A Zero Trust cybersecurity approach recognizes that everyday online activities can expose consumers and businesses to security threats. From browsing websites and opening emails to connecting to public Wi-Fi or charging devices in public places, seemingly routine actions can create opportunities for credential theft, malware, identity theft, and unauthorized access to sensitive data.
The challenge is that individuals cannot always recognize when an interaction poses a cybersecurity risk. Even technically knowledgeable users can make mistakes or temporarily lower their defenses. Applying Zero Trust principles means treating devices, networks, communications, and online interactions with appropriate skepticism rather than automatically assuming they are safe.
This article in Forbes provides a good review of all the daily tasks we perform that puts our cybersecurity at risk and argues that no set of tools can protect us as we transact our life.
Instead, we need to be cognizant of the risks and protect ourselves—implementing our own Zero Trust Model. The problem, of course, is most people don’t have the technical knowledge required to detect these risky moments and even those that do occasionally let their defenses down.
In short, the internet needs a trusted environment similar to that envisioned by Hyperledger and Sovrin Foundation:
“Zero Trust applies to systems, networks, devices, emails and people. When interacting with another person or computer, there is nothing wrong with taking a moment to assess the truthfulness of their intentions. As an industry, we have been pontificating this for many years in the email space. Phishing enabling the rise of ransomware amplified this message.
As stated above, when navigating the web, critique what is presented. You are wholly responsible for your personal cybersecurity and should be a good steward of technology at work.
Connecting to an open Wi-Fi network is rarely a good idea. Doing so on your personal device could allow criminals to steal your identity and implant malware. Neither of these outcomes are good. While they are not permanent, they are painful and can throw a proverbial wrench into your plans and aspirations.
Connecting to that same network with your work computer, especially without also connecting to a VPN, can spell significant disaster to your employer. Not only may they be subjected to credential theft or malware, but an intruder may also be able to gain access to customer data or company crown jewels. Charging banks for mobile devices in public places are another opportunity for criminals to steal troves of data. People are only seeking to charge their devices. They may authorize whatever trust is requested to complete the charging transaction. Without taking the stations apart, it is impossible to know what lies between the power source and the connector inserted into the phone or tablet.”
Personal vigilance is an important component of cybersecurity, but relying on individuals to identify every potential threat has significant limitations. Phishing, malicious networks, compromised devices, and other attacks can exploit moments when users do not recognize the danger or make an incorrect trust decision.
A broader Zero Trust cybersecurity model can help reduce this dependence on individual judgment by making verification a fundamental part of digital interactions. As more financial and personal activity moves online, developing trusted digital environments that continuously verify identities, devices, and interactions will be increasingly important for protecting consumers and organizations.
Overview by Tim Sloane, VP, Payments Innovation at Mercator Advisory Group
