‘Don’t trust anyone’: Tech giants’ tactics of suspecting all employees

Hackers are a problem that plagues many large companies in the world, especially technology firms. Over time, they’ve determined that the biggest security weakness is people. Therefore, a series of technology giants today have adopted the “don’t trust anyone” tactic.

“Zero-trust architecture” is a model that assumes that no matter how strongly secured any system is, it can still be compromised by hackers. In particular, the weakest link in this system is human. With this tactic, companies need to make sure that even people on the internal network can’t cause serious damage.

Last week, Uber and Rockstar Games revealed major hacks that disrupted their operations. Before that, some big technology companies such as Microsoft, Nvidia and Okta were also attacked by hackers.

What these hacks have in common is that the perpetrators tricked internal employees into enabling network access authentication or handing over other important information. This type of attack is called social engineering. In the case of Uber, for example, its employees were tricked into giving access to hackers.

The attacker used a tricked contractor account to gain access to internal systems, post messages on company-wide Slack, and hijack an account used to communicate with the company. security researchers. Uber then had to suspend access to its intercom.

Cybersecurity experts and the FBI say that as large companies develop technology to protect their systems, “social engineering” is becoming more and more popular because it hits on the human element. According to the Wall Street Journal, after all, upgrading computers is still easier than upgrading human minds.

In an era where a company has many employees and contractors connected to its systems via computers, phones and cloud services, security becomes even more difficult. Everything will turn into disaster because hackers only have to penetrate a single port to access the entire “kingdom”, a security expert commented.

The “Zero-trust architecture” is seen as a simple way to limit that disaster. “It’s based on the idea that you don’t trust anything and anyone in your system anymore,” said Anshu Sharma, CEO of Skyflow, which uses a “don’t trust anyone” tactic to protect data. data for other businesses, said.

One of the safeguards of the “Zero-trust architecture” is that if a person logs in late to the corporate system, they are only granted certain permissions. The idea is that even if a hacker gets into the person’s account, they will have limited functionality and time to attack.

Another measure is “behavior analysis”. Security engineers will use software that monitors the behavior of people online and flags an alert when anyone does something unusual, like trying to withdraw a very large sum of money from the bank.

At the heart of the “Zero-trust architecture” is that every component of the system is questionable, even if the employee has been identified, has access, and is properly performing his or her duties.

However, this can cause unnecessary conflicts between employees and the system. Security is always a balance between giving people the access they need and requiring proof of identity.

By design, a concept was created called the “principle of least privilege”. Accordingly, people only have access to what they need when they need it. It is considered against the priority of many businesses, which focus more on maximizing operational efficiency than ensuring the security of the system.

While many new businesses are aware of and adopting the “Zero-trust architecture”, the security industry has adopted this tactic for over a decade, especially large companies.

One of them is Google. In 2009, when the Gmail server in China was hacked, the company implemented its own version of “Zero-trust architecture”. Accordingly, this version applies to every component of an information technology system, from users, devices, applications, services, to ownership, physical location or network. All are suspect.

According to a Google representative, this change has made it easier for employees to work from anywhere without a VPN. Later, Google turned the above version into a product for companies that pay for its cloud services.

Microsoft said an attack on their system in March only compromised one account and was quickly detected and handled in time, without leading to any customer data leaks. .

Vasu Jakkal, the company’s vice president of security, said that without a “Zero-trust architecture”, an attacker could move from accessing a system to infiltrating sensitive parts. feeling in just over 1 hour.

According to Justin Boitano, VP of enterprise computing at Nvidia, the ” zero-trust architecture” is not without its downsides. Striking a balance between security and accessibility means that security teams and employees have to communicate constantly with each other when it is not easy to do .

He added: “ The new world is like that. You have to think that there will always be bad guys around. The question is how to protect your resources and the company’s intellectual property .”

Source: WSJ, BI