Although the EY Global Information Security Survey 2018-19 says that internal attacks are responsible for only 5 percent of cyber threats to organizations, if this source is removed, organizations will definitely heave a sigh of relief. The basic reason your organization and others are becoming more threatened by malicious software is the rapid increase in digitalization. You are increasing the number of internet connections which raises the likelihood of being attacked. You mustn’t dwell on the ARC Advisory Group report which says that 40 percent of the companies surveyed stated that they have not experienced any cyber-incidents within the last 12 months since there is the likelihood that you have simply been unable to identify all incidents in 2018. By the time you do a thorough check, making use of more intrusion detection solutions available globally today you will really appreciate the savviness of attackers. These intrusion detection solutions will expose more cyber incidents than were visible in the past and you will see why you need to apply a zero-trust strategy. Due to the fact that a lot of people have access to your network security, threats will keep on escalating since attackers will have more vectors to exploit. You, therefore, need to implement a zero-trust approach to network security by removing any residual trust from the network. You absolutely don’t have room for the type of trust you unnecessarily grant to both users and systems that access restricted resources from within your organization’s perimeter. Also, you must curb the access granted to external users for specific systems that may have been removed. A zero-trust strategy ensures that you don’t have vectors that can be meaningfully exploited by attackers.
BYOD as an entry point
Without an unblemished input from your employees, any strategy targeted at safe network security is dead on arrival. If your company has imbibed the culture of BYOD without a zero-trust strategy, then it’s a potential source of an attack. Most employees have teens and kids, even those who are not parents may have brothers and sisters who incidentally are teens and kids. With the rate of advancement in technology, it may not be easy for you to keep your devices away from both the prying eyes and the grabbing hands of these kids. The security vendor poll of 150 IT and security professionals at Cloud Expo Europe in London revealed that 74 percent are allowing employees to use their personal devices at work, but 47 percent either don’t have a policy in place to manage them or don’t know if any policy to manage BYOD exists. This is a clear indication that you’re not safe from attacks. If an employee can be deceived through social engineering attacks that typically involve some form of psychological manipulation, fooling otherwise the unsuspecting employee into handing over confidential or sensitive data, what do you expect from a kid who may possibly be handling a device and such prompts come on? Inasmuch as there is a human angle to social engineering, attempting to prevent these attacks without a zero-trust approach can be tricky for your company. For the singular fact that the number of people that can access your network legitimately keeps on increasing and also the increasing refusal to accept as desirable of the perimeter by the use of BYOD, signify that segregating users as being internal or external is increasingly unjustifiable. If you take a critical look at the way and manner attacks are launched by often depending on or gaining unprivileged access to an internal system in order to pivot to juicier targets you will come to the right conclusion that an internal threat may just be an extension of an external one. While we don’t need to argue the fact that BYOD can drive improved productivity, cost savings, and talent retention, it may, however, unwittingly increase the risk of data loss if proper policies and security controls aren’t put in place. While you may have decided to take serious actions about your employees, it’s very important that you realize that your vendors, contractors, and other third parties you have business affiliations with and who can access your network should also be placed on the same zero-trust approach. With a zero-trust approach to network security, therefore, there is absolutely no need to differentiate between the two types of threats.
