Zero Trust in financial services

Issue 3 2022 Editor's Choice, Security Services & Risk Management

When it comes to adopting a Zero Trust approach, many organisations in the financial services sector already have most of the constituent parts required. In fact, we estimate organisations already have between 60-80% of the security building blocks that banking and financial services organisations need to adopt a Zero Trust approach. But moving from existing approaches to a new security model is a challenge. What needs to come next is a change of stance and a unification process to protect their business as they evolve.

In our white paper ‘Why you need to turbo-charge your Zero Trust journey’ (*bt1), we identify eight guiding principles for Zero Trust in banking and financial services.

1. Identify your goal and pull it through your planning

Form your security strategy around the fundamental assumption that you will always be operating a dynamic network in a hostile environment. Centre your thinking around how you can best use automated processes to create security rules that change dynamically in response to context. But remember that automating a broken process is a swift route to failure; make sure you’re training your AI to make correct decisions about risk so it can automate the appropriate response.

2. Assess existing capability before investing in more

Don’t rush to spend money on ‘Zero Trust’ point products because you may be duplicating capability or investing in areas that aren’t a priority for your organisation. Instead, optimise the value you already have in your security estate by establishing what latent capabilities you possess. For example, layer 1, 2 and 3 segmentations along with very narrow access lists could be a fruitful first step on your Zero Trust journey.

3. Focus on removing peer-to-peer protocols

Segmentation is your key defence in a Zero Trust environment, but you won’t be able to segment your network if you’re running peer-to-peer protocols. A vital part of any attacker’s kill chain is the ability to pivot from one host to another, but if you limit their ability to move easily, then you neutralise entire classes of attack. Think about how 5G architectures cut out peer-to-peer connections, forcing every call to go through a central gateway – this model should be your aim.

4. Control access to core assets

Leverage your security investments to secure your cloud and data centre servers, using Zero Trust segmentation to coordinate traffic authorisations across your estate. This needs to be universal so it’s as watertight as possible and servers only accept traffic sent by authorised users. Consider investing in red teaming ethical hacking exercises to check the security of your key assets.

5. Incorporate user identification

Limit your exposure to risks by only opening ports in your environment when they’re needed. Make user identity the first key to access your systems and make sure permissions are revoked as soon as the user logs out.

6. Build in security-by-design to your projects

Investigate how containerisation can be a springboard for your security DevOps, providing a pre-certified and pre-configured software ‘container’ that you can build on to create automation and machine-to-machine application service models. Containerisation is an ideal opportunity to leave waterfall cycles of patching behind, instead offering security that flexes with context.

7. Segment, segment, segment

Introduce micro-segmentation to segregate – and protect – your network at a granular workload level. This will give you the real-time visibility you need, as you monitor application behaviour and connections to understand what is talking to what and to identify risks. It will also give you the level of control you need to improve your breach containment, preventing lateral movement and reducing the blast radius of any attack.

8. Activate your human firewall

Remember the user in all this and make it easy to do the right thing and hard to do the wrong thing. Educating and motivating your workforce to follow protocols and stay vigilant against potential attacks is just as important as any other aspect of your Zero Trust security journey.

When you’re operating in an environment that’s constantly shifting in ways that open up new vulnerabilities, adopting a Zero Trust approach is essential. Getting it right is about extracting and extending value from your existing investments rather than jumping straight into new ones. Once you’ve identified latent capabilities that you can leverage immediately, employing these eight principles will alleviate the challenges of moving to a new security model.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

The benefits of investing in whole-house surge protection
Smart Home Automation Security Services & Risk Management Residential Estate (Industry)
When you consider that the potential for equipment damage can run well into the hundreds of thousands of rands, whole-house surge protection is a worthwhile expense.

Are you your insider threat?
Technews Publishing Editor's Choice Security Services & Risk Management Commercial (Industry)
Insider threats are a critical aspect of risk management today, but what happens when it is the owner of the company acting fraudulently and making sure none of his staff can catch him?

Passion, drive and hard work
Technews Publishing Editor's Choice CCTV, Surveillance & Remote Monitoring Security Services & Risk Management
Colleen Glaeser is a leader in the security market, having made her mark in the male-dominated security industry through determination and hard work, along with a vision of making the world a safer place.

2022 trends in video surveillance
Eagle Eye Networks Editor's Choice CCTV, Surveillance & Remote Monitoring Integrated Solutions
Eagle Eye Networks predicts what will impact the video surveillance industry in the coming year and how to seize opportunities and forge a path to success, even amid ongoing uncertainties.

The impact of AI-enhanced video analytics on control room personnel
Leaderware Editor's Choice CCTV, Surveillance & Remote Monitoring
What impact do AI-capable detection systems have on control room staff, and do they mean a change in the demands on operators and the type of people you have in the control room?

To be or not to be, is that the objective?
Iris AI Editor's Choice CCTV, Surveillance & Remote Monitoring News
Gerhard Furter joins a discussion on the nature of sentience in artificial intelligence. Do we actually know what sentience is, or are we overestimating our human capabilities?

Leaning into the edge
Technews Publishing Axis Communications SA Forbatt SA Hikvision South Africa Editor's Choice CCTV, Surveillance & Remote Monitoring Integrated Solutions IT infrastructure
Video storage and analytical processing, with the help of artificial intelligence on the edge, is simple today with the powerful and advanced camera technology we have available.

The cybersecurity consolidation conundrum
Editor's Choice Cyber Security Healthcare (Industry)
Check Point discusses why less is sometimes more when it comes to securing your organisation from the innumerable cyberattacks happening every day.

Tracking surveillance into the future
Technews Publishing Bosch Building Technologies Cathexis Technologies Axis Communications SA Arteco Global G4S Secure Solutions SA Editor's Choice CCTV, Surveillance & Remote Monitoring Integrated Solutions
Hi-Tech Security Solutions asked six industry experts to join us around a table to discuss the state of the surveillance industry and where it is going.

The benefits of VSaaS
Technews Publishing Editor's Choice
Video Surveillance-as-a-Service promises to make life easier for customers as they will no longer have the hassles of hardware and software maintenance and they require less backup power. Hi-Tech Security Solutions asked David Arrikum if this is true.