This is part of Solutions Review’s Premium Content Series, a collection of contributed columns written by industry experts in maturing software categories. In this submission, Wasabi CEO David Friend offers an introduction to Zero Trust and enterprise data storage strategy.
Once upon a time, in a data center not that far away, users could log in via a VPN and have access to all of the applications and data inside the corporate network. Life was easy. Then, one miserable day, a group of malicious hackers broke into the corporate network via malware, compromised the network, stole data, and deleted the local backups. To make matters worse, they installed ransomware that encrypted the on-premises applications and data, bringing the targeted company to its knees until the ransom was paid. Suddenly, life was not so easy anymore.
The circle of [IT systems] trust has been shattered forever. Understanding that the nature of IT systems security has forever changed, let’s talk about Zero Trust and how it helps to combat this constant threat.
The Rise of Zero Trust
Among security professionals and industry leaders, it’s now a widespread truism that an organization’s data, assets, and workloads have to be ring-fenced. Making sure that teams only have access to data they immediately need is one of the best ways to ensure a business is safe from accidents, internal sabotage, or ransomware.
Limiting access limits the “attack surface,” or the range of data and processes available to any one user. This means that a single event – a ransomware package sent in an email, a compromised software supply chain, etc. – has minimal risk of undermining the rest of a business’s data.
Taken to its logical conclusion, this trend has given birth to the “zero-trust” paradigm of organizational security. Zero Trust is not necessarily a new concept. It has been adopted by a number of organizations that were among the first to recognize that a less trusting model of security was required to operate in the internet-connected cloud age. But what does zero-trust mean? And, looking beyond the technical requirements of zero-trust architecture, what does it mean for your organization’s backup and archiving processes?
The Layers of Zero Trust
The term “zero trust,” coined in April 1994 by Stephen Paul Marsh in his doctoral thesis on computer security at the University of Stirling, is defined as a security model based on maintaining strict access controls and not trusting anyone by default. It refers to an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources.
Simply translated: just because you can access the corporate network doesn’t mean you have access to any or all of the corporate resources – applications, databases, systems, or data.
Zero-trust sees security teams automatically segment their organization’s networks to prevent breaches. The layers of the zero-trust architecture onion build a security environment predicated on hyper-granular access privileges that are automatically assigned and reassigned in real-time to users.
It enhances security through automation, while also freeing up security teams from having to manually assign or reassign access privileges across an organization’s network. To that end, it eases the friction and frustration of security procedures for employees, as permission changes can be guaranteed in a matter of minutes.
Those are the technical layers of zero trust, but before organizations can even consider moving to automate access privileges, they must first address the organizational layers of zero trust. This comes in the form of the question of who should have access to what information in the first place, and why.
It’s a basic question, but too often do companies go all-in on automation before setting the stage organizationally. An organization needs to take serious time to audit and segment its various stakeholders and to review and break down all the categories of data and processes that should be recognized by a zero-trust architecture.
Storage – Zero Trust’s Last Line of Defense
In early May 2021, the Colonial Pipeline attack forced one of the largest fuel suppliers to shut down its distribution of gas and jet fuel to the Eastern United States. This event ended up causing panicked gas buying and shortages in twelve states which brought heightened attention to key infrastructure vulnerabilities in the country.
With no other option to get their pipeline running again, Colonial was forced to pay $4.4 Million to the Eastern European cyber hackers called DarkSide. However, it still took an entire week for the pipeline to restore distribution and get the supply chain back on track, and several more days for the country to get back to normal following the attack. It’s a harrowing tale that prompted companies to increase their reporting and auditing cadence following a cyberattack, or risk incurring financial penalties. But this is not enough.
Because ransomware attacks are on the rise, this begs the question of whether organizations are adequately prepared to recover quickly and with minimal impact on themselves, their partners, and customers. If they are not, what should they do to be more proactive with their readiness?
Ensuring you have a solid backup and recovery strategy can be the simple difference between paying huge ransoms to keep your business running or simply recovering your backup. The golden rule for backup is “3 2 1”. Three copies of the data, 2 different types of media/systems, and 1 copy at a remote site. Backup provider Veeam has turned this rule up to “11,” adding guidance that also includes 1 copy should be immutable and there should be 0 issues with data integrity.
However, even though companies do backups and deploy services to better secure their data, most still struggle to get back up and running when a ransomware attack hits. Enter object-level immutability.
According to Merriam Webster, immutable refers to something that is not capable of or susceptible to change. Immutability in cloud storage follows the same principle. It enables users to designate certain files as objects that cannot be tampered with by anyone, even a systems administrator, for a specific period of time. If desired, one can also configure the storage bucket to automatically delete the data after the retention period has expired.
Immutability is a key tool in a zero-trust architecture because it prevents anyone from tampering with or stealing data regardless of intention, whether malicious actor or true human error. Leveraging data immutability (wherein a user can designate certain files or “objects” to be immutable) is also more likely to provide fast response and recovery should an attack occur. While immutability is nothing new, it is a valuable feature that most organizations still don’t take advantage of. By preventing data from being tampered with, modified or deleted by anyone, even a systems administrator, over a set period of time, organizations benefit from a faster recovery time from ransomware or other catastrophic events. Immutability adds another layer of protection that organizations can no longer ignore.
In short: zero-trust architecture is an excellent way to maximize the security of existing workloads and to ensure backups are also kept confidential and safe. But for the ultimate purpose of business continuity, a zero-trust architecture needs data storage that’s air-gapped from a business’s day-to-day activities and immutable. Only with this final defensive line can you guarantee operational continuity and security, zero-trust or not.
- Hybrid Cloud Backup Technology: Key to Data Loss Prevention? - October 6, 2022
- Cloud Backup Strategy for Fighting Ransomware with Immutable Storage - June 16, 2022
- Zero Trust and Enterprise Data Storage Strategy: An Introduction - April 25, 2022
David Friend
David Friend is the co-founder and CEO of Wasabi, a revolutionary cloud storage company. David’s first company, ARP Instruments developed synthesizers used by Stevie Wonder, David Bowie, Led Zeppelin and even helped Steven Spielberg communicate with aliens providing that legendary five-note communication in Close Encounters of the ThirdKind.
- Hybrid Cloud Backup Technology: Key to Data Loss Prevention? - October 6, 2022
- Cloud Backup Strategy for Fighting Ransomware with Immutable Storage - June 16, 2022
