The so-called Zero Trust model for security proposed by Forrester Research earlier this month has revived debate about the way organizations secure their networks.. Zero Trust means end users are no more trusted than outsiders, and that organizations must inspect all traffic, from the outside and on the inside as well. While this concept has stirred Big Brother worries among skeptics, it also resonates with some experts in light of the end user application-borne attacks as well as malicious or careless insiders. But does this user threat trend merit a whole new security model? Most security experts agree that you can't trust your internal network and have to assume you've been compromised, so it's a matter of detecting and stopping breaches before any information is stolen or damage is done. It's just that inspecting all internal traffic can be a tall order -- and maybe overkill. The link for this article located at Dark Reading is no longer available. . The concept of Zero Trust dictates that every user is scrutinized in the same way as external entities, emphasizing rigorous examination of all data flows.. Zero Trust Security, Network Inspection, End User Threats, Security Models. . Anthony Pell
Just ten years ago, security professionals had almost total control over what end-users ran on their computers. Today, the IT landscape looks very different and leading analysts and security experts are warning companies that, no matter what perimeter defenses and technologies they might implement, the biggest threat lies within the company - the system users, the human beings.. . .. Just ten years ago, security professionals had almost total control over what end-users ran on their computers. Today, the IT landscape looks very different and leading analysts and security experts are warning companies that, no matter what perimeter defenses and technologies they might implement, the biggest threat lies within the company - the system users, the human beings. Paul Robertson, director of risk assessment at TruSecure, a provider of intelligent risk-management products and services, says companies that come to him for advice on security policies are either "those that don't have anything at all, or just the basics," or "those that have a lot of policies, but no tidy implementation." A common weak area today, he says, is company usage policies. Having strong privacy and usage policies can go a long way to protect a company if someone does something wrong. "Policies need to be up-to-date and reflect the situation and culture of the company," says Robertson. "It should be understandable by the end-user, and have the buy-in of human resources." The biggest concern Roberts has is that there is no easy way to enforce policies regarding passwords and ID sharing and, as an IT expert, he knows how easy it can be to get a user's ID over the phone. "Even good intentions can threaten security. You have to do some reverse social engineering, because it's hard to get people not to be courteous and helpful," he points out. The link for this article located at SCMagazine is no longer available. . Just ten years ago, security professionals had almost total control over what end-users ran on their. years, security,professionals, almost, total, control, end-users, their. . Anthony Pell
The 2001 Computer Crime and Security Survey from the Federal Bureau of Investigation and the Computer Security Institute makes it clear that cybercrime is on the rise. But for the first time, according to survey respondents, incidents precipitated by outside hackers outnumbered those originated by internal threats.. . .. The 2001 Computer Crime and Security Survey from the Federal Bureau of Investigation and the Computer Security Institute makes it clear that cybercrime is on the rise. But for the first time, according to survey respondents, incidents precipitated by outside hackers outnumbered those originated by internal threats. Experts said that trend is likely to continue as increasing numbers of outside intruders mount more attacks on computer networks and PCs. However, others pointed out that internal perpetrators remain the most difficult threats to fight, as they go straight for a company's crown jewels and often know how to cover their tracks. . The 2001 Computer Crime and Security Survey from the Federal Bureau of Investigation and the Compute. computer, crime, security, survey, federal, bureau, investigation, compute. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.