The New Cybersecurity Motto: Trust is Not an Option

The discovery of the Log4j vulnerability in December 2021 is one of the more recent and prominent reminders of why cybersecurity teams need to implement a zero-trust security architecture.

Not that they should need reminders. Incidents are happening every day, and some of them—such as ransomware attacks that impact entire supply chains—make the headlines. In the case of Log4j, a Java-based logging utility that’s part of the Apache Logging Services, security researchers found a zero-day security vulnerability involving arbitrary code execution.

This was no garden variety vulnerability. Security experts described the flaw as being one of the biggest and most critical discovered in recent years. And it provides a glaring example of how at-risk organizations can be. New software vulnerabilities are being uncovered all the time, some of them leading to serious security breaches and lost data.

As cybersecurity and IT leaders know all too well, the complexities of security have increased significantly in recent years. Not only are attacks getting increasingly sophisticated, but cybercriminals are more organized than before, in some cases well-financed by nation-states.

In addition, the attack vector has broadened considerably in recent years. Hybrid and remote work models mean more people are working remotely and, in many cases, are using their own devices and networks to access critical business data.

Furthermore, the use of cloud services and multi-cloud strategies continues to increase. Sometimes cloud deployments are not even on the radar of central IT and therefore not managed as other IT assets might be. Given the rise of cloud services, remote work, and mobile environments, the concept of perimeter defense has been obliterated. There really is no such thing as a perimeter, or perimeter defense, anymore.

The need for zero trust

All of these developments provide good reasons for organizations to shift to a zero-trust model of cybersecurity. The idea of zero trust is fairly simple: trust no user or device, and always verify. A successful zero-trust approach considers three things: a user’s credentials, the data the user is trying to access, and the…