Threat Tuesday: What Does "Zero-Trust" Mean For ITAD?

Think about walking into a large office building. As you enter, a security guard looks at your ID badge. Then you scan it at the entrance, and the barrier allows you to enter. You’re then free to proceed to your office, your boss’s office, or wherever else you might like to go in the building.

That’s how networks are traditionally designed. Perimeter firewalls, proxies, reverse proxies, and email gateways inspect the traffic entering your network, and prevent anyone who’s not supposed to be there from entering. But once you’re inside, there’s nothing to prevent you from going anywhere you want.

This “moat-and-castle” model has been a factor in several serious data breaches over the last few years. It may have taken hackers weeks or months to breach the exterior perimeter, but once they were inside, they were able to hop from server to server with impunity, exfiltrating gigabytes of data with ease.

The Zero-Trust Model

In response to these security threats, the “zero-trust” security model has gained popularity. In this system, internal traffic isn’t treated any differently than external traffic from a security standpoint. Any action you take on the network requires authentication.

Like in a high-security building, your badge isn’t just checked at the front door. You need to scan your badge at every door you pass through in the facility. And following the principle of least privilege, only the doors that you have a need to access will open for you.

Having these additional access checks and security protocols in place restricts an attacker from being able to move laterally within the network. A single breached account or service can no longer compromise an entire network’s worth of data. So, many security experts recommend that organizations adopt this model as they look to the future of their information security practices.

What Zero-Trust Means For IT Asset Management

The zero-trust model gives organizations greater flexibility in how they deploy their resources. It can facilitate a shift to cloud workloads for some assets. And it can allow workers to more easily and efficiently work from anywhere — home, the office, coworking spaces, or elsewhere.

So, your asset management processes need to keep up with these shifts in thinking. Zero-trust should extend to what happens to your workstations, servers, and other IT assets after they’re decommissioned. After all, if you don’t trust them while they’re on your network, why would you trust what happens to them after they’ve left?

Cloud data storage and remote work can still leave plenty of data behind on workstations and laptops. This data needs to be securely destroyed before these items are disposed of.

A secure ITAD provider like CyberCrunch can help you with that process. Our NAID AAA certified data destruction processes give you peace of mind that your data won’t turn up in a dumpster find or an eBay sale. And we can help you support arrangements like company-owned workstations for remote workers, with our secure mail-back recycling services.