Although there are a number of cybersecurity buzzwords currently circulating, Zero Trust will likely become a familiar term for many organizations in the very near future. A Zero Trust model essentially means every user starts with zero access rights to a system by default and will only be granted access to resources and information for a legitimate need. The Zero Trust approach encompasses the idea that nobody can be trusted automatically, and everything must be questioned. A large number of organizations have found this to be an effective method when it comes to reducing potential security threats and data breaches. This is particularly relevant in the current day and age, whereby many companies have transitioned to harvesting data in cloud-based environments.
One example of an organization implementing this approach is The Department for Business, Energy & Industrial Strategy (BEIS). BEIS is a unique and pivotal ministerial department responsible for building a stronger, greener future for the UK. The organization was formed to tackle climate change, unleash innovation, and invigorate the nation as a great place to work and do business in. It took on further responsibilities to help in the fight against Covid-19 and the UK’s ongoing economic recovery.
BEIS works with 41 agencies and public bodies ranging from the Met Office to the UK Space Agency, through to the UK Land Registry to deliver its ambitions and directly supplies digital services to eight of these organizations as well as the Department for International Trade, totaling over 10,000 users of needing secure access. With only a relatively small team of approximately 150 to support this growing number of users across a wide-ranging spectrum of both public-facing and confidential initiatives on a daily basis, BEIS needed to reassess its tools and technology to ensure its users and assets stay protected. The organization wanted to use its resources to deliver a great set of user-enabled services which would minimize the hassle and friction that is often felt by users. BEIS needed the right capability and technology which would allow users to work freely while also protecting people and data.
- These are the best cloud storage solutions on the market right now
Embracing the cloud
To keep up with user demand for ease-of-access while fighting increasingly sophisticated cyber threats, BEIS had to embrace a cloud-first strategy and move away from its previous on-premises, traditional virtual private network (VPN) and perimeter protection approach. To reduce its reliance on hardware and minimize the footprint within the organization’s physical building, the organization wanted to move to a consumption-based IT model to prepare for unpredictable changes going forward.
BEIS adopted Internet and private access to enable its team to support the 41 agencies it works with, while allowing the organization to scale up its digital users to 10,000 and more in the future. When looking for to a cloud-native strategy, BEIS wanted to provide direct-to-cloud protection of users and offices, allowing the organization to break free from costly infrastructure, with unlimited scaling capacity, and allowing users to have seamless access across all apps and devices. The wide-ranging responsibilities of BEIS also meant that its pool of digital users was scattered across locations, industries, and functions. As such, the intelligent platform it installed was able to provide insight on patterns of behavior and signatures across all sectors and regions. It provided a deep, rich level of insight that the organization felt it could not get from other vendors. Additionally, other applications which BEIS got through the platform could also host Amazon Web Services.
- Check out our take on the best cloud hosting services at the moment
Stopping threats thanks to data
By implementing a cloud-based Zero Trust solution, BEIS is able to identify trends that displayed specific teams that were targeted by bad actors. BEIS is now able to identify individuals that are being targeted through various phishing attacks and can warn specific teams about the potential threats. Not only is this level of information around unprecedented threat protection available, but the organization also has actionable insights which it can give to specific teams to take next steps on. This is important because in the past, BEIS found one of the dangers of amassing a huge amount of data from various different tools was the people being unable to make sense of it.
Eradicating reliance on physical appliances
When the global pandemic forced the UK into lockdown, like the rest of country, BEIS went from a predominantly office-based environment to having to work remotely overnight. Not only did employees need access to the organization’s network, but also thousands of users needed access to resources from other various locations. This was at the same time as BEIS prioritizing resources to help the nation’s fight against the pandemic. Because it was already operating on modern architecture through the new platform, the BEIS IT team had a huge advantage and barely needed to implement any infrastructure adaptations to enable the change.
When remote working requirements were implemented, all the team needed reminding of was to remember to take their laptops and chargers home. This eradicated any reliance on appliances inside the physical building which enabled the team to essentially just flip a switch to move remote. They did not face many of the issues that obstructed some of their peers in other organizations – both inside and outside of the government. For example, they were not restricted from the VPN capacity, the tunnels they had available, or licensing. This was a culmination of the team’s drive for simplification, and they are continuing to look at how they can make the services that they deliver as simple as possible.
BEIS has come a long way within recent years and continues to develop security through innovative technology and staff awareness campaigns that reinforce security behaviors. It maintains strong and tested cyber defenses while building a more coherent approach to security to mitigate threats and minimize the security vulnerabilities. BEIS is passionate about its people, and how it can give employees the chance to complete tasks that bring real value. Having technology in place to cut out bureaucracy and make access as seamless as possible, means the team can engage with the organization’s wider objectives around climate change, or pivot to responding to Covid, or build a better business environment for people to start a business.
As BEIS is a ministerial department dealing with climate change, there is an increasing focus on how the organization is reducing its own carbon footprint. It ensures partners are as green as they possibly can be across the board and will soon implement active monitoring on this. Focusing more on personal hardware and devices, BEIS will also look at how to consume even more services from the cloud by way of more energy-efficient lightweight, low-power model devices, and continue planning with that kind of cloud-first trajectory.
- These are the best cloud storage solutions for photos and images
Matt Norris, Regional Sales Manager, Large Enterprise, Zscaler