www.helpnetsecurity.com Open in urlscan Pro
44.235.189.191  Public Scan

Form analysis
1 forms found in the DOM

POST

<form id="mc4wp-form-1" class="mc4wp-form mc4wp-form-244483 mc4wp-ajax" method="post" data-id="244483" data-name="Footer newsletter form">
  <div class="mc4wp-form-fields">
    <div class="hns-newsletter">
      <div class="hns-newsletter__top">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__title">
              <i>
                        <svg class="hic">
                            <use xlink:href="#hic-plus"></use>
                        </svg>
                    </i>
              <span>Cybersecurity news</span>
            </div>
          </div>
        </div>
      </div>
      <div class="hns-newsletter__bottom">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__body">
              <div class="row">
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="520ac2f639" id="mcs1">
                    <label class="form-check-label text-nowrap" for="mcs1">Daily Newsletter</label>
                  </div>
                </div>
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="d2d471aafa" id="mcs2">
                    <label class="form-check-label text-nowrap" for="mcs2">Weekly Newsletter</label>
                  </div>
                </div>
              </div>
            </div>
            <div class="form-check form-control-lg mb-3">
              <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="28abe5d9ef" id="mcs3">
              <label class="form-check-label" for="mcs3">(IN)SECURE - monthly newsletter with top articles</label>
            </div>
            <div class="input-group mb-3">
              <input type="email" name="email" id="email" class="form-control border-dark" placeholder="Please enter your e-mail address" aria-label="Please enter your e-mail address" aria-describedby="hns-newsletter-submit-btn" required="">
              <button class="btn btn-dark rounded-0" type="submit" id="hns-newsletter-submit-btn">Subscribe</button>
            </div>
            <div class="form-check">
              <input class="form-check-input" type="checkbox" name="AGREE_TO_TERMS" value="1" id="mcs4" required="">
              <label class="form-check-label" for="mcs4">
                <span>I have read and agree to the <a href="https://www.helpnetsecurity.com/newsletter/" target="_blank" rel="noopener" class="d-inline-block">terms &amp; conditions</a>
                </span>
              </label>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div><label style="display: none !important;">Leave this field empty if you're human: <input type="text" name="_mc4wp_honeypot" value="" tabindex="-1" autocomplete="off"></label><input type="hidden" name="_mc4wp_timestamp"
    value="1701310690"><input type="hidden" name="_mc4wp_form_id" value="244483"><input type="hidden" name="_mc4wp_form_element_id" value="mc4wp-form-1">
  <div class="mc4wp-response"></div>
</form>

Text Content

 * News
 * Features
 * Expert analysis
 * Videos
 * Events
 * Whitepapers
 * Industry news
 * Product showcase
 * Newsletters

 * 
 * 
 * 


Please turn on your JavaScript for this page to function normally.
Mirko Zorz, Director of Content, Help Net Security
November 29, 2023
Share


STRATEGIES FOR CULTIVATING A SUPPORTIVE CULTURE IN ZERO-TRUST ADOPTION



In this Help Net Security interview, Wolfgang Goerlich, Advisory CISO at Cisco,
discusses the benefits of implementing a mature zero-trust model for both
security and business outcomes, revealing a decrease in reported security
incidents and enhanced adaptability.

Goerlich emphasizes the role of organizational culture in successfully adopting
zero trust, outlines strategies for cultivating a supportive culture, and talks
about future trends in the evolution of the zero-trust model.



WHAT ARE THE MEASURABLE BENEFITS OF IMPLEMENTING A MATURE ZERO-TRUST MODEL
REGARDING SECURITY AND BUSINESS OUTCOMES?

Good security first delivers a business outcome and, as a result, then increases
the security posture. When we research outcomes, we look to those around
enabling the business, managing risk, and increasing operating efficiency.

Organizations maturing their zero-trust programs are doing so in support of
digital transformation, workforce modernization, and adopting hybrid cloud
infrastructure. We’ve seen measurable increases in the security function’s
ability to keep up with the business, adapt to external events, and create a
security culture.

Specific to security, organizations maturing zero trust are half as likely to
report security incidents (dropping 67% to 33%). The likelihood of incidents
across the board decline, from a data breach, DDoS attacks, accidental
disclosure, or malicious insider. Ransomware is significantly less likely given
zero trust’s identity controls (11% decrease) and network and workload
protections (8% less likely). We see fewer incidents, the severity is lesser,
and the speed of response and recovery is greater.

HOW INFLUENTIAL IS ORGANIZATIONAL CULTURE IN SUCCESSFULLY ADOPTING ZERO TRUST,
AND WHAT STRATEGIES SHOULD LEADERS EMPLOY TO CULTIVATE A SUPPORTIVE CULTURE?

Culture and relationships are significant drivers for successful programs. In
the previous year’s study, we found organizations with mature zero-trust
programs were twice as likely to report strong relationships with their
executives, their peers, their directs (as measured by retention), and their
business partners (as measured by security culture). We see similar correlations
in this recent study. Strong relationships lead to good programs, leading to
stronger relationships and better security programs.

Security leaders should take a three-pronged strategy. First, invest time in
cultivating stakeholders and sponsors. Second, find opportunities to collaborate
with their peers. Finally, leverage and strengthen the security champions and
security advocates program. This will position leadership well for maturing zero
trust, but it doesn’t end there. Down the chain, there also needs to be
relationship building between IT, security, and business functions. It begins
with the CISO and CIO on the same page to kick the work off. But it doesn’t end
until the front-line security professional can contact the network admin and get
the work done.

WHAT ROLE DOES SECURING THE IT STACK PLAY IN A MATURE ZERO-TRUST MODEL, AND HOW
SHOULD COMPANIES APPROACH THIS?

This study researched zero-trust capabilities for identity, device, network,
workload, automation and orchestration. These capabilities align with the CISA
zero-trust maturity pillars. The zero-trust model uses policy to extend or
revoke a trust boundary when a person or service connects to an application or
resource. To be effective, this policy enforcement is across the IT environment
and up-and-down the IT stack. This includes directories and identity providers,
device management, firewall and networking infrastructure, software development
tooling, and more.

While 86.5% of organizations surveyed have embarked on zero-trust programs, only
2% of organizations have achieved maturity across all zero-trust pillars. Why?
There are many reasons, but certainly, IT complexity and a lack of engagement
from IT owners are contributing factors. Successful programs embed zero-trust
principles in the IT stack, leveraging relationships between security leadership
and IT leadership.

HOW DO INTEGRATION AND AUTOMATION DRIVE THE MATURITY OF ZERO-TRUST
IMPLEMENTATIONS, AND WHAT ARE SOME BEST PRACTICES FOR ACHIEVING THIS?

This was a surprise from this year’s study: organizations using Security
Orchestration and Automated Response (SOAR) are more likely to report having
zero trust in place (13.7%). We’re seeing a shift in how the industry defines
zero trust. Now we still have a long way to go in order to see automation widely
deployed, with 47% of organizations not yet started on the capability and only
15% of organizations reporting having completed it.

Successful zero trust programs must integrate multiple tools in policy decision
and automate multiple systems for policy enforcement. Otherwise, we run the risk
of siloed tech stacks, unused functionality, and unrealized benefits. Start by
including automation with future-state roadmaps and investigate what
functionality the current tooling will support. In addition, security leaders
should evaluate new purchases based on integrations, automation, and API
features.

HOW DOES IDENTITY AND ACCESS MANAGEMENT SERVE AS A CORNERSTONE IN ZERO TRUST,
AND WHAT ARE THE CHALLENGES IN IMPLEMENTING EFFECTIVE IDENTITY STRATEGIES?

Strong authentication, MFA, continues to have strong stopping power against
ransomware and supply chain attacks (8% reduction and 4%, respectively.) Yet the
phrase “identity is the new perimeter” will send a shiver through anyone who’s
had to lead an enterprise identity and access management program. It’s
challenging to properly on-board and off-board people, and to provision them
across the thousands of applications a typical organization relies upon.

This complexity won’t be going away any time soon. An effective strategy focuses
on successfully deploying key capabilities – like MFA, SSO, and RBAC – to a
tightly scoped set of people and applications. Then balance usability with
defensibility to get out of the way of the user while getting in the way of the
adversary.

By deploying a set of high-value security capabilities to a well-scoped
high-risk area of the business, security leaders can demonstrate the value of
zero trust and position the program for expansion and maturation.

WHAT FUTURE TRENDS DO YOU FORESEE IN THE EVOLUTION OF ZERO TRUST, AND HOW SHOULD
ORGANIZATIONS PREPARE TO ADAPT TO THESE CHANGES?

Zero trust has moved beyond the buzzword to be an actionable set of capabilities
and a defined architecture. Organizations are taking a standards-based approach
by leveraging NIST and CISA guidance.

While many of the early successes were with identity and device security,
success in zero trust requires enhancements in networks and workloads. We must
avoid zero trust becoming another siloed capability or bolted-on security
control. Therefore, organizations should prepare for integration and automation
becoming more important.

Security leaders bring capabilities and technologies to bear to solve business
problems and deliver business outcomes. Within this context, the future of zero
trust is taking its place alongside our fundamental security principles. At
every level, at every request, our IT environment must be able to extend or
revoke trust to provide access while protecting assets.





More about
 * authentication
 * automation
 * CIO
 * CISA
 * Cisco
 * CISO
 * cybersecurity
 * identity
 * NIST
 * opinion
 * SOAR
 * strategy
 * zero trust

Share


FEATURED NEWS

 * Google fixes Chrome zero day exploited in the wild (CVE-2023-6345)
 * Okta breach: Hackers stole info on ALL customer support users
 * 5 resolutions to prepare for SEC’s new cyber disclosure rules

Report: The state of authentication security 2023



SPONSORED

 * eBook: Cybersecurity career hacks for newcomers
 * Download: The Ultimate Guide to the CISSP
 * eBook: Keeping Active Directory out of hackers’ cross-hairs
 * Guide: SaaS Offboarding Checklist




DON'T MISS

 * Sumo Logic discloses potential breach via compromised AWS credential
 * Marina Bay Sands breach exposed data of 665,000 customers
 * The 3 key stages of ransomware attacks and useful indicators of compromise
 * Aqua Trivy open-source security scanner now finds Kubernetes security risks
 * AI-assisted coding and its impact on developers




Cybersecurity news
Daily Newsletter
Weekly Newsletter
(IN)SECURE - monthly newsletter with top articles
Subscribe
I have read and agree to the terms & conditions
Leave this field empty if you're human:

© Copyright 1998-2023 by Help Net Security
Read our privacy policy | About us | Advertise
Follow us
×