Common Cybersecurity Breach Scenarios Disrupted by Zero Trust
Four Rules of Zero Trust to Boost Cybersecurity
As businesses face more dynamic cyber threat actors than ever before, Zero Trust is recognized as a leading cybersecurity framework for addressing the expanding threat landscape. With cybercrime expected to cost the world $10.5 trillion USD by 2025, let’s take a look at the types of breaches a Zero Trust security approach can prevent and mitigate.
First, a refresher on Zero Trust. The framework of Zero Trust is outlined in our recent white paper Securing a New Digital World with Zero Trust, and includes the premise that all traffic should be regarded as suspicious until verified: “never trust, always verify.” Four key tenets of the Zero Trust approach include:
- Protect the crown jewels: Deploy network segmentation to create perimeters and micro-segments, while limiting user privileges (such as unnecessary administrative rights).
- Automate your lookout: Use leading incident detection and response tools, with automated solutions where possible.
- Make your tools work together: Integrate cybersecurity offerings across multi-vendor networks to create a comprehensive, unified cyber approach.
- Keep an eye out: With full network visibility, watch for suspicious behavior and other patterns across data, devices, applications, networking tools and other channels.
With this approach, let’s take a look at common cybersecurity attacks Zero Trust can address:
Phishing Attacks
Phishing is a common type of cyberattack that uses social engineering to fool unsuspecting users. Often, a user will receive an email with an attachment or undercover download link, which tricks them into taking an action that downloads malware or takes them to a fake login page to give away credentials. Consider a scenario where employees receive a forged email that requests them to change their password in a short timeframe. By visiting the link and inputting their credentials into a counterfeit site, users can give threat actors access to a login portal, which allows hackers to move within a network and find additional weak points.
A Zero Trust approach accounts for this by assuming that any user can be compromised. Cybersecurity protocols that allow security administrators to maintain visibility into the network and watch for suspicious behavior can help quickly mitigate attacks as they occur.
A true Zero Trust approach should include informing employees and organizational stakeholders on cyber risk and how to prevent threats. Many Security Operations Centers (SOCs) will run regular exercises and tests including sending their own fake emails to employees to simulate what a phishing attack might look like. In some cases, employees may be asked to take a training course if they mistakenly engage with the fake malicious messages.
Business Email Compromise (BEC)
Business Email Compromise (BEC) often uses a combination of social engineering, malicious email campaigns and other impersonation methods to gain users’ trust with tactics like domain spoofing and lookalike domains. By targeting users with seemingly genuine messages and prompts, attackers can manipulate employees to make wire transfers, hand over credentials and allow threats to penetrate the network.
With Zero Trust, security administrators can use their visibility into a network to detect suspicious behavioral patterns, such as third-party users communicating with large numbers of staff via malicious email campaigns and unauthorized login activity from new devices, locations and users. Zero Trust should extend from the cloud to on-premise, and security personnel should have monitoring capabilities—ideally with automated detection and response—that prioritize mitigating BEC threats.
As with the whole of the Zero Trust approach, user education is key. Business users should understand common giveaways of email compromise, including email addresses and domains that don’t match the official versions, urgent requests for unusual or financially risky behavior including wire transfers and other account actions, and other signs of suspicious activity. Like phishing education, in some cases security personnel may test employees or networks with examples of BEC attacks to determine whether cybersecurity protocols are sufficient to address the threat.
Ransomware
In 2021, ransomware is one of the top challenges facing businesses, with the cost of ransomware rising globally to $1.85 million USD per incident. Ransomware usually comes in the form of employees or authorized users accidentally downloading malware, whether via email or a web portal or other application, that encrypts an organization’s files and data until a ransom is paid. In some cases, ransomware can be delivered via phishing or BEC attacks. In other cases, threat actors compromise credentials, move laterally within the network and deliver ransomware directly to the organization by posing as one of its employees.
A Zero Trust security posture assumes the threat of ransomware is ever-present. With automated detection tools, Zero Trust implementations watch for suspicious activity, malware and user behavior commonly associated with ransomware, such as unauthorized user activity or impersonation websites and other vehicles for malware delivery.
In some cases, ransomware attacks can be stopped at the infiltration stage with simple two-factor authentication. By requiring that all company portals use two-factor authentication for access, such as a text message or a unique code via a two-factor app like Google Authenticator, Zero Trust security practices can use layered security to prevent a malicious actor from gaining the initial login access they need to escalate privileges or infect an organization.
As businesses take steps to address their exposure to cybersecurity risk, Zero Trust represents one of the most important frameworks for building a cyber secure, robust enterprise. View our white paper to learn more.