What is Zero Trust Security?

Zero Trust is a security framework based on the belief that every user, device, and IP address accessing a resource is a threat until proven otherwise. Under the concept of “never trust, always verify,” it requires that security teams implement strict access controls and verify anything that tries to connect to an enterprise’s network.

Coined in 2009 by John Kindervag, then a principal analyst at Forrester Research, Zero Trust has since gained ground as an effective strategy to prevent data breaches and other cyber attacks in a world of increasing security challenges.

In this post, we’ll explore why Zero Trust is important to the security landscape, consider how today’s technologies can bring its principles to life, and look forward at how the Zero Trust model may evolve.

Why is Zero Trust important?

Zero Trust presents a proactive way of thinking about security for the information age. Previous security models viewed the network perimeter, often protected by firewalls and other on-prem solutions, as the ultimate line of defence. Users inside the enterprise network were considered trustworthy—and given free rein to access company data and resources—while those outside the perimeter were deemed untrustworthy.

This is otherwise known as the castle-and-moat approach, where it’s hard to gain access from outside the network, but everyone inside enjoys trusted access privileges. The problem: once an attacking force crosses the moat, they’re free to storm the castle—and a compromised knight also has access to all the sensitive information they need to bring the castle down.

The cost of a breach is astronomical

Malicious insiders and threat actors using compromised user accounts can easily take advantage of this system to perform far-reaching attacks on an organisation. A 2020 report from the Ponemon Institute and IBM found the average cost of a data breach to be $3.68 million—and that’s on top of personal and reputational damage. With billions of compromised credentials accessible to attackers online, the risk is too great to take trust for granted.

Changing workplace models require Zero Trust

Zero Trust acknowledges the severity of today’s threat landscape, including mobile security threats, but it also aligns with the nature of how we work. The rise of smart devices and cloud adoption has empowered many organisations to adopt distributed work models, where employees, contractors, and partners across the globe access resources from anywhere—using devices and networks outside of the company’s walls.

These are trends we expect to continue, particularly as organisations have been forced to adopt more flexible, dynamic work environments. While companies must allow their people to work seamlessly, the increasing presence of untrusted devices and connection points introduces more security risks. And when you also consider the rising sophistication of cyber attacks—and the fact that old tricks like phishing still work—it’s clear that only securing the network perimeter is unviable.

What are the principles of Zero Trust Security?

The ultimate goal of Zero Trust is to rethink security for a modern, cloud and mobile environment. To that end, the model recommends that companies adopt the following principles:

1. Identify sensitive data

Whether your organisation stores personally identifiable data, financial information, or confidential intellectual property, data has immense value to attackers. Since data security is the heart of Zero Trust, it makes sense to prioritise those initiatives: get to know where your sensitive data lives and who can access it, and log any access attempts.

2. Strictly enforce access control

Under a Zero Trust framework, companies should use the following tools and techniques to stop untrusted access attempts:

• Least-privilege access control only provides users and their devices with access to the resources they need to do their jobs. Your attack surface will shrink by minimising each user’s exposure to information and applications across the network. For example, in the event of a breach due via account takeover, only the resources assigned to that user account will be compromised. This approach to access control prevents threat actors from deepening their attacks on your system and obtaining more sensitive data.
• Contextual multi-factor authentication (MFA) is an effective way to confirm the identities of your users and increase your network security. MFA allows you to strengthen your authentication procedures by implementing factors that provide greater security than passwords, from push notifications and hard tokens to biometric identifiers. Every authentication method offers different degrees of protection and deployability, so it’s best to research authentication factors to determine how suitable each is for your workforce. Using contextual analysis, a modern MFA solution can identify when the risk of the login attempt warrants an additional factor—or two—be deployed. 
• Zero trust network access (ZTNA) isolates and protects the network. Operating on an adaptive trust model, ZTNA isolates the act of providing application access from network access, only providing access to authorised users. It also segments native apps so that users only have access to specific applications, makes outbound-only connections to keep infrastructure unavailable to unauthorised users, and a user-to-application approach that de-emphasizes the network and makes the internet the new corporate network.

We’ve spoken explicitly about using these methods to protect your data and network, but it’s also important to look after your workloads. By that, we mean the stack of apps and back-end software that power customer interactions with your organisation. Customer-facing organisations in particular should treat their stacks as a threat vector and apply the Zero Trust protections above to keep them secure.

3. Scrutinize every endpoint

The Zero Trust model assumes that every user, device, and connection point is a potential threat—including those inside the enterprise network. As such, every request to access the system must be authenticated, authorised, and encrypted.

The perimeter has shifted. Zero Trust security emphasises that the perimeter now lies with individual users, as they introduce the most vulnerabilities to your network. Establish limits on how your users can access resources inside and outside the network, and monitor user behaviour to look for signs of threats from compromised accounts or malicious insiders.

Devices are significant risk factors for Zero Trust networks. Each device, if compromised, is a potential entry point for an attacker into your system. Your security team should be able to isolate, secure, and control access for every device that connects to your network. That said, these measures shouldn’t introduce friction for your workforce.

Contextual access management is the solution. It’s designed to help you set progressive and granular access policies that evaluate risk factors to make smart access decisions. By analysing criteria like the user’s job role, device, location, and request time, you can grant the appropriate access after learning more about each user and device.

4. Invest in real-time monitoring and analytics

To execute a Zero Trust network, your security and incident response teams need to make sense of everything that happens in your systems. Threat detection and user behaviour analytics will help you to proactively shut down attacks and attempts at data theft while making the difference between legitimate logins and compromised user accounts clear.

5. Automate as much as possible

Zero Trust requires thorough, round-the-clock threat detection and event monitoring—but it’s not realistic or efficient to rely on your workforce to keep pace. Automate as much of your monitoring and analytics functions as possible, as this will free up your security teams to focus on the tasks they’re most effective at, like incident response. You should also automate typically manual, error-prone processes such as provisioning and deprovisioning to protect the organisation from rogue accounts and accidentally granting access to the wrong resources.
 

What’s next for Zero Trust?

As threats evolve, so must Zero Trust. Going forward, continuous authentication will be key to the evolving Zero Trust Access Management space. As users, devices, and applications access resources, risk can change. It’s important that companies can take action throughout the user's session should risk increase. To do this, passive, continuous evaluation of signals will be critical—as will the ability to take action on those threats at any point, such as re-prompting for MFA mid-session.

Ultimately, Zero Trust is about achieving both higher levels of security while also enabling a secure, productive workforce wherever they need to do work. And who wouldn't want that?

Want to get started with Zero Trust? Read our whitepaper to learn how.