Security leaders will be familiar with the term ‘Zero Trust’ – an approach crucial as vulnerabilities and attacks are becoming more damaging to organisations. Hila Meller, BT Vice President Security, Americas, EMEA and APAC, discusses some of the guiding principles for Zero Trust in banking and financial services.
When it comes to adopting a Zero Trust approach, many organisations in the financial services sector already have most of the constituent parts required. In fact, we estimate organisations already have between 60%-80% of the security building blocks that banking and financial services organisations need to adopt a Zero Trust approach. But moving from existing approaches to a new security model is a challenge. What needs to come next is a change of stance and a unification process to protect the business as it evolves.
In the following whitepaper, Why you need to turbo-charge your Zero Trust journey, we identify eight guiding principles for Zero Trust in banking and financial services.
#1 Identify your goal and pull it through your planning
Form your security strategy around the fundamental assumption that you will always be operating a dynamic network in a hostile environment. Centre your thinking around how you can best use automated processes to create security rules that change dynamically in response to context. But remember that automating a broken process is a swift route to failure; make sure you’re training your AI to make correct decisions about risk so it can automate the appropriate response.
#2 Assess existing capability before investing in more
Don’t rush to spend money on ‘Zero Trust’ point products because you may be duplicating capability or investing in areas that aren’t a priority for your organisation. Instead, optimise the value you already have in your security estate by establishing what latent capabilities you possess. For example, layer one, two and three segmentations along with very narrow access lists could be a fruitful first step on your Zero Trust journey.
#3 Focus on removing peer-to-peer protocols
Segmentation is your key defence in a Zero Trust environment, but you won’t be able to segment your network if you’re running peer-to-peer protocols. A vital part of any attacker’s kill chain is the ability to pivot from one host to another, but if you limit their ability to move easily, then you neutralise entire classes of attack. Think about how 5G architectures cut out peer-to-peer connections, forcing every call to go through a central gateway – this model should be your aim.
#4 Control access to core assets
Leverage your security investments to secure your cloud and data centre servers, using Zero Trust segmentation to coordinate traffic authorisations across your estate. This needs to be universal so it’s as watertight as possible and servers only accept traffic sent by authorised users. Consider investing in red teaming ethical hacking exercises to check the security of your key assets.
#5 Incorporate user identification
Limit your exposure to risks by only opening ports in your environment when they’re needed. Make user identity the first key to access your systems and make sure permissions are revoked as soon as the user logs out.
#6 Build in security-by-design to your projects
Investigate how containerisation can be a springboard for your security DevOps, providing a pre-certified and pre-configured software ‘container’ that you can build on to create automation and machine-to-machine application service models. Containerisation is an ideal opportunity to leave waterfall cycles of patching behind, offering instead security that flexes with context.
#7 Segment, segment, segment
Introduce micro-segmentation to segregate – and protect – your network at a granular workload level. This will give you the real-time visibility you need as you monitor application behaviour and connections to understand what is talking to what and to identify risks. It will also give you the level of control you need to improve your breach containment, preventing lateral movement and reducing the blast radius of any attack.
#8 Activate your human firewall
Remember the user in all this and make it easy to do the right thing and hard to do the wrong thing. Educating and motivating your workforce to follow protocols and stay vigilant against potential attacks is just as important as any other aspect of your Zero Trust security journey.
When you’re operating in an environment that’s constantly shifting in ways that open up new vulnerabilities, adopting a Zero Trust approach is essential. Getting it right is about extracting and extending value from your existing investments rather than jumping straight into new ones. Once you’ve identified latent capabilities that you can leverage immediately, employing these eight principles will alleviate the challenges of moving to a new security model.
