What are the responsibilities of IT managers regarding third-party attacks?

In this important interview with Wise TV, Lostar General Manager Murat Lostar drew attention to supply chain security, one of the most ignored sources of cyber threats by companies.

The IT aspect of the interior has changed a lot now. A very important part of them does not make this mistake, but they made an important mistake, which is this: “I should protect myself against the internet, there are bad people there, but I have an important supplier here, an important business partner here. They are people I know, know, trust. I do not need to make so much effort to ensure the security of my connection with them.” Therefore, if something happens to the supplier or business partner, it unfortunately becomes very easy to jump through it to our organization, jump over information technologies, and cause us harm through IT. We see this not only in information technologies but also in production technologies. Unfortunately, there have been many attacks that penetrate the holes opened to the outside to support the systems on the OT side and stop the production systems, resulting in a complete halt and disruption of production. As for the solution, the structure we call zero trust is actually a lifesaver for us here too. It doesn’t matter who he is; Whether it is from within the company, from outside the company, from our own institution or from any other institution in the supply chain, we must evaluate all requests that come to us, firstly, by seeing whether they are coming from the right place, from the right person, and secondly, whether this request is a correct, meaningful and useful request.

The Zero Trust Approach in IT Security

In the world of information technology (IT), security is becoming increasingly complex. Traditional security approaches are no longer sufficient to counter today’s threats. Consequently, the “zero trust” approach has emerged as a new paradigm in IT security. In this article, we will explore the importance of the zero trust approach and how it can be implemented.

The Inadequacy of Traditional Security Approaches

Traditional security models typically operate by distinguishing between internal and external threats. However, this approach can lead to the oversight of internal threats. Threats originating from sources deemed “trusted”—such as business partners and suppliers—can pose significant risks to an organization.

Balancing Internal and External Threats

Balancing internal and external threats is critical to IT security. Connections with business partners and suppliers are often assumed to be secure; however, threats arriving through these channels can compromise an organization’s security. Therefore, it is essential to ensure the security of every connection.

Core Principles of the Zero Trust Approach

The zero trust approach is founded on the principle that every request must be verified. Under this model, every request—whether it originates from an internal or external source—is checked to ensure it comes from a legitimate origin and an authorized user. Furthermore, the request is evaluated to determine whether it is meaningful and appropriate.

Security in Production Technologies

Production technologies represent another vital area of ​​IT security. Operational Technology (OT) systems can be vulnerable to threats that enter through points of external connectivity. Therefore, the security of production systems is just as critical as IT security, and a zero-trust approach should be applied here as well.

Implementing the Zero-Trust Approach

Implementing a zero-trust approach requires organizations to re-evaluate their security policies. Verifying every request ensures the effective use of firewalls and access control mechanisms. This enhances organizational security while simultaneously allowing business processes to continue without interruption.

Conclusion

In the realm of IT security, the zero-trust approach is vital within today’s complex threat landscape. In situations where traditional security approaches fall short, zero-trust strengthens security by verifying and evaluating every single request. By being applied to both IT and production technologies, this approach plays a key role in ensuring organizational security and business continuity.