No standing still: Zero Trust and cybersecurity

Cyberattacks are increasing in speed and sophistication, ranking among the biggest threats to businesses of all sizes and industries.

<![CDATA[ <article> <p>Cyberattacks are increasing in speed and sophistication, ranking among the biggest threats to businesses of all sizes and industries. </p><p>Previously unprecedented costs have made headlines; in October, a report from the Cyber Monitoring Centre revealed that the <a href="https://www.techradar.com/best/best-online-cyber-security-courses">cybersecurity</a> incident which affected Jaguar Land Rover in August cost the UK economy an estimated sum of 1.9 billion pounds. </p><p>Meanwhile, in North America, the aerospace sector has seen a spate of attacks, with WestJet’s June cyberattack resulting in the theft of 1.2 million passengers’ data while the data sets of 1.5 million flyers are believed to be compromised following September’s attack on Collins Aerospace.</p><p>Research released earlier this year revealed a stark dip in public trust; when questioned on which industry consumers trusted with their data, no single sector saw an approval rate of above 50%. </p><p>Without a clear and modernized <a href="https://www.techradar.com/news/best-internet-security-suites">security</a> strategy, businesses are leaving themselves vulnerable to the far-reaching consequences of a breach, including reputational damage, operational delays, and financial loss. </p><h2 id="why-zero-trust-matters">Why Zero Trust Matters</h2><p>AI has given everyone with a <a href="https://www.techradar.com/news/best-business-desktop-pcs">computer</a>, <a href="https://www.techradar.com/news/best-business-tablets">tablet</a>, or even <a href="https://www.techradar.com/news/best-business-smartphone">smartphone</a> easy access to automation, including those using it with malicious intent. In the cyber space, this allows criminals to continually change their approach, scaling their efforts and exploiting vulnerabilities in their target’s software. To keep up with evolving threats, Zero Trust is vital, prioritizing data over assumptions is not optional. </p><p>The contemporary approach to the principle of Zero Trust has been developed from the work of the Jericho Forum, made up of industry experts keen to establish a ‘de-parameterized’ model that enables a more granular and flexible approach to security. </p><p>The group, which later became part of The Open Group Security Forum, paved the way for John Kindervag’s popularization of the <a href="https://www.techradar.com/best/ztna-solutions">Zero Trust</a> principle in 2009, emphasizing the importance of 'Never trust, always verify'. In a conversation with Gartner’s Neil MacDonald, he further explained that “Zero Trust is not a technology; it’s a security philosophy that rewires how we think about access”.</p><p>It's a smart idea; allowing security systems to keep up with industry change. In reality, however, despite the majority (96%) of companies incorporating, or planning to incorporate, a Zero Trust strategy, only 35% have made it to the implementation stage. </p><p>To decrease the frequency of corporate security breaches, this needs to change. The key to success? A mutually agreed understanding of what Zero Trust is and a cross-industry implementation drive.</p><h2 id="steps-to-a-modernized-security-strategy">Steps to a Modernized Security Strategy</h2><p>The traditional business approach to cybersecurity, including an over-reliance on <a href="https://www.techradar.com/vpn/best-vpn-for-business">VPNs</a>, led companies to draw a single ‘perimeter’ around their data. Thus, once breached, cybercriminals were able to steal and duplicate data from across the organization. In contrast, with a strategy led by strict adherence to the Zero Trust principle, access is confined to the singular section where the incident occurred. </p><p>The successful implementation of the Zero Trust principle requires a focus on data and information security across all networks and platforms. For example, the evaluation of risk should take place on a case-by-case basis, with deliberate decisions made to accept, mitigate, or transfer. With this approach, security teams have the flexibility needed to safeguard data and, when inevitable breaches do occur, ensure hackers can only access the top layer of information. </p><p>The use of Zero Trust as a basis for risk management necessitates a security infrastructure that does not become stagnant but is ever-changing to prevent cyberthreats from impacting the organization. At any point, a key tech stack component can become a target for criminals. In response, to drive resilience, security professionals should track any attempts, and techniques used, amending infrastructure in tandem. </p><p>Across sectors, cybersecurity budgets are growing. In March, the IDC's Worldwide Security Spending Guide predicted a spending growth of 12.2% in the year that followed, growing to $377 billion by 2028. Though this reflection of increased enthusiasm to strengthen security infrastructure is a step in the right direction, organizations need to ensure this investment isn’t just a one-off. Every element, and everyone’s access, must be continually questioned to protect from the escalating threat posed by a breach.</p><h2 id="designing-a-forward-looking-security-strategy">Designing a Forward-Looking Security Strategy</h2><p>Solutions adopted with cybersecurity in mind may differ between organizations but, to drive resilience in the long-term and successfully embrace the principle of Zero Trust, vendor-neutral definitions of methodology and standards will be a necessity. </p><p>Once these are widely acknowledged, a commitment should be made to strengthening the underlying security infrastructure over the long-term, driven primarily by the principle of Zero Trust. In a landscape where security threats are ever-evolving, so too should each corporation’s ability to protect themselves from malicious actors. This includes blocking access to valuable data sets in the event of a breach and ensuring each person responsible for security is kept up to date with the latest insight on the nature of threats. </p><p>When applied in practice, though the exact methods and vision may differ, the guiding principles should remain consistent. To establish necessary considerations, organizations can start with the Zero Trust Commandments, which include the need for security to be integrated through culture and processes, the implementation of asset-centric controls, and the explicit validation of trust through using all relevant information available.</p><p>A news landscape dominated by security breaches and cyberattacks has created a generation of consumers that, more wary than before, are no longer shocked when the personal information they have willingly shared with corporations is taken with malicious intent. It should be expected that they will think twice before trusting a new organization with their information, placing an onus on businesses to prove that their infrastructure is robust. </p><p>As we look ahead to 2026, the companies that succeed will prioritize security, consider wider society expectations, and prove their commitment to Zero Trust in each decision they make.</p><p><em></em><a href="https://www.techradar.com/best/firewall"><em>We've rated the best firewall software.</em></a></p><p><em>This article was produced as part of </em><a href="https://www.techradar.com/pro/perspectives" target="_blank"><em>TechRadar Pro Perspectives</em></a><em>, our channel to feature the best and brightest minds in the technology industry today.</em></p><p><em>The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: </em><a href="https://www.techradar.com/news/submit-your-story-to-techradar-pro" target="_blank"><em>https://www.techradar.com/pro/perspectives-how-to-submit</em></a></p> </article> ]]>