The shift to flexible work has brought many benefits, from more time for family and self-care to more options for where and how we work. But with the good comes a dark side: remote and hybrid work have also increased cybersecurity threats.
In fact, research from HP and KuppingerCole found that cyberattacks more than doubled during the pandemic, thanks in part to more work devices being used at home and personal devices being used for work.
It’s no wonder, then, that security has become a top priority for companies large and small. And while small and midsize businesses (SMBs) are under the same cybersecurity and supply chain attack threats as larger enterprises, they often lack the skills and resources to implement every available security safeguard.
Big enterprises typically have the luxury of staffing their IT departments with security experts. Not so at a smaller company. Instead, a company with under 100 employees may have only 1 or 2 IT people, and they have to do 10 different things, not just security let alone keep up with the ever evolving landscape.
But the picture is brighter than you might think. SMB leaders may just be looking in the wrong places for solutions, not even aware that powerful security options exist just for them. In fact, with modern tools, technology can provide the air cover that a chief information security officer would require at a large company. These tools start with zero-trust security.
Why You Need Zero-Trust Security
To explain zero trust and what it means, I like to use an analogy based on the perimeter-based defense that has long been standard for IT products.
Traditional cybersecurity practices focus on a “castle and moat” model, where security protocols concentrate on keeping threats out of a centralized environment. Most importantly, the castle-and-moat approach assumes that any user with the right credentials to access a network has done so legitimately and can be trusted to move freely through the system.
As the trend toward the cloud accelerates, the concept of a security perimeter as we know it is becoming obsolete. Zero trust makes a different assumption: that networks are either actively under attack or already breached. In this case, zero trust sees networks as cities where communication with external applications and networks is constant, and users need to move freely without sacrificing usability or security.
Zero-trust architecture can be thought of as a type of internal law enforcement agency, representing many different validation points, barriers around sensitive content, and strict controls even on verified users. An individual user may be a citizen in good standing in her virtual city with valid credentials. However, according to zero trust, that still doesn’t give her free reign around the city or allow her to access any information she wants without showing an ID or proof she belongs there.
How Zero-Trust Security Works
With zero trust, the system must validate requests before granting access to any information. This powerful idea has by now taken hold throughout the IT world.
Here’s an example of how it works. Suppose a server sends a software update to an insurance company CEO’s laptop. The update may be legitimate, but with zero trust, the CEO’s laptop will not execute the update until the company’s IT administrator digitally signs it. That means the administrator must enter a password or otherwise prove their identity to ensure updates receive authorization from a human, not just the CEO’s machine. In this way, every significant action the computer takes encounters checks and balances.
This example does introduce a bit of friction. But it also enhances security by a couple orders of magnitude, making it well worth it — especially since such updates may occur only once a month.
The best tools have zero trust built in, taking care of all the real complexity behind the scenes, meaning managers don’t have to build zero-trust architecture, create virtual private networks, or take any other such time-consuming actions.
Zero Trust for SMBs
Security and reliability should be a top — if not the top — deciding factor when evaluating software tools. This is especially critical for SMBs working with limited IT resources.
Take remote access and IT support tools. Without zero trust, bad actors could use such tools to push malware into customer devices operating under the assumption that anything inside is to be trusted. That can’t happen with zero trust-based support software, and that’s why zero trust is a core part of our new remote support tool, GoTo Resolve.
New tools like GoTo Resolve make it easier for small business owners and IT staff to stay secure while doing what they do best: serving customers. And the future is bright. We are still in the early innings of fulfilling the vision of delivering a consumer-grade user experience with enterprise-grade security and scalability.
You can get started using GoTo Resolve for free, find out more.