Distrust all network traffic until proven safe—no matter where it comes from. This is the key tenet of Forrester’s Zero Trust model, which also outlines three best practices to protect distributed IT networks: access all resources securely, enforce strict access controls, and inspect and log all network traffic in real time.
As technology advances, so do security threats. Due to the recent growth of cloud services and mobility, Forrester proposed the Zero Trust eXtended Ecosystem (ZTX). ZTX suggests that people, networks, and devices should never be trusted by default, and encourages organisations to implement holistic security measures that monitor and analyse traffic as if every access request were a potential threat.
Do You Need to Implement Zero Trust Protocols?
Gone are the days when every IT resource could be protected behind a firewall and under the direct control of the IT department. Conventional security solutions are no longer enough to totally secure organisations in a cloud-first, mobile-first world, where employees increasingly demand remote working arrangements, access files on their devices while they're on the go, and expect instant access to the tools and information they need. To protect their digital assets, organisations should consider everything in their environment as untrustworthy—and any device as a new opportunity for hackers to gain system access. It’s important that organisations remember that people, not firewalls, are the security perimeter. If one individual fails to protect sensitive corporate information, it could put the entire company at risk.
After all, not even technology’s biggest players are safe from data breaches. After falling victim to a cyber attack, Google devised its own practical application of Zero Trust— BeyondCorp. BeyondCorp has three key principles: connecting from a particular network should not determine the services you can access; access should be granted based on what’s known about the user and the device; and finally, all access to services must be authenticated, authorised, and encrypted. Companies should be wise to the world of remote working and mobility by providing contextual access management that grants access from anywhere—provided that users meet the stringent security requirements.
There is, however, a delicate balance to strike. Organisations still need to take advantage of the opportunities and benefits that cloud and mobile have to offer, and implementing Zero Trust solutions should not come at the expense of usability and productivity. It’s one thing to understand Zero Trust in theory, but it’s even more important to implement it in a way that ensures organisations can still optimise the user experience. This means putting tools and solutions in place that create a more streamlined login experience.
Building a Zero Trust Network With Okta
As organisations build their own Zero Trust networks, Okta can help them strike this balance. Allowing users to securely access resources regardless of their location means always verifying their identity. Okta offers several solutions that can help organisations effectively manage identity and access, providing an essential foundation for their Zero Trust architecture.
With over 6,000 out-of-the-box integrations, the Okta Integration Network facilitates deep connections between all components of your Zero Trust ecosystem. Here’s a snapshot of its comprehensive, vendor-neutral coverage:
- Cloud security gateways (Skyhigh)
- Data security (Netskope)
- Network security (Palo Alto Network, Cisco)
- Device security (VMware, Carbon Black)
- Workload security (CyberArk, Cloudflare)
Okta’s Adaptive Multi-Factor Authentication (Adaptive MFA) solution is another example. By taking the context of the user’s device, location, and network into account, the Okta Policy Framework rates the risk of each login attempt against a predefined set of policy and configuration settings. Based on the calculated risk rating, the solution then either grants access, denies access, or prompts for a second authentication factor. This contextual awareness improves authentication security, and administrators can also choose to implement passwordless login experiences by setting up a variety of other factors to authenticate users.
As ZTX illustrates, Zero Trust identity verifications need to factor in devices, networks, and people. The Okta Policy API allows administrators to fine-tune whether users need MFA to log in, what factors are employed, and password complexity requirements. This gives organisations the ability to verify user or resource identities with great granularity, ensuring that their IT environments stay secure.
Building a Zero Trust network requires visibility and automation. Okta’s Lifecycle Management automates the provisioning and deprovisioning of user accounts, reducing an organisation’s potential attack surface when employees leave the company. Meanwhile, Okta’s Centralised Reporting provides visibility with a service that enables the sophisticated search of real-time system logs, geolocation tracking, pre-built application access reports, and integration with SIEMs.
Ultimately, the benefits are plenty for those that seek out the right tools to implement Zero Trust. Taken together, Okta’s solutions can empower organisations to build a Zero Trust network that equally protects and performs.