmanaged, which
then means they are unprotected.
What
runs parallel to the security benefits of being able to discover and manage
privileged accounts is auditing and compliance control that comes with that. If
those accounts are unmanaged then they are unprotected, so you have no auditing
information and no access control around who did what and when with any of your
privileged accounts.
Forrester’s
reveals that 80% of breaches involve privileged credentials*.
What
we are talking about here is the human and non-human privileged accounts that
exist across your network and connected devices. It is critical yet often
difficult for enterprise IT security teams to manage these without the correct
tools in place.
SANS
reveals that 85% of cyberattacks enter through compromised endpoints.
It’s
difficult to comply with regulations and reduce risk, a least privileged policy
is needed to remove excessive privileges and without adopting this least
privilege policy virtually all windows and mac computers remain vulnerable
despite having the tools in place, things like AV and web protection are of
course important pieces of endpoint application, however if privileged accounts
exist on the device it will always be an attractive attack vector.
Gartner
ranks privileged account management as the CISOs #1 security priority.
This
really does drive home the importance of how critical it is to secure
privileged accounts and have the correct tooling in place. On that list of Gartner’s
Top 6 Security Projects Thycotic address 4 of these within the 6:
#1 – Privilege Account Management
#3 – Anti-phishing
#4 – Application Control
#6 – Detection & Response
What
this means is through a single toolset you can address 4 of the top major
security projects ranked by Gartner CISOs report in 2018 & 2019.
Cyber
Essentials & Cyber Essentials Plus
Cyber Essentials is essentially designed to help organisations of all sizes meet the basic level of cybersecurity and threat protection within your business.
What’s the difference?
Cyber Essentials Certification involves self-assessment with an online form to get self-certified.
Cyber Essentials Plus Certification involves the same procedure as Cyber Essentials however you will then need a certifying body that will validate all the information to meet the 5 core requirements of the certification.
The DCMS Cyber Security Breaches Survey 2019 reveals that 32% of businesses identified cybersecurity breaches or attacks in the last 12 months. Amongst those, 32% needed new measures to prevent further attacks, 27% took up staff time dealing with breaches or attacks, 19% had staff stopped from carrying out daily work and 48% identified at least 1 attack or breach a month.
This government led scheme outlined by the NCSC helps organisations meet foundational security requirements by addressing 5 technical controls, which will reduce organisational risk if addressed sufficiently.
Privileged Account Management (PAM) can assist with all
of these technical controls. The tools Thycotic offer can drastically improve
all of the processes that fall under the 5 technical controls outlined by the
NCSC.
The
Cyber Essentials scheme was launched on the 5th June 2014.
There has been a lot of traction over the last 18 to 24 months, however since October 2014 it became a mandate for any organisation looking to secure government contracts that involve handing personal information or delivery of certain ICT products and services. Equally so in January 2016 this certification become mandatory for the Ministry of Defence for all suppliers.
It
is not mandatory just yet for many industries. The Cyber Essentials
certification is a step in the right direction when it comes to proving that
your organisation is serious about cybersecurity and getting ahead of your
competitors. Let’s not only think of the outward facing benefits, this
certification also gives you piece of mind that you know you have taken the
fundamental steps towards reducing your organisational risk.
How
Can We Help You?
There are many ways NetUtils can support you to have a good cybersecurity posture. If you would like deeper insight into how Privileged Account Management and Cyber Essentials can reduce your organisational risk, then get in touch today.
Businesses of all sizes can take control of their cybersecurity by using this award winning solution.
CyberScore is an automated testing service that allows you to take control of your cybersecurity by detecting vulnerabilities and providing you with empirical evidence and get well plans. The score itself also allows you to clearly demonstrate to the board simply where your organisation currently stands in terms of its cyber risk rating and security posture.
We would like the opportunity to show you how CyberScore can and will reduce your costs, give you full visibility of your cybersecurity posture and improve performance.
With CyberScore you will be able to:
Dramatically reduce pen testing costs
Improve quality of compliance
Prioritise vulnerability data into easy to understand recommendations
Track progress and watch your cybersecurity health improve as measures are implemented
Track cyber risk across third parties
Share easily digestible reporting across the business
Measure performance against the requirements of the UK Cyber Essentials Plus scheme
Cyber Essentials Certification involves self-assessment with an online form to get self-certified.
Cyber Essentials Plus Certification involves the same procedure as Cyber Essentials however you will then need a certifying body that will validate all the information to meet the 5 core requirements of the certification.
