A scramble began to build or upgrade the infrastructure needed to move their employees into a remote environment: they quickly spun up a VPN, or in some cases, they just open applications up to the Internet. Their world has suddenly changed overnight. I've repeatedly heard this story from many Security and IT leaders. Overnight your workforce moved out of the office, off your network to their homes. It's hard to get investment in the digital transformation when things are static and mostly the same. Then, before you could start decoupling them, they were still heavily integrated with an old legacy IAM system, which was also sitting in your data center.
Adding external access outside of your corporate VPN introduced its own set of problems and risks. Your perimeter was pretty hard it was the walls of your buildings that wrapped around your employees. The corporate applications that kept your Business running mostly still lived in your data center, within your building, and accessed from the local network. Maybe they did some work here and there outside of the building, a flex-day to work around an appointment or a school sports day. Then, on Monday morning, you returned to your headquarters and were confronted with your reality. Why should you trust a device just because it's inside your perimeter? Why do you even need a perimeter?! Do I even know what my perimeter is?! And then you visited the vendor floor at a major security conference, and you found a lot of companies willing to sell you that zero trust dream. Then you started to read about Google's BeyondCorp implementation. The security industry had an answer for that you started to hear about more and more companies pushing towards a Zero Trust security model. Building a castle wall around your data won't stop a persistent threat. Once there is that single crack, an attacker can rampage around your network's soft center. I know you think your hardened perimeter protects you, but eventually, someone will find their way past it. They give you a "false sense of security," they cried. You can't rely on your old corporate controls anymore - firewalls, NIDS, and WAFs don't keep attackers out "they are a Band-aid," they said.
The death of the corporate network had long been predicted.
0 kommentar(er)
