Zero-trust is the logical successor to the legacy perimeter security model, but there are many common pitfalls to consider. Whether companies know it or not, we’re all on a journey toward zero-trust security. This concept, which can be summarized as “never trust; always verify,” has been around for over a decade as a security focus on least privilege. However, the pandemic brought it to the forefront, as corporate offices emptied and millions of workers started working from home. So, in a relatively short period, tens of thousands of companies inadvertently accelerated their zero-trust journey, often without a well-thought-out plan.

The truth is that you’re going to pay for cybersecurity one way or another. So, it’s better to invest now while the cost is much lower and more predictable. As a business owner, you have lots of projects vying for your time and money, and let’s face it, anything that’s not a revenue driver is easy to push to the bottom of the list. Unfortunately, cybersecurity too often falls into this category. Companies may tell themselves, “We already have security in place. We have a firewall; we have antivirus software; our critical applications are password-protected.” The reality is that you’re probably well aware that cyberattacks have exploded in the past 18 months, both in terms of frequency and seriousness. This year, for example, the damage costs from cybercrime are expected to reach $6 trillion, up from $3 trillion in 2015. To put this number in perspective, if it were measured as a country, cybercrime would be the world’s third-largest economy after the U.S. and China. In the past, data breaches were about data loss and the potential harm to the victim’s reputation. Today, however, we see attacks that result in significant operational delays and setbacks.

If the term endpoint security still evokes images of signature-based antivirus software, it’s time for a refresher on how critical this technology is to your organization. Time seemed to speed up over the past 18 months, with so many changes taking place in such a short period. For example, within the business world, digital transformation initiatives accelerated by seven years, according to a survey from McKinsey & Company. Besides the massive shift to remote work and new collaboration technologies, many companies had to update their security strategies.

While there’s no silver bullet to preventing a ransomware incident, following security experts’ recommendations will greatly reduce your vulnerability. Thousands of Americans experienced the trickle-down effect of a ransomware breach in early May following the Colonial Pipeline attack, which shut down the oil supplier’s operations and left many scrambling to find gas and waiting in huge lines when they did. The attack originated from DarkSide, a Russian-linked criminal group, who threatened to leak the utility provider’s sensitive data unless the company paid a $4.4 million ransom.

How you respond to a security incident can determine whether the problem gets fanned into flame or extinguished. When companies plan their cybersecurity strategies, there’s often a lot of time spent talking about and testing various security solutions, backup and disaster recovery tools and security awareness training options. All these actions are vital components to building a strong security posture, but they’re not the first thing companies should be thinking about. One of the most important foundational activities organizations tend to put off until it’s too late (i.e., post-incident) is creating a plan that details how your company would handle a security incident. While it might sound a bit defeatist to create a plan that assumes the security tools and services you’re about to invest in to prevent a security incident are going to fail, it’s not the case. First, not every security incident is a worst-case scenario like the Colonial Pipeline attack that resulted in a $5 million ransom payment. Often, an incident is something much smaller, such as a failed attempt to breach your defenses. The second point is that a small security incident can become a serious threat if the incident response isn’t handled properly. More on this point below.

Earlier this month, Russian-linked cybercriminal organization, REvil, launched the single biggest global ransomware attack on record. The breach infected thousands of victims in more than 17 countries and demanded $70 million in cryptocurrency to unscramble all the infected machines. What made this breach especially noteworthy was the specific conduit the criminals used to gain access to the victims: Kaseya VSA (virtual systems/server administrator), a remote monitoring and management (RMM) solution. RMM solutions are commonly used by managed services providers (MSPs) and managed security services providers (MSSPs) alike. What makes them particularly attractive to cybercriminals is that each MSP/MSSP breach has an enormous trickle-down effect. For example, CBS News reported that Swedish grocery chain Coop had to close most of its 800 stores for multiple days because the attack crippled their cash register software supplier. Thus, not only do these “one-to-many” attacks lead to more victims in a shorter period, but they also lead to bigger payoffs for the attackers.

Sportsmanship and collaboration are the key to success – whether it’s a sports team, colleagues on a project, or winning the Pinewood Derby. Because people are at the center of the data, threats and attacks, and the protection against those, leading security solutions companys such as Proofpoint takes a people-centric approach to cybersecurity. Here at Presidio, our philosophy is also centered around our team of technical experts and  getting the RIGHT people in the RIGHT roles to deliver impactful business outcomes for you.

Security is like weight; it can be more effective if you put it in the right places. In a Pinewood Derby you can set a weight anywhere on your car, but it will affect your speed depending on where put the weight.  In your technology organization, by having visibility into Shadow IT, cloud risk assessment, and a true footprint of your applications, you can identify and put the right amount of security in the right places to secure and accelerate your business. Visibility in real-time is key when it comes to cloud security. With so many apps, services and other endpoints moving to the cloud, it can be challenging to have a 360 view of everything that is going on. To respond to threats as they come up, you need to ensure you have a bird’s eye view of your entire cloud ecosystem.

At the core of your Pinewood Derby car is obviously the wooden body. What might not be as obvious is what should be at the core of your Zero Trust Network Access (ZTNA). The answer? Identity, or Identity Access Management (IAM) as the foundation in which to build the rest of your ZTNA. IAM is the core of ZTNA because it is the first step in granting entry. Much like showing your ID to enter a bar or board a plane, you are presenting verification that you are allowed to enter. Furthermore, It answers the question “Who has access to your most valuable asset – your data?” Most cyber-attacks take advantage of misused credentials in some fashion.