Preventing human error

85% of cybersecurity incidents contain an element of human error and, with the pandemic shifting the workplace outside the confines of the traditional office space, organizations across the world now lack the visibility over employee activity that they had grown accustomed to.

At best this has a knock-on effect on productivity. At worst, this makes organizations even more vulnerable to cyber criminals.

Increased surface area for cyber criminals to attack

Remote working means there is suddenly a huge increase in the surface area available to attack; employees are now accessing sensitive data from multiple locations across multiple devices and the traditional perimeter has now become blurred.

A single stolen or lost laptop, which is not encrypted or password protected, can give an unauthorized password access to the entire set of data in all apps if a user remains logged in to cloud apps. This becomes even more of a concern at scale; even within SMBs that may only have 100 employees, the number of potential access points can exceed 5000 if there are 50 different cloud apps being used.

Siege mentality no longer works in deflecting external threats and there are multiple access points that cyber criminals can target. It is impossible for IT policies to be enforced on third-party WiFi networks, and the traditional method of using an IP address as a form of verification becomes obsolete in a workplace that is transient in nature.

Outbound (and inbound) employees

Alongside dealing with the current workforce, organizations are now faced with much more complicated considerations when it comes to inbound and outbound employees too. During the pandemic, more than one in four employees in the UK were furloughed, with 8% of these not returning to their employer once furlough ended. With the majority of these employees still retaining access to at least one sensitive business system after they have left their role, they pose a real threat when it comes to data breaches.

Similar considerations need to be made for inbound employees; many often bring with them legacy behavior and a lack of digital hygiene. One example of this is a reliance on personal apps that may not have the necessary level of security to comply with IT policies; a recent study by Verizon found that data breaches through such applications have doubled in frequency since 2019.

The cost of cyber-attacks

One of the major concerns for any organizations are the costs associated with cyber-attacks.

With a DDoS (distributed denial-of-service) attack, systems could be offline for a few hours, resulting in loss of revenues and a disrupted workforce. If a cyber-attack infects an organization’s systems with ransomware, then this could cripple them for days or even weeks. Along with potential ransom payments, the cost of recovery could result in losses of millions of pounds. A Ponemon Institute study found that organizations spend almost £3 million per incident; a not-insignificant number.

There is also the issue of data; if potentially sensitive and personal information is stolen in a data breach, it can not only tarnish the reputation of a business, but also affect customer retention or lead to hefty fines from the authorities.

Zero Trust as a solution

With the indiscriminate nature of cyber-attacks, the most obvious solution for an organization is to implement ‘Never trust, Always verify’ security measures across it’s networks. This is particularly important when we consider just how many areas of a business can be targeted; by working under the assumption that every connection – whether “secure” or unsecure – could be a threat, this approach to security is proactive rather than reactive, preventing a potential cyber-attack before it can even take place.

Managing these IT policies under a single-system platform, such as that offered by Zelt, helps to unify operations across both IT and HR departments, ensuring that employees are only able to access data that they need at that given time for their given role in the company. For those leaving a company, permissions can quickly be revoked, protecting any potential access to sensitive data. This can be time-intensive, and so it also helps to automate the system in order to manage resources.

Of course, for Zero Trust to effectively combat the threat of cyber-attacks, every single employee of a company needs to be behaving in the same way. Again, by automatically implementing a policy through a single-system platform, there is less room for error and every employee must, by default, operate under the same rules. This can also remove any potential friction between the employer and the employee when monitoring and implementing various permissions; the Zero Trust process becomes a policy rather than any form of judgement.

Source – The threat to cyber security in 2022 and how zero trust can combat this