Print.IT Reseller - issue 75

01732 759725 28 SECURITY Louella Fernandes An increased attack surface due to widespread remote working will undoubtedly accelerate the shift to a zero trust network architecture. Quocirca has published a new executive briefing which examines the concept and its principles. Research Director Louella Fernandes warns that print manufacturers and ISVs need to ensure that their products can adapt Document security in the age of zero trust the security systems designed to protect organisations have proved inadequate, leading many organisations to adopt a zero trust security model to mitigate risk. Trust nothing, verify everything In contrast to the traditional ‘castle and moat’ principle which assumes that everything within an organisation’s perimeter can be trusted and given unrestricted network access, zero trust is based on the principle of ‘trust nothing, verify everything’. It incorporates all the applications and endpoints, users, APIs, IoT devices, micro services and other elements that form an organisation’s IT footprint. The advantage of implementing zero trust is that it is a model, not a product, so it doesn’t require the replacement of existing technology. Instead, it is based around establishing and verifying the identity of the people and devices trying to access the network. It prompts organisations to think about managing access in a way that limits it to a least- privileged basis, reducing the potential for data breaches and data loss on the basis that you can’t leak what you can’t access. The zero trust approach allows organisations to gain visibility of user and device activity across their network and to enforce policies on data access and movement. Implications for the print infrastructure As the traditional office environment evolves into the more flexible, hybrid approach that is likely to persist in future, the implications for the print infrastructure and its incorporation into a zero trust environment become more complex. An unsecure printer or MFP can prove to be the weak link through which adversaries access the network, which means protecting it at a device and access level is critical. Also, with more employees working from home and potentially using personal devices to print corporate documents, this represents a further data security risk that must be managed. Print manufacturers and ISVs need to ensure that their products can adapt to the zero trust model. It enables the enforcement of policy-based controls, visibility into user and device activity and delivers the insight that permits better threat detection and response. By following the concepts of a zero trust architecture, print device manufacturers, ISVs and the print channel can help to ensure that the print infrastructure is not the weak link that malicious assailants target in an attempt to breach a part of an organisation’s zero trust environment. Quocirca’s Executive Briefing: ‘Zero trust in the remote working era’ provides an introduction to the zero trust concept, its key principles and implications for operating a secure print infrastructure. The report also includes recent Quocirca primary research on print security concerns and requirements from organisations. www.quocirca.com Security professionals have been battling to evolve and strengthen corporate cyber defences as fast as cyber criminals discover ways to circumvent them. This has worked – up to a point – however, recent rapid changes to working practices, coupled with an increasingly sophisticated cyber threat landscape, mean the traditional network security perimeter model is no longer effective. The use of personal and corporate devices to access the network via public networks and third-party clouds is introducing an expanded attack surface. Employees work from remote and sometimes unexpected locations, while businesses use public networks, third-party cloud infrastructure and software-as-a-service to give users access to the tools they need. In this drive for productivity, traditional security approaches can struggle to distinguish genuine connections and data interactions from malicious infiltration attempts. The increasing interconnectedness of today’s corporate ecosystems also creates challenges. Corporate networks are linked with those of partners, suppliers and service providers. This means that new risk – arising from malicious activity or simply poor security in a third party – can emerge from these ‘trusted’ partners at any time. Simultaneously, cyber criminals are growing increasingly skilled and strategic. Rather than trying to tackle corporate cyber defences head-on, they look for weak links, such as poorly protected partner companies or less well-protected parts of the network and use them to breach an organisation’s defences. As both the workplace and the cyber threat landscape have changed, and the attack surface has grown exponentially, Zero trust is based on the principle of ‘trust nothing, verify everything’ Zero trust in the remoteworkingera July2020 ©Quocirca2020 1 Zero trust in the remote working era ExecutiveBriefingReport