Is your organisation implementing zero-trust correctly? While thousands of enterprises flocked to implement a zero-trust framework during the Covid-19 pandemic, many have struggled to effectively deploy it within their environments.  

Research released earlier this year found that while 100% of organisations believe zero-trust architecture is important in reducing cyber risk, only 21% have so far adopted zero-trust as a security model.  

There are many reasons why organisations are struggling to deploy zero-trust, but one of the most significant is the fact that organisations are attempting to manage user access to infrastructure rather than to the underlying data itself.  

Data-centric security is an essential component for implementing effective user access controls and ensuring that confidential or regulated information stays out of the hands of unauthorised users.  

What is data-centric security? Data-centric security and zero-trust  

The term, data-centric security is a security approach where an enterprise secures access to critical data assets at data-level, rather than ringfencing and protecting at infrastructure or server level.  

Under a data-centric security framework, an organisation catalogues data throughout on-premises and cloud environments; deploys access controls to determine who has access to what information; and monitors that access to ensure no malicious changes are made.  

This approach enables security teams to quickly identify if an unauthorised individual starts accessing important files so they can take action to control the incident.  

According to the National Security Agency (NSA) data-centric security is essential to implementing zero-trust, as it enables an enterprise to protect critical data assets in real-time, and apply the principle of least privileged access to each access decision.  

In other words, if organisations want to implement zero-trust, they need to move beyond the traditional network security mindset of protecting key resources and servers and start identifying and protecting key data assets.  

Want to find out how our Managed Digital Risk Protection Service can protect your organisation’s attack surface? Click here to download our free ebook. 

How to implement data-centric security  

 At a foundational level, data-centric security is about collecting information on the relationship between users, data, and apps. This means understanding the level of data sensitivity across your network and the cloud as well as user access permissions, and access activity.  

This information helps you to employ the principle of least privilege and monitor how users interact with critical data assets so it is easier to identify malicious insiders and hackers who’ve bypassed your preventative controls.  

The Varonis platform provide a solution to implement these controls, enabling you to build a baseline behaviour profile for every user to detect real world attacks.  

It also offers post-event controls such as automated and roll-back environment-wide changes so you can revert changes to users/groups, folder permissions and AD group memberships.  

The challenge of data-centric security 

While implementing data-centric security is a necessity, many organisations struggle due to the complexity of identifying data within their environments.  

According to MongoDB, 80% to 90% of the data collected by modern companies is unstructured, meaning it's not only difficult to discover, but also to classify. Unfortunately, some of this data can be exposed in public-facing assets like APIs, which means threat actors can still get hold of it.  

The problem is that many organisations don’t have the expertise they need to discover this information and are unaware of the true volume of data that’s exposed to malicious entities.  

To address this challenge, Integrity360 has launched the Managed Varonis Data Security Service, which helps users to integrate data sources and directories, and discover and classify sensitive data on-premises and in the cloud, so that it can be monitored and secured.  

This approach enables organisations that don’t have the in-house expertise to discover and classify unstructured data to implement a data-centric security solution with the support of a 24x7 SOC and infrastructure support team. 

Integrity360’s team can help configure effective data protection policies, while providing continuous security incident investigation, analysis, and management to ensure you have the ability to detect and respond to data breaches in the shortest time possible. 

Guarantee your data security  

Zero-trust has the potential to redefine enterprise security and make it much more difficult for attackers to gain access to high value information.  

However, data-centric security and implementing access controls at the data level is critical to ensure you can reduce the likelihood of unauthorised access to regulated data.  

If you don’t have the internal capability needed to deploy these controls, Integrity360 can provide you with full managed service support so you can gain a complete inventory of your data and stop cyber criminals in their tracks.  

Want to find out how our Managed Varonis Data Security Service can help you identify, classify, and protect your mission-critical data?

Contact us today for more information and to request a free data risk assessment to help you to identify and address any potential data security risks within your business. You can also download our Varonis Service eBook HERE and Brochure HERE