Zero Trust is effective - what else is needed for security?

In my last blog on Zero Trust (on June 6 of this year), I talked about the reasons why Zero Trust is becoming more popular and why the change is necessary.  In this blog, I want to delve more into what does a Zero Trust model buy you and what you still need to do in your security program alongside Zero Trust.

At its core, Zero Trust is making the decision that all access to applications, data and resources should be checked and strongly verified on a continuous basis.  This helps your organization in several ways…

Zero Trust helps provide a mechanism for strong identity protection. As protecting identities (both normal and privileged) has become one of the main focuses of security, more and more security tools and business processes hone in how to recognize how identities are being used and what access should they have.

This is really important because of the way applications and data are now dispersed. As security operation teams are trying to baseline access, it becomes instrumentally important to know the context of which identities are logging in, from where, and on what device.

One of the goals of Zero Trust should be to limit the number of people or identities that access your systems, data and applications, allowing you to watch possible compromised account activity and prevent compromises. Using strong authentication and just-in-time access, along with watching login activity, will greatly reduce the chance for compromised accounts. This makes life a lot simpler operationally and maybe in application development.

Now that you have a single method for access and are using a consolidated identity with strong authentication and baseline login activity, this allows organizations to expose resources internally as they would externally. Now internal applications and resources can feel like cloud applications and resources when it comes an employee access – the login method could be the same and the security can be the same. This innately helps with identity protection and gives flexibility to possible new ways for remote access for remote workers.

This also increases visibility with security operational staff, as security operations can now focus on less things to monitor and alert on. They can develop access polices that can be applied to more applications, data and infrastructure because the access method has be simplified, and reacting to compromised account indicators will be faster since logins have been baselined.

Additionally, the number of security tools might go down because access has changed and simplified. This is in contrast the older security model where access could wildly vary depending on endpoint network location and identity used.

What do you need beyond Zero Trust?

There are things that still need to be done beyond Zero Trust. While Zero Trust does help in many ways, it does not cover all aspects of what an effective security program still requires.

• Organizations still need to have strong policies and standards.
• They need to have a working vulnerability program that covers as many assets as possible.
• Remediation for found vulnerabilities needs to happen in a timely manner.
• Data protection has to be carefully planned and documented in case someone or thing has compromised the integrity of the data.
• Business continuity plans need to be in place and rehearsed.
• Endpoint security must works with your Zero Trust strategy.
• Security operations has to be built or outsourced to provide a response to security indicators.
• Tools have to be in place to take in those indicators and provide alerts.

In summary…

This is a high-level view of the benefits of Zero Trust and what other aspects of security must coexist alongside that architecture and solution for effective security strategy.  In my next post, I will go into more detail on the components of Zero Trust and things to consider to get started planning and implementing it in your organization.

In the meantime, if you’re considering Zero Trust in your environment and want to discuss,  just contact us, and one of our security experts is here to help.

Additional Resources: