A MATTER OF ZERO TRUST

RUSSIAN HACKERS HAVE TAUGHT US THAT THE ERA OF THE “TRUST BUT VERIFY” APPROACH TO CYBERSECURITY IS OVER.

- ANNE-FRANCES HUTCHINSON

“What’s a business to do? … Don’t freak out. But do get serious. Gone are the days when the only risk was having sensitive data stolen. Progress begins with you—what data and which systems are most important to your company? Prioritize from there. You can’t build perfect walls, and there is no silver bullet in cybersecurity, so don’t let your CIO or CISO tell you otherwise. You’ll need a diversity of approaches, and those approaches will have to evolve over time. If you didn’t believe it already, believe it now … ”

This advice for the C-suite came from Michael Sulmeyer, cybersecurity project director at the Harvard Kennedy School and former director of Plans and Operations for Cyber Policy in the Office of the Secretary of Defense, addressing how businesses should approach threats from Russian hackers and other state actors.

In 2017.

Despite the inexorable progression of cybercrime since Sulmeyer proffered his guidance, it still holds up. What has collapsed in the aftermath of the FireEye-Solarwinds catastrophe is certainty. The lesson of this moment is no longer as subtle as it was four years ago, or even four months ago. It is stark and irrefutable: Trust no one.

“Organizations need to start thinking about a security methodology that relies less on blocking specific traffic by policy and actively moving towards a zero trust, positive security model that explicitly states which traffic between users and hosts can be allowed, or whitelisted,” said Tempered Networks CTO Bryan Skene in TechRepublic.