Jigsaw puzzles come in many shapes, sizes, and complexities. But they all are completed in a similar way - viewing the end goal, determining a strategy, and implementing piece by piece. Similarly, IT environments come in varied architectures, sizes and complexities and may seem just as daunting as the most complex jigsaw puzzle at first glance. Does anyone in an organization really understand how all the pieces of security puzzle fit together? Not an understanding of general security models implemented, but how all the pieces of the entire enterprise jigsaw puzzle of security fit together? Is there a picture that shows you what it is supposed to look like when finished?
IT operation models, architecture models, platforms, hardware, software, employees, and outsourcers all come together to form the full picture for effective security. And, while we can probably never get to zero risk, we can implement Zero Trust to enable a layered series of controls giving us peace of mind amidst the complexities of the environment. The Zero Trust Model enables us to manage all the pieces of the puzzle with the least risk. It is imperative in today’s IT environments.
The Zero Trust security model can give us peace of mind even if we are not aware of every piece in our IT environment. At its most basic - never trust, always verify - it says that we should prepare our environments assuming we will be breached. By making this assumption, we will be proactive similar to the way we proactively and incrementally safeguard our homes and the content in our homes before going on vacation. Prior to departure for vacation, we lock up valuables, stop the newspaper and mail, automate lights, alert the neighbors, and lock the doors. All of these are mitigation efforts to discourage a burglar from targeting us and to reduce the exposure should they access our house even after the best of security intentions. Just as with our house, we can do the same with our IT environments. The model also drives the principle that trust is not automatic and trust is not assumed. Trust is gained at the entry point and reevaluated at each step on every journey. Resources are doled out in a granular fashion and only to those authorized. The trust level is commensurate with the task and not granted in excess. The Zero Trust model gives layers of protection and constantly verifies and validates. In total, it gives reassurance of security within the most complex of IT environments.
An all or nothing approach to implementing a new security model today is not an option. Security models and infrastructure are years in the making or, for the mainframe, decades in the making! Starting over by resetting every security control just isn’t an option our businesses can entertain.
But we don’t need to start from scratch to create a Zero Trust Model to lower our risk. More assuring, it is not necessary to conduct a massive evaluation and make changes to Identity and Access Management content. Instead, it is perfectly acceptable to augment existing IAM defenses with additional layers to provide a Zero Trust compliant model. As always, ‘rings of security’ and layered defenses are important in security architecture and the same works for implementation of Zero Trust. Advanced authentication at boundary or entry points and contextual granular just-in-time authorization drives layered security checks in a series. Zero Trust is simply implemented with a combination of additional tools and by following best practices with existing tools. From Multi-Factor Authentication, often easily or already adapted to existing architectures, to practices such as more granular controls, separation of duties and stringent adherence to least access privilege standards can all lead to a model of access driven by the goals of Zero Trust.
Analysis of few well-known data breaches can illustrate where implementation of the Zero Trust model may have reduced the success and impact of the breach, perhaps resulting in the hackers abandoning their efforts:
The illustrations above describe incremental changes that, when added to a layered series of security controls would have reduced the risk and painted a richer enterprise security picture. Incremental changes are manageable and often simpler. It’s just a matter of committing to and implementing the next step in completing the puzzle.
Many Zero Trust efforts focus on specific challenges, such as controlling access to cloud resources. But security objectives are rarely achieved by a single-point fix or even a tool deployment. Zero Trust isn’t a part number, but an approach and way of thinking. While ignoring some platforms or focusing only on specific business units might lead to quickly achieving a ‘check box’ result for the Security and IT team, it often does little to deliver on actual improvement in security posture. This consistently applies to Mainframe where there is a common belief that it is secure, simply because it is a Mainframe. However, just as with any platform, the Mainframe too is only as secure as the people and policies make it. Much new thinking in security has led to changes in policies, procedures, and practices across many platforms, but often, Mainframe does not participate in these new practices, despite the critical nature of the platform in running most businesses.
We’ll continue with a series of posts, videos, how-to content and more on our Zero Trust web page (link) discussing Zero Trust on the mainframe. The goal is to provide pragmatic practices that can be adopted by any Mainframe team, allowing them to leverage the benefits of Zero Trust sweeping the security community.
Admittedly, enterprise IT environments are large and complex. This applies to the mainframe as well, but don’t be overwhelmed. We will discuss how to implement a Zero Trust model with the mainframe in mind. Note this won’t be and can’t be exclusive to the mainframe, as it is part of a larger hybrid environment delivering applications that span cloud, on-prem and mainframe assets to deliver value to customers. But it is time that mainframe adopted critical security models such as Zero Trust. In order to do so, we will approach the topic in several segments:
In Summary, the bad news is that we need to assume and prepare for the worst-case scenario. The good news is that efforts are layered and can be implemented incrementally. Risk reduction is gained at each step. Improve your peace of mind. Achieve Zero Trust with Broadcom Mainframe Security Suite. And join us for ongoing discussions on the benefits of implementing Zero Trust on the mainframe.
SOURCES:
1CBC News · Posted: Dec 14, 2020 10:16 AM ET | Last Updated: December 14, 2020 | Gaps in safeguards led to massive Desjardins security breach: privacy commissioners
2 CBC News · Posted: Nov 01, 2019 10:44 AM ET | Last Updated: November 1, 2019 | 4.2 million Desjardins members affected by data breach, credit union now says Gaps in safeguards led to massive Desjardins security breach: privacy commissioners
3 Marriott International News Center· MARCH 31, 2020 — BETHESDA, MD | Last Updated: November 1, 2019 | Marriott International Notifies Guests of Property System Incident
Copyright © 2005-2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
Comments