I recently heard a segment on WBUR (a public radio station in Boston) on the emergence of microgrids. I was amazed at how much the microgrids concept closely aligned with that of microperimeters within our Zero Trust model of information security.
Zero Trust is a conceptual and architectural model for how security teams should redesign networks into secure microperimeters, increase data security through obfuscation techniques, limit the risks associated with excessive user privileges, and dramatically improve security detection and response through analytics and automation.
Zero Trust demands that security professionals move away from legacy, perimeter-centric models of information security -- which are useless for today's digital businesses no longer bounded by the four walls of their corporation -- to a model that is both data and identity centric and extends security across the entire business ecosystem.
Why Microgrids Are Emerging
Microgrids are emerging because there is a realization that smaller, distributed grids would make energy delivery across the U.S . more resilient amid everything from cyberattacks to nuclear attacks to mega storms, and better able to connect to local renewable resources. Smaller microgrids can quickly connect and disconnect to the larger grid and generate and deliver electricity locally. Unlike today's massive, centralized grid, an attack or disruption of one microgrid wouldn't affect the entire system.
During the Great Northeast Blackout of 2003, people in eight states across the Northeast and Midwest lost electricity because a power surge overloaded the grid responsible for distributing electricity to the eastern US. And during Hurricane Sandy, Con Ed (a utility in New York) had to cut the power to all of lower Manhattan to prevent flooded high voltage substations from exploding.
Climate scientists expect mega storms like Hurricane Sandy to become much more frequent and both government and private sector leaders are very worried about how escalating geopolitical tensions are likely to lead to cyberattacks on the power grid and other critical infrastructure.
Zero Trust Microperimeters
Zero Trust microperimeters are like microgrids. If a digital business segments their critical systems and data into a series of microperimters, rather than simply design one monolithic network akin to a castle wall, then a breach of the network doesn't give cybercriminals or malicious insiders free reign across the entire environment. Instead, the criminals -- and the operational and reputational costs of the breach -- are essentially quarantined within the microperimeter.
This allows the rest of the organization to continue to deliver on its brand promise as well as its fiduciary and social responsibilities -- be it providing the best possible experience to its consumers, making clients successful, serving its citizens, or making patients healthy and happy.
So if your organization is a hospital, a breach of the POS system in the cafeteria or gift shop doesn't allow attackers to gain access to clinical systems. If you're a retailer, a malware infection in one corporate system doesn't allow attackers to infect every one of your brick and mortar locations within 2 weeks. If you're a critical infrastructure provider a microgrid and a microperimeter are not similar, they are the same.
Why Zero Trust?
We called our model Zero Trust because we wanted to warn security professionals about the dangers of the numerous trust assumptions they had made in the design of their networks and their overall approach to security -- whether that's trusting that internal network traffic is legitimate by default, trusting employees to always have the best intentions or to never make bad decisions, trusting partners to treat access to our systems and our data like it was their our own etc.
By never assuming trust, we actually make the reliability, dependability, security of our organization more trustworthy for the customers that choose to engage with us, the citizens and patients that rely on us, and the partners that do business with us and these trusted relationships will fuel the success of our organizations.
Stephanie Balaouras is VP and research director at Forrester Research, where she serves security and risk professionals. Read more Forrester blogs here.
