David Kelleher
Feb 22, 2024
David Kelleher
Feb 22, 2024
Traditional security models based on perimeter defence and implicit trust are no longer effective. The notion that what is inside the organisation’s network is trusted and everything outside as untrusted is no longer supported.
Instead, organisations are adopting a more proactive and holistic security strategy that does not trust any user, device, or application, regardless of location, whether inside or outside the network perimeter. This new approach is called Zero Trust.
The core principle behind Zero Trust is “never trust, always verify”. This means that only those who are authenticated and authorised are given access to resources, systems and data. Simply put, every request must be verified and authenticated.
In a recent survey by Optiv all respondents said Zero Trust is important in reducing their organisation’s risk and consider it to be one of the most effective security practices.
Zero Trust is not a product or a solution, but a philosophy and set of principles and best practices that guide security decisions and policies. Zero Trust aims to reduce the attack surface, limit lateral movement, improve visibility, and simplify security operations.
The Optiv survey found that 44% saw the ability to reduce the attacker’s ability to move laterally as one of the top 3 reasons for building a zero trust strategy.
“Never trust, always verify” encapsulates what Zero Trust is all about but there are a set of underlying principles that explain the rationale behind this proactive approach to security.
These are:
Verify explicitly: Every request for access or data must be authenticated, authorised, and encrypted, regardless of where it originates, where it is going, or what resource it is accessing.
Use least-privilege access: Users, devices, and applications should only have the minimum level of access and permissions they need to perform their functions.
Assume breach: Zero Trust assumes that attackers are already inside the network and constantly monitors and audits all activities and transactions for signs of malicious behaviour or anomalies.
Micro-segment: The network should be divided into small, isolated segments that have granular security policies and controls. This prevents lateral movement of attackers and contains the impact of a breach to a limited scope.
Automation: Zero Trust requires a high level of visibility and control over the entire digital environment, which can only be achieved by leveraging automation, machine learning, and artificial intelligence to collect, analyse, and act on security data in real time.
A Zero Trust security strategy offers several significant benefits, such as:
• Improved security posture: Zero Trust ensures a higher level of security, leading to a more robust defence against potential threats.
• Reduced risk of data breaches: Zero Trust minimizes the attack surface and prevents unauthorised access, reducing the likelihood of successful data breaches.
• Enhanced compliance and regulatory adherence: Zero Trust frameworks often align with various compliance standards, providing organisations with a structured approach to meet regulatory requirements and maintain data privacy and security.
• Adaptability to modern IT environments: Zero Trust is designed to accommodate complex and dynamic IT infrastructures, ensuring security remains effective in diverse and evolving technology landscapes.
• Simplified access management: Zero Trust's focus on identity-based access reduces the need for complex network segmentation, making access management more straightforward and user-centric.
However, Zero Trust also poses some challenges:
Implementing a Zero Trust model can be complex and require significant planning and coordination. Organisations may need to redesign their existing network architecture, update security policies, and integrate new security technologies.
Many organizations still use legacy systems or applications that might not be fully compatible with a Zero Trust environment. Integrating these systems without compromising security can be a significant challenge. Adopting Zero Trust might demand additional resources, including financial investments and skilled cybersecurity professionals who are knowledgeable in Zero Trust principles and technologies.
It may also require a shift in the organisation's security culture. Employees and stakeholders might be accustomed to the traditional perimeter-based security model, leading to resistance and scepticism about the new strategy. Furthermore, this approach could introduce additional authentication steps and access controls, potentially impacting user experience and productivity.
Implementing Zero Trust is not a one-time project, but a journey that requires careful planning and execution. A Zero Trust roadmap is a strategic document that outlines the vision, goals, milestones, and actions for achieving Zero Trust in an organisation and this should be your first step.
The roadmap should always be aligned with the business objectives and priorities of the organisation, as well as the current state of its security posture and maturity. It should also be flexible and adaptable to changing needs and circumstances.
Learn more about Zero Trust here.
