# How Cloud is Driving Forward Implementation of Zero Trust Security
Author:  Pal Sinha, Barnali 
Author URL: https://financedigest.com/author/pal-sinha-barnali
Published: 2022-12-02
Category: TECHNOLOGY
Category URL: https://financedigest.com/category/technology
Meta Title: How Zero Trust Security Can Mitigate Cyber Threats for UK
Meta Description: Discover alarming statistics on cyber security threats facing UK businesses, including phishing and ransomware attacks. Learn how to safeguard your financial
URL: https://financedigest.com/how-cloud-is-driving-forward-implementation-of-zero-trust-securityhtml

![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/the-new-cyber-agency-helping-tech-startups-stay-secure-1736814783099-compressed.jpg)

![](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/manuel-sanchez-1736814783034-compressed.jpg)

_By_ **_Manuel Sanchez,_** _Information Security & Compliance Specialist, iManage_

The UK government’s [Cyber Security Breaches Survey 2022](about:blank) is overflowing with statistics that paint a concerning picture of just how challenging the threat landscape is for today’s companies, including those in the financial sector.

For starters, phishing is widespread: Of the 39% of UK businesses who identified a cyber security attack, the most common threat vector was phishing attempts (83%). Meanwhile, around one in five [businesses experienced a more sophisticated attack type](https://www.financedigest.com/types-of-business-partnership.html "Types of business partnership") such as a denial of service, malware, or ransomware attack.

The National [Cyber Security](https://www.financedigest.com/how-to-handle-cyber-security-during-mergers-and-acquisitions.html "How to Handle Cyber Security during Mergers and Acquisitions") Centre and the Information Commissioner’s Office also observe that there is a rise in ransomware payments being made.

The reason that the [financial services space remains a popular target for cyber criminals is because of the sensitive nature of the data they hold](https://www.financedigest.com/new-york-holds-top-spot-london-second-in-z-yen-financial-centre-survey.html "New York holds top spot, London second in Z/Yen financial centre survey"). According to the survey, the [sector that is most likely to hold personal data about customers is finance and insurance](https://www.financedigest.com/whats-driving-consumer-opinion-in-the-insurance-sector.html "What’s driving consumer opinion in the Insurance Sector?") (with an 85% likelihood of holding personal data, vs. 61% of businesses overall).

Does this mean that [financial institutions](https://www.financedigest.com/a-cloud-migration-guide-for-financial-institutions.html "A Cloud Migration Guide for Financial Institutions") should resign themselves to the inevitability of a data breach?

The answer, unfortunately, is yes. But there are [steps that businesses can take to significantly lower the risk and impact from potential data breaches](https://www.financedigest.com/10-steps-to-stop-lateral-movement-in-data-breaches.html "10 Steps to Stop Lateral Movement in Data Breaches"). One of these steps is taking a Zero Trust security approach as [part of their digital](https://www.financedigest.com/what-is-id-and-verification-and-why-is-it-such-an-integral-part-of-digital-life.html "What Is ID and Verification and Why is it Such an Integral Part of Digital Life?") transformation strategy.

**The move to cloud**

As it did with so many other aspects of life, [COVID upended normal work](https://www.financedigest.com/beijing-nervously-returns-to-work-as-china-doubles-down-on-zero-covid-policy.html "Beijing nervously returns to work as China doubles down on ‘zero-COVID’ policy") patterns. Suddenly, people were working from home as often as they were from the office, and this instigated the move to cloud systems – for document management, project management, billing, and other workflows – so that data and the controls to [secure](https://www.financedigest.com/the-challenge-of-keeping-data-secure-why-in-house-security-isnt-enough.html "The challenge of keeping data secure: why in-house security isn’t enough") that data could be accessible at any time, from any location.

This continued migration to cloud from on-premise systems has picked up so much momentum that Gartner reports that more than [85%](about:blank) of organisations are expected to embrace a cloud-first principle by 2025 – and any application that isn’t cloud will be viewed as a legacy application.

This shift towards cloud has also had a significant impact on the traditional security model, where the approach was to “secure the perimeter” and protect the corporate [network](https://www.financedigest.com/new-demands-on-network-security.html "NEW DEMANDS ON NETWORK SECURITY") against anything coming from the outside in. For the few [workers who were working](https://www.financedigest.com/1-in-5-uk-workers-believe-there-is-a-gender-divide-with-work-uniforms.html " 1 in 5 UK workers believe there is a gender divide with work uniforms") from home, the primary means of accessing corporate assets was via a VPN (virtual private network) that would let them connect to the corporate network.

One of the flaws of this approach is to automatically trust all [users and devices](https://www.financedigest.com/signalling-device-market-competitive-growth-strategies-based-on-type-applications-end-user-and-region.html "Signalling Device Market Competitive Growth Strategies Based on Type, Applications, End User and Region") once they are inside the perimeter. Not only does this put the [business at risk from malicious internal actors but also allows external bad actors to take advantage of compromised accounts](https://www.financedigest.com/making-your-accountant-an-invaluable-asset-to-your-business.html "MAKING YOUR ACCOUNTANT AN INVALUABLE ASSET TO YOUR BUSINESS") and wreak havoc once inside.

Relying on [technologies like VPN to protect the infrastructure within the four walls of an office is no longer an option for the current times](https://www.financedigest.com/why-its-time-to-centralise-public-sector-technology.html "Why it’s time to centralise public sector technology"). [Organisations should look to protect](https://www.financedigest.com/protect-your-organisation-from-fraud.html "Protect your organisation from fraud") applications, assets, users, and devices, wherever they are. And with cloud applications allowing [data to be accessible from anywhere, it is important to ensure employees can access sensitive files and data that they are allowed to access securely](https://www.financedigest.com/2023-fintech-prediction-secure-and-private-data-usage-is-key.html "2023 FinTech Prediction: Secure and Private Data Usage is Key"), without impacting their productivity.

**A comprehensive security model**

Taking a Zero Trust approach has never been more critical, as it [offers higher](https://www.financedigest.com/credit-suisse-offers-higher-deposit-rates-in-asia-to-woo-the-wealthy-sources.html "Credit Suisse offers higher deposit rates in Asia to woo the wealthy – sources") levels of security with reduced complexity and operational overhead.

The premise of Zero Trust is to verify “everything, every time”, whether inside or outside the [company network](https://www.financedigest.com/hackers-hit-italian-oil-company-enis-computer-networks.html "Hackers hit Italian oil company Eni’s computer networks"). Unlike older security models, which would verify user credentials just once at the point of entry, Zero Trust is based on the concept that no user is given implicit trust until their identity is verified – and every interaction is constantly verified throughout the user session to [reduce risk](https://www.financedigest.com/driving-returns-and-reducing-risk-with-data.html "Driving returns and reducing risk with data").

If we take the example of a cloud-based document management system (DMS) used exclusively by Finance and Legal staff to manage sensitive content, a Zero Trust approach would ensure that access to, or even visibility of the DMS application, is limited to only those [employees who are in the Finance](https://www.financedigest.com/4-reasons-your-finance-employees-are-showing-signs-of-stress.html "4 reasons your finance employees are showing signs of stress") and Legal teams and are authorised to view the data, with authorisations determined granularly – not just to file level, but also usage rights. For example, one user could be granted only viewing rights for a [defined period of time](https://www.financedigest.com/renewing-democracy-is-defining-challenge-of-our-time-biden-tells-summit.html "Renewing democracy is ‘defining challenge of our time,’ Biden tells summit"), whilst another may be able to also edit. By implementing this level of need-to-know security, the damage a threat actor could achieve via lateral movement once inside the network can be [significantly reduced](https://www.financedigest.com/white-bullets-collaboration-with-polands-sygnal-association-significantly-reduces-ad-funded-piracy-in-key-european-market.html "White Bullet’s collaboration with Poland’s Sygnał Association significantly reduces ad-funded piracy in key European market").

A Zero [Trust approach combines various technologies](https://www.financedigest.com/why-trust-and-technology-are-the-perfect-partnership-to-rebuild-the-financial-sector.html "Why trust and technology are the perfect partnership to rebuild the financial sector") such as multifactor authentication (MFA), endpoint security, identity and access management (IAM) and device certification. These [technologies can help to authenticate and validate users and devices across multiple cloud](https://www.financedigest.com/7-ways-cloud-technology-can-transform-business-finances.html "7 ways cloud technology can transform business finances") applications and internal systems.

This allows organisations to incorporate cloud applications into a standardised and robust security model, as well as taking advantage of all the benefits of migrating to the cloud, while increasing [protection across their data](https://www.financedigest.com/4-steps-you-should-be-taking-to-protect-data.html "4 Steps You Should Be Taking To Protect Data").

**Cloud requires Zero Trust**

Zero [Trust isn’t a “product” or a shiny new thing that will replace the existing security](https://www.financedigest.com/how-financial-services-can-secure-data-and-build-trust-in-todays-modern-environment.html "How financial services can secure data and build trust in today’s modern environment") stack. Zero Trust is a journey, and it requires careful, patient planning. As the migration to the cloud continues, it will become increasingly critical for [financial organisations](https://www.financedigest.com/can-financial-services-organisations-harness-data-and-bi-to-catch-up-in-the-digitalisation-race.html "Can financial services organisations harness data and BI to catch up in the digitalisation race?  ") to embark on their own Zero Trust journey sooner rather than later. If they don’t, they risk becoming just another statistic for [next year’s](https://www.financedigest.com/novartis-to-spin-off-generics-business-sandoz-next-year.html "Novartis to spin off generics business Sandoz next year") cybersecurity report.


---
This blog is powered by Superblog. Visit https://superblog.ai to know more.
---