The COVID-19 pandemic will have a lasting effect on our business and industry in general. It is no surprise that most corporate security profiles are being changed and updated on a regular basis. The resulting production and supply chain disruptions, remote working and labour shortages have resulted in operational challenges and business losses. Many organizations would have increased their dependencies on third parties as part of their crisis management plans without assessing the risks related to changes in third-party relationships. The evolution of software defined everything has increased cyber-related risks in terms of APTs, targeted attacks, insider threats in a multi-fold fashion. The current COVID scenario suggests the time has come to completely rethink how we define trust in considering how to secure critical data and resources while still relying on third parties. Zero Trust is the only way to protect organizations from such emerging & sophisticated threats. With the rise of COVID-19, the need for a holistic policy framework that can effectively manage security issues across a highly distributed workforce has grown exponentially. Zero Trust rejects the outdated idea that everything inside the internal network is safe, while everything outside it is unsafe. It assumes instead that nothing is inherently safe. The Zero Trust concept goes beyond “trust, but verify” to command that we “never trust, always verify.” CISOs are in the Business of Trust but Risk is their regular companion. They are fundamentally in the job of balancing risk-acceptance and risk-mitigation decisions, so that greater trust can be created. Zero trust establishes the framework for minimizing risk from third parties by examining security gaps that occur during these interactions. It unifies and consolidates security policies in-house, minimizing vulnerabilities created by insufficient security practices of outside vendors. Continuous verification - the foundation of zero trust - ensures that the compromised vendor gets notified immediately, in near real-time.   ‘Assume breach’ is the Zero Trust mindset, we must go beyond the enterprise to consider our partners, contractors and suppliers. Zero Trust hinges on the idea that, all vendors are essentially “guilty until proven innocent” in the realm of cybersecurity. So, all these vendors should be extensively assessed and ‘graded’ before they are onboarded to an organization’s ecosystem. Running a one-time security audit isn’t enough for a true Zero Trust security approach. Organizations leveraging a Zero Trust approach to CyberSec usually have to do more heavy lifting on the back-end before approving vendors than traditional companies. Zero Trust is the idea that you are essentially creating a secure perimeter around every single person that has access to your organization, both internally and externally. In order to successfully implement a security strategy at this scale, your team must be meticulously organized and prepared. This means having immediate access to all security assessments, vendor profiles, questionnaires, and other security reports in a secure location.

The goal of Zero Trust security is to protect the company from advanced cybersecurity threats and data breaches, while helping the company achieve compliance with Regulations, Standards, and any future data privacy and security laws. For businesses to sustain, security and risk management leaders must establish and continuously assess trust using Gartner’s CARTA approach - Continuous Adaptive Risk and Trust Assessment. Wipro provides a holistic approach for zero-trust security, leveraging a framework and a working model for continuous risk assessment of third parties. NIST SP 800-207 for Zero Trust Architectures, NIST SP 800-161 Supply Chain Risk Management Practices and NIST CSF recommends organizations “should evaluate service providers on a holistic basis by taking into consideration factors such as vendor security controls, enterprise switching costs, and supply chain risk management.” Supply chain risk management programs require alignment of people, processes, policy and technology to organizational requirements and respective standards for implementation. In order to enforce Zero Trust principles, empower your teams with the visibility of everything going on in your vendor ecosystem– and the analytics to make sense of it all. Leveraging Zero Trust to enable Third party Trust:

1. Thoughtfully designed controls and responses based on the notion that the enterprise is constantly under attack.
2. Continuously evolving and improving security across people, devices, networks, data and cloud within as well as outside the organization.
3. Without assuming each control is self-sufficient, building strong multi-dimensional and comprehensive controls

Knowing how data is shared — and where potential gaps in security occur — will allow your team to build comprehensive assessments and strategies to ensure these Zero Trust perimeters are built around vendor businesses. To achieve zero trust security, in such heterogeneous environments, requires enterprises to prioritize elements and security controls

Zero Trust in a way that allows for the dynamic, continuing assessment of risk and that enables the business by continually applying visibility, insight and action to protect your most valuable assets. Zero Trust also means that we assume we are constantly under attack or compromised, and build controls that leverage a Threat-centric security architecture.

Adopt an integrated & continuous risk monitoring approach that can uncover hidden patterns, anomalies, threat vectors, and blind spots in order to proactively monitor and manage third-party risk while considering the changing enterprise risk landscape.

With deep roots in technology, as well as domain expertise in risk and compliance, we are uniquely positioned to help you proactively manage third-party risk.