- Much Depends On Risk Appetite, Regulatory Requirements, Experts Say
By Suparna Goswami (Gsuparna) • April 26, 2022
How does one decide the right approach to zero trust, and what are some important considerations to keep in mind? A panel of experts – group head of cybersecurity at a leading financial institution in Sydney Chirag Joshi; regional chief security officer, APJ, OKTA Brett Winterford; and director of cyber transformation, EY in Sydney Jay Hira – share their in-depth views.
“Different industry verticals have different regulatory expectations. For example, higher education universities by default have an approach of open trust and open collaboration and sharing. That is what they thrive on. Here, you cannot go full throttle trying to restrict everything,” Joshi says. “In such organizations, you need to take a different approach addressing zero trust whereas, in financial institutions because you need to take a risk-based approach, there is almost a heightened expectation of prevention and anomalous detection of activities.”
“‘One size fits all’ will not work for all organizations because of different context, different environment and different business goals. It is important to assess the readiness to achieve zero trust. Who is talking about zero trust? Is it the board asking you questions around zero trust, or is it the security operations lead? These are two separate conversations,” Hira says.
Winterford talks about the various challenges faced by organizations taking an identity-centric approach. “Identity and governance are our biggest gaps as they are complex problems to solve. Pam is a massive challenge as well. Another challenge is helping people to break out of the mindset that assessing all these problems will increase friction in user experience,” he says.
In a discussion with Information Security Media Group, the panelists also talk about:
-What zero trust means to them;
-How the zero trust approach changes with industry regulatory requirements;
-The challenges involved in an identity-centric zero trust approach.
- Winterford is the Regional Chief Security Officer ofr Okta In The Asia-Pacific Region And Japan.
