{"id":44857,"date":"2022-01-17T21:13:00","date_gmt":"2022-01-17T21:13:00","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/zero-trust-is-hard-but-worth-it\/"},"modified":"2022-01-17T21:13:00","modified_gmt":"2022-01-17T21:13:00","slug":"zero-trust-is-hard-but-worth-it","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/zero-trust-is-hard-but-worth-it\/","title":{"rendered":"Zero Trust is hard but worth it"},"content":{"rendered":"
<\/div>\n

At the end of last year, I heard from a long-time enterprise contact that had a major security concern. The company had installed three layers of security and just completed an audit. It showed that since thIey\u2019d finished their installation they\u2019d had five security incidents, and all of them had originated inside their security perimeter, bypassing most of their protection.<\/p>\n

Their question was what they did wrong and how they could fix it.<\/p>\n

What this company experienced is far from rare, and the source of their problems and the paths to correction are far from easy.<\/p>\n

We tend to think of security as a goal we can achieve with a simple toolkit. Not so. Security is the state you achieve by dealing with all likely threats, and every threat has to be addressed in its own unique way. Problems can come from hackers gaining access to an application or database from the outside, through things like stealing credentials or exploiting weak authentication.<\/p>\n

They can also come from exploits, where faults in a program (application, middleware, or operating system) can be used to trigger malicious behavior. Finally, they can come from malware that is introduced in some way. Combinations of the three are increasingly common. Enterprises have tended to focus, as my contact did, on perimeter security as a defense against the first of these security problems. They\u2019ve overlooked, or maybe I should say underthought, the last two.<\/p>\n

Fixing those other two problems doesn\u2019t mean abandoning perimeter security, it means addressing all the possible problem sources, and the issues my contact reported offer some insight on rules to sharpen security focus.<\/p>\n