Cyber Defense eMagazine November Edition for 2021

Keeping Your Guard Up: Protecting Against Inherent
Trust Risks
Important steps to identify inherent trust in the risk management process
By Zubaid Kazmi, a managing director in MorganFranklin Consulting’s cybersecurity practice
Trust is a huge problem in cybersecurity. Whether gaining access to a building or infiltrating a computer
network, anything can be breached with the right credentials. While implementing multiple identity zones
is a good measure in the zero-trust playbook, a bad actor that can get through a first checkpoint, can
certainly make it through the second. This is why implementing a second checkpoint that requires
biometric verification or requests information only the real employee would know is vital for security.
Meanwhile, most organizations still inherently trust the strength of their verification processes, and this
trust extends to what happens once an intruder is inside the organization.
The Risks of Inherent Trust
In a world where it is increasingly difficult to trust that an identity is true and not compromised, models
like “zero-trust” are catching interest and frequently being implemented. The best way to approach zerotrust
within an organization is by being intentional about trust. This goes beyond traditional
authentication and access governance use-cases. It extends to the supply chain of identities,
organizations, and services. It also goes beyond just third-party risk management and starts delving into
fourth-party risk management. Truly protecting an organization means thinking about zero-trust as an
assessment of where there is inherent trust across business processes, contractual agreements, systems
integrations, and (yes) identity and access controls.
Cyber Defense eMagazine – November 2021 Edition 105
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.