Five worthy reads is a regular column on five noteworthy items we’ve discovered while researching trending and timeless topics. This week, we explore why organizations should implement Zero Trust in 2021.
In 2010, John Kindervag introduced the concept of “Zero Trust” which has become a touchstone for cyber resilience and persistent security. Zero Trust is not a security product, architecture, or technology. It’s a strategy or set of principles defining how to approach security; it sets the assumptions behind what we do. The core principle of Zero Trust is “Never trust, always verify!” No matter the device, user, system or location whether inside or outside, the organization’s security perimeter should not be trusted.
A Zero Trust strategy entails three things:
-
Always authenticate and authorize.
-
Apply the least-privilege principle.
-
Continuously monitor and adapt.
As the name suggests, nothing should be trusted and everything should be verified. Principles like last-privilege access, micro-segmentation of networks with different credentials, data usage control, and continuous validation in real-time can help organizations to mitigate the inevitable intrusions in networks.
COVID-19 has fostered a remote work culture which has, in turn, led to the rapid adoption of a hybrid work environment. Employees are not bound to the legacy perimeters anymore. Use of the cloud and the accelerated adoption of remote work scenarios has increased the threat landscape and opened paths to more vulnerabilities and complexities in the infrastructure. With this shift every organization’s security model needs to change. When someone requests access to any data, the organization needs to decide whether to grant or restrict access by figuring out who, when, where, why and how. Zero Trust enables businesses to function more effectively by providing better visibility, granular level access to users, and also helps in revoking access to any resource anytime.
Here are five interesting reads about Zero Trust architecture and why every organizations should consider implementing it.
1. Zero Trust Is Not A Security Solution; It’s A Strategy
Zero Trust is not one product or platform, it’s a security framework. The Zero Trust eXtended (ZTX) is an ecosystem with both technology and non-technology pieces which takes other areas into consideration, such as identity and access management (IAM) and privileged access management (PAM) among others. Implementing the Zero Trust security strategy should be a tool to enable digital transformation and always balance the organization’s security and employee experience.
2. Zero Trust Architecture and Solutions
ZTNA is an identity based security model which creates an identity, context based and logical-access perimeter eliminating the distinction between being on and off the corporate perimeter. ZTNA assumes all inside and outside networks are untrusted, where access is provided only after the intent and identity verification. It also helps in identifying unusual and malicious behavior by flagging attempts to access restricted resources and massive data download attempts. This research states that by 2022, 80% of new digital business apps will be accessed through ZTNA and, by 2023, 60% of enterprises will phase out most of their remote access VPNs, favoring the Zero Trust Model.
3. Why You Should Implement Zero Trust Security in 2021
This pandemic-driven remote working culture has led to an increase in the number of endpoints, including personal devices of the employees, that access the organization’s data. Thus, securing the changes in operations for business sustenance has become more crucial than ever before. A Zero Trust security strategy relies on identity and access management, endpoint control management, and an effective security monitoring capability. Organizations are now moving to security orchestration automation and response which can effectively reduce the response time and reduce the burden of repetitive tasks by automating identified vulnerabilities and implementing pre-defined workflows.
4. 5 tips for implementing a zero trust model
An organization implementing Zero Trust should first identify its users and the devices that connects or attempts to connect to your network with an IAM solution. Every data should be classified and by micro-segmentation the organizations can define access controls for the data, applications, and services. Networks should be monitored continuously and organizations should assess trust every time a new device requests access to its endpoints.
5. Why A Zero-Trust Policy Is Important For Remote Companies And Cybersecurity Effectiveness
The rise in remote work culture comes with new cybersecurity challenges that results in less control over the organization’s resources and heightened risk of data breaches. This makes it more important than ever to approach cybersecurity from a risk-based perspective. The Zero Trust model applies the least privilege principle which ensures no one has more access to the data and resources than they actually require. This model not just verifies the device but also verifies the identity; the authentication is adaptive, contextual, and risk-based.
Humans are not the weakest link; they are the primary attack vector, which is a compelling reason why access to data must be restricted as much as possible. Implementation of Zero Trust security strategy takes months of hard work with hours of monitoring and management, but it’s worth all the effort because it serves as the blueprint for the future of cybersecurity.
