Zero Trust Security: Why Trust But Verify is No Longer Enough

This guide will help you understand the basics of zero-trust security and how it can help your team secure your users, applications, and information. You’ll learn more about how zero trust security differs from the traditional approach, why it’s necessary, the benefits, and the challenges.

For years companies have operated using “trust, but verify” security principles. This means that anything living inside of the corporate firewall was automatically trusted to access the network. It relies on IP addresses, ports, and protocols to “trust” a particular user. That method worked for a while–but only because companies kept their information inside of a centralized location. The firewall was the moat protecting the castle of information.

Unfortunately, there were a few issues. If someone breached the moat they were free to wreak havoc in every room. Not only that, information and people dispersed. Companies are using hundreds of SaaS apps, information is sent to the cloud, and people are working from anywhere. The castle and its occupants are all over the place and the number of access points will only continue to grow. With that growth comes increased risk and threats, which requires a new way to work.

Enter zero trust security.

Zero trust security is an architecture started in 2010 by John Kindervag. Rather than trust, but verify, zero-trust security is built on the idea that no organization should automatically trust anything–even if that something is inside the corporate firewall. Every request for access to tools, data, or other information must be earned and verified every time. No user can access anything until the network knows who they are. For example, a computer may be connected to the corporate network and even live inside the office building, a zero-trust security model will still require verification every time the user needs to access corporate data or applications.

Unlike the traditional approach, zero-trust security is not location-based. Instead, a zero trust architecture means information, applications, and more are protected by microsegmentation, or a granular approach to security. Microsegmentation is based on business policies and those policies connect users, devices, and applications over any network–no matter the location. In addition, users are continually authorized, authenticated, and validated, whether in or outside of the network.

A zero trust architecture uses a number of technologies to authenticate users and devices and protect identity, including multifactor authentication, IAM, orchestration, analytics, encryption, scoring, and file system permissions. Rather than putting a moat around the castle, it uses microsegmentation to look at users, locations, and other data before deciding if that user, device, or app is trustworthy–no matter where the user or device is located. Access is based on least privilege controls, meaning users only have access to what they need to do their jobs and nothing more. A zero-trust model continually verifies access for all resources, works to minimize the impact of an external or internal breach, and also provides appropriate context when a threat is perceived. This context helps IT teams determine how to prioritize the threat and which actions to take.

Zero trust security is a pretty big shift compared to traditional models. It requires IT teams to think differently in order to secure remote workers, hybrid environments, and other threats. But it’s absolutely necessary for IT teams to maintain security and compliance in a sea of users, apps, and devices. Creating a zero trust environment means IT teams must create policies and controls that determine privileges and attributes and continually enforce those policies in real-time. Even a slight lag, such as a former employee gaining access to company data before their permissions are turned off, can compromise company security, privacy, and compliance efforts.

Yes and no. Implementing zero trust security is complex and it will look different for every company. It’s difficult to create the zero trust architecture in a legacy or existing environment. While it can be done in stages as a company moves away from legacy systems, a zero-trust environment is something that should really be built by design and as part of a bigger digital transformation strategy.

A successful zero trust architecture isn’t just a one-off initiative; it requires ongoing microsegmentation and validation to be successful. If information is not updated promptly or correctly, employees may not be able to gain access to the tools and information they need to do their jobs.