Zero Trust Security

How Does Zero Trust Work? 

Zero trust works by helping security organizations realize the power of least privileged access (LPA) – the concept that individuals and components should only have the most minimal access necessary to perform a required action. It initially applies a second authentication factor to a user previously verified by a preliminary set of credentials.

The entire authentication attempt is risk-assessed in real time to see if, for example, an individual's connection is in an allowed geofence, that the access time is within the usual operating mode of that person, and that the individual does not already have an established session.

Even if an attacker managed to obtain multi-factor codes via – for example – a weaker SMS 2-factor authentication (2FA) that was all an organization could afford to implement – they may achieve a successful connection, but would not have general access to all intranet systems and services. In fact, the VPN connection would only grant them access to a defined set of applications or services. If the attacker makes any attempt to try a network scan or perform other behavioral network actions, monitoring systems would be alerted and that individual and connection would be quarantined for investigation.

Each transaction has a defined set of authentication, authorization, and behavior-auditing rules that continually let the overarching zero-trust system ensure the safety of the interactions.

What are the Use Cases for Zero Trust? 

The zero-trust security methodology can really apply to any device, application, or human connecting to the internet or connected systems. Authentication applies in all cases – especially those of a sensitive nature – in order to best protect the business. Let’s take a look at some specific use cases:

Securing Device Access

Internet of Things (IoT) devices are constantly sending and requesting data from any number of applications on a company’s network. In more traditional security models, IoT devices were imparted a certain level of trust based on a multitude of factors. As the number of these devices – and the attack surface of their users – expands, it’s critical to implement zero trust so that security is hardened and everything is authenticated.

Securing Remote Worker/Application Access

The pandemic was a gift for attackers due to companies around the world scrambling to set up a remote workforce to mitigate productivity downturns. Attack perimeters expanded almost overnight as proper security became secondary to keeping businesses running.

Emerging from the pandemic, much of the global workforce is hybrid – a few days in the office, a few days at home – so solutions like zero trust should remain in place in order to protect businesses in this new normal. Each worker must authenticate their access to corporate network applications, every day.

Securing Supply Chain Access

Relying on third party suppliers and vendors is the baseline in today’s economy. No business or security organization can be entirely independent and thrive. Stakeholders must assume that any access to its network by a third party is a vulnerability. Therefore, those outside vendors must continuously validate and authenticate their network presence in order to mitigate cyberthreats that may emerge from that supplier’s own environment.

Protecting Against Ransomware

Root causes of ransomware are attributable to a multitude of errors: misconfiguration, human, weak authentication protocols, and general lack of cybersecurity awareness. Ok, so lots of those are human-attributable. That’s why a zero-trust architecture is a crucial weapon in the fight against ransomware – it requires authentication of access to only the area where a human or application needs to take action.

How to Implement Zero Trust

While this section could fill an entire book, let's talk about the scenario of the beginning of a zero-trust journey. To make the initial move, you'll need to pick at least one business process or service-access scenario to move to this new model. 

Standing Up the Solution

Every component and individual responsible for enabling a business process or service must be identified and the architecture fully documented. At this point, you may find you need to reimagine the architecture to ensure you have the necessary control and audit points in place.

You'll then need authentication, authorization, auditing, risk-assessing, and enforcement solutions to support the access decisions at each connection in the process or service. Finally, you'll need staffing to support creation and maintenance of the rules that are enforced, along with traditional patching, mitigation, and configuration management enforcement activities.

Then, repeat for all other processes and services. In other words, it’s quite an effort to get scalable zero trust off the ground.

Timing and Resources

However, you should not – and, in reality, cannot – move every business process and service to zero trust all at once. Once you've assessed that initial service, begin the groundwork of acquiring the necessary tools and hiring the necessary staff to ensure a successful outcome. Then, you can transition that initial service over to zero trust when funding and time are on your side, and leave it in place for a while as you evaluate what it takes to maintain safety and resilience. Once you’ve adjusted your tooling and staffing plans accordingly, you can get to work on the remaining processes or services.

Thankfully, you may have many of these components and personnel in place within existing security and compliance solutions and processes, and you can finally employ more of your existing investments' capabilities than the 5-15% most organizations generally utilize.

Adopting the Zero-Trust Mindset

One of the biggest mindset challenges to overcome when introducing zero trust into your organization is the fear that the constraints that the model imposes will reduce productivity and hamper creativity. These fears can be overcome with the right framing of zero trust:

• Start by performing a scenario-based risk assessment of a given business process. Do this with the business process owner(s) or stakeholder(s), and ensure you enumerate what actions threat actors could take at each transaction point in the process, ideally with some measurement to the costs – due to loss of safety and resilience.
• Go on to show how each threat is reduced or eliminated with a zero-trust implementation of the same business process, and note how new processes – developed from the outset with a zero-trust mindset – will likely have reduced implementation costs, be far more safe and resilient, and can be much easier to enhance over time as they will have been established on a solid foundation.