Weak Zero Trust Exposes Enterprises to More Cyber Threats

What is Zero Trust security?

Digital transformation, the proliferation of emerging technologies and working habits such as ‘work from home’ have blurred the traditional corporate boundaries. These developments coupled with an alarming increase in data breaches and security incidents have turned trust into a blind spot and a liability. Zero Trust security is based on the tenet “Never Trust, Always Verify”, views trust as a vulnerability, and requires strict and continuous identity validation and verification to minimize implicit trust.

Zero Trust is a strategic initiative and principle that helps organizations prevent data breaches and protect their assets by assuming no entity is trusted. The National Institute of Standards and Technology (NIST) defines Zero Trust as “a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as compromised.”

Zero Trust goes beyond the “castle-and-moat” concept which was predominant in traditional perimeter security. Traditional security concepts considered all users and devices inside a corporate network as trusted – including malicious actors. Leveraging on implicit trust, adversaries could move laterally across corporate networks and freely access or exfiltrate sensitive data.

Zero Trust can help organizations strengthen their security posture and limit their attack surface through the application of:

• Strong user identification and access policies
• Segmentation of data and resources
• Strong data security in storage and transfer
• Security orchestration

Why do we need it?

Digital transformation, work trends and emerging technologies have been a real challenge for traditional perimeter security solutions. Legacy solutions are no longer adequate to effectively protect modern enterprises. The use of legacy security solutions to satisfy the new business requirements and to enforce authentication and authorization hampers productivity, scalability, user experience and increases operational costs.

Security teams are faced with access management and visibility challenges. Failure to address these challenges coupled with the inherent risks and vulnerabilities introduced by emerging technologies results in an expanding threat surface.

The exposure of businesses to threats and attacks also grows because criminal actors are getting more sophisticated, leveraging the capabilities of the same technologies to turn them into adversarial weapons. Insiders, like disgruntled employees or partners, are also leveraging untracked credentials and their privileges to disrupt operations. Once inside the corporate network, malicious actors are able to elevate privileges to perform reconnaissance, move laterally undetected, disrupt business operations and extract data.

Implementing a Zero Trust security model

Implementing a Zero Trust security model in an organization requires a different security mindset. Designing a solid Zero Trust model requires a clear understanding of business functions and workflows, roles and responsibilities, deployed software and hardware, and access levels. We also need to have a vision how each of those requirements will shape in the future.

IT and security teams should come up with an agreed-upon strategy that includes clearly defined objectives, the final infrastructure, and step-by-step procedures on how to meet the objectives. Building a Zero Trust network from the ground up might be easier than reorganizing an existing network into Zero Trust because the existing network will need to remain functional throughout the transition period.

When designing the Zero Trust security model, security teams should consider

• Different kinds of users in office and remote
• The variety of corporate devices, like mobile, and IoT
• Available on-premises and cloud applications
• Mechanisms to access and store data

Challenges to implementing Zero Trust security

Moving from traditional, perimeter security concept to Zero Trust is not an easy task. This is especially true for organizations with legacy systems in place. While Zero Trust seems like a one-way road for modern enterprises, executives must consider the disruption that comes with such a transition.

Poorly designed approach

Zero Trust architecture may eventually lead to superior security, but it can put companies at greater risk. Decommissioning legacy apps and security solutions may create gaps and leave organizations open to new vulnerabilities. On the other hand, we should consider that legacy systems might not support micro-segmentation and least privilege principles. A careful and gradual approach is required, starting with the most critical data and then moving to other systems and apps.

Ongoing administration and commitment

Zero Trust relies on a complex network of strictly defined authorizations and access controls. As personnel rotate into new roles or change locations, these access controls must be updated to ensure the correct people have access to specific information. Maintaining accurate and up-to-date permissions requires ongoing effort and commitment. If those access controls are not updated immediately, unauthorized individuals could gain access to sensitive information.

Complexity hampers productivity

The core principle of Zero Trust is enforcing strict access controls to corporate data. The biggest challenge is how to design and implement these controls without disrupting business workflows and hampering user convenience. Employees require continuous access to corporate data to work and collaborate. If employees find themselves locked out of files or applications for a week, their productivity can plummet. Security complexity will eventually lead to insecure workaround solutions, exposing the organization to additional challenges and threats.

How to overcome these challenges

To overcome these challenges and reap the benefits of Zero Trust security, a careful migration strategy is required. Gradually introducing Zero Trust security is a good practice because it will affect and disrupt business continuity, creating more problems than the ones intending to solve. Businesses should begin by imposing strict authentication and authorization controls to the most crucial assets, without dismantling existing security programs and creating, thus, unforeseen cyber threats. They can segment the legacy systems that cannot be seamlessly migrated – and start incorporating zero trust for more new age, containerized applications.

Despite the efforts of the cybersecurity industry, data breaches will continue. Zero Trust promises to offer enhanced security focusing on the corporate assets rather than the corporate entry points. Businesses need to recognize the challenges of implementing a robust Zero Trust security to ensure a strong cybersecurity posture.