Traditionally, the IT industry has relied on perimeter security policies to protect its most valuable assets, such as user data and intellectual property. These security policies involve the use of firewalls and other network tools to inspect and authenticate users entering and leaving the network. However, digital transformation and the shift to hybrid cloud infrastructures are changing the way the industry does business. Relying on network boundaries is no longer enough.
Many organizations are also adapting their business models. They offer customers the new digital experiences they need and want, while supporting a global and diverse workforce. Recent events have only accelerated this digital transformation journey.
Suddenly, thousands of people in the organization were connecting via personal computers outside the IT department’s control. Users, data and resources are spread across the globe, making it difficult to connect quickly and securely. Without traditional on-premises protection infrastructure, employees’ home environments are more vulnerable, putting organizations at risk.
To further complicate matters, many organizations currently use a patchwork of poorly integrated security solutions and tools. This forces security teams to spend more time on manual tasks. They lack the context and insight needed to effectively reduce the extent of organizational vulnerability. The rise in data breaches and global regulations makes securing networks difficult. For example, the average cost of a data breach is nearly $4 million in lost business and fines. They lack the context and insight needed to effectively reduce the extent of organizational vulnerability. The rise in data breaches and global regulations makes securing networks difficult. For example, the average cost of a data breach is nearly $4 million in lost business and fines.
Applications, users and devices need fast, secure access to data, which is why the industry’s security tools and architectures are designed to protect them.
Zero Trust meets the security needs of this data-driven hybrid cloud environment. It provides organizations with adaptive, continuous protection of users, data and assets, as well as the ability to manage threats proactively. In other words, this never-trust, always-verify approach is designed to give every user, every device and every connection a sense of security in every transaction. Applying a zero trust framework can also help defenders better understand their security operations. They can consistently enforce security policies and detect and respond to threats faster and more accurately. However, it also offers corollary benefits such as:
- Improved network performance thanks to reduced traffic on subnets
- Improved ability to troubleshoot network errors
- Simplified logging and monitoring process thanks to granularity
- Faster breach detection
How Zero Trust works
Developed by John Kindervag in 2010 while he was a principal analyst at Forrester Research, Zero Trust Architecture is a broad framework that promises to effectively protect an organization’s most valuable assets. It operates on the assumption that every connection and endpoint is considered a threat. The framework protects against these threats, whether external or internal. In short, a Zero Trust network:
- Logs and inspects all corporate network traffic
- Limits and controls network access
- Verifies and secures network resources
More broadly, a Zero Trust security model ensures that data and resources are inaccessible by default. Based on the principle of “never trust, always verify”, where appropriate, users can only access them in a limited way, known as least-privilege access. A Zero Trust security model authenticates and authorizes every connection, for example when a user connects to an application via an application programming interface (API) or when software connects to a data set. It ensures that the interaction meets the conditional requirements of the organization’s security policy. A Zero Trust security strategy also uses as many data source contexts as possible to authenticate and authorize every device, network flow and connection based on dynamic rules.
Zero Trust: implementation
To successfully implement a Zero Trust architecture, organizations must connect the information from each security domain. The organization’s security teams must agree on priorities and align access policies. They must secure all connections across the enterprise, from data to users and devices to applications, workloads and networks. This architecture requires a well-planned strategy and roadmap for implementing and integrating security tools to achieve specific business-focused outcomes. For a zero trust model to work, those adopting it must:
- Make an enterprise-wide commitment.
- Catalog all IT and data assets and assign access rights based on roles.
- Eliminate certain common vulnerabilities.
- Classify data to adopt a data-centric approach
- Segment networks to prevent lateral movement
- Isolate and protect workloads as they move between virtual machines and cloud servers.
From the outside, the process seems limited. But successfully implementing a zero trust model can help security teams gain context and insight into rapidly evolving vulnerability boundaries and improve the user experience.
Sign up so you don’t miss the next part of our article: Minimum requirements for Zero Trust and how to focus on context for an effective Zero Trust model.