Zero trust sounds easy enough -- just remove trust from the equation. But it isn't quite that simple. Moving from a traditional security architecture that assumes trust for devices, individuals and locations to a zero-trust model that instead trusts nothing until it is verified requires new tools, methodologies and a different way of thinking.
Legacy network security designs were perimeter-based, castle-and-moat philosophies. Everything outside the perimeter was considered hostile until proven otherwise. Network security tools -- among them firewalls, intrusion prevention systems, VPNs and other security services -- were deployed to fortify internet and extranet edges of corporate networks. Once on the inside, network-connected devices, users and communications were largely considered "trusted."
Many in the industry realized this was not the most secure approach, but only recently were tools developed that help assume all network devices, users and locations should be considered untrusted until they are verified.
Two additional factors driving the movement toward zero-trust strategies are public clouds and the uptick in remote workforces. As applications, data and services began migrating to public clouds, security administrators quickly realized that network flows were no longer passing directly through the corporate network. The same is true of workers accessing resources from outside the corporate LAN. Thus, edge security tools have become far less effective and, in some cases, have become performance bottlenecks when remote traffic is hairpinned through perimeter security tools.
The ability to create virtualized protective barriers around critical resources -- both on premises and in the cloud -- eliminates flaws found in previous perimeter security models.
Zero-trust use cases in the enterprise
For organizations that see a zero-trust model as a good fit for their infrastructure, learning how to correctly build and manage a zero-trust network is likely a top priority. One of the best ways to understand how to implement zero trust is to look at zero-trust use cases.
Here are four examples of where zero trust can significantly bolster a company's security posture.
Secure third parties working inside the corporate network. Most enterprises support employees on the corporate network. However, it's inevitable that other users, such as third-party business partners, will also work from within your corporate network. These situations spotlight the true reason why location-based security tools are woefully overrated and why security should be uniform -- via zero trust -- across the board.
Protect remote workers accessing public cloud resources. Managing the security of remote employees has been a major concern during the COVID-19 pandemic. Security administrators are finding their edge security products provide no benefit to remote workers who use the internet to connect directly to public cloud resources. While it is possible to force remote workers through the corporate network via VPNs or virtual desktop infrastructure technologies, these options often prove inefficient and burdensome. Zero-trust security is a great alternative because it does not require users to connect to the corporate network before accessing cloud services.
IoT security and visibility. For businesses with IoT ambitions, security is a major issue because many embedded IoT devices are not secure out of the box. Instead, security mechanisms are often wrapped around IoT deployments.
Zero trust offers two key security benefits for IoT deployments. First, it helps build and maintain a dynamically learned inventory of devices that includes IoT sensors. Knowing where IoT devices reside at any given time is an important consideration of any IoT project.
Second, zero trust can automate the security health monitoring of autonomous IoT devices. In many cases, it's impossible to install agent-based security, such as endpoint detection and response, on IoT sensors. Zero trust can be used as an alternative to strictly limit who and what IoT devices can communicate with in the event of a compromise, reducing the overall vulnerability of IoT deployments.
Data center microsegmentation. A relatively new data center trend is known as distributed computing. This is where compute services are spread across multiple compute infrastructures and clouds but operate as a single application. Benefits of this model include improved performance, reliability and scalability. One drawback, however, is that the distributed services must be in constant communication with one another. Any compromise or mimicking of a service can affect and compromise the entire application. Implement zero trust within systems, data centers and clouds to help protect the integrity of laterally moving data as it passes from one service to another.
Zero-trust use cases: The benefits
From a cost-benefit analysis perspective, zero-trust use cases offer several security advantages that are otherwise difficult or impossible to achieve. These include the following:
- Uniform security, regardless of device, user or location. Zero trust removes inherent bias stemming from device type, user status or location the device or user is connecting from. This flattens the security playing field, requiring full enforcement of security mechanisms across the entire corporate infrastructure.
- Increased security visibility. Zero trust provides unprecedented visibility by centralizing security logging and management, as well as automating the discovery of devices, applications and end users. This helps create a uniform security policy, no matter where applications, data and services reside.
- Regain security control of cloud and edge services. Zero trust can be deployed anywhere it's needed. This not only includes users and devices that connect from or into privately owned and operated networks, but also public cloud and edge compute services.
Myths about zero trust
Because zero trust has been such a popular buzzword over the past few years, myths are floating around that, in most cases, have been spawned by misleading marketing material.
One major myth is that any infrastructure can easily adopt a zero-trust model. The unfortunate truth about a zero-trust deployment is that it's far more achievable with modern network hardware and applications. Legacy systems and applications cannot always be retrofitted to support zero trust. The hardware and software used in many situations was built on the concept of secure boundaries. Such tools work by inspecting traffic as it moves from centrally located clients to centrally located application servers. These models are no longer relevant when it comes to zero trust. Major architectural and hardware changes are often required to deploy a zero-trust framework.
In addition, several popular open and proprietary peer-to-peer (P2P) or mesh protocols -- such as Zigbee or Z-Wave -- are not conducive to zero trust. Thus, it's possible that major P2P or mesh deployments would have to be reworked to adhere to the zero-trust model.
The second myth is that zero trust will not restrict daily workflows or hold the organization back if it pivots toward new business goals. If zero trust is not carefully designed and deployed with flexibility in mind, the security model can quickly become an administrative nightmare when major changes are required. In this scenario, zero trust has the potential to be more trouble than it's worth. That said, deployment and management tools are getting better by the day, and this concern is quickly fading.
Zero-trust trends
Now that the zero-trust market has had a few years to mature, some trends are beginning to emerge.
First, enterprises are taking an outside-in approach to zero trust. This means the focus is on the verification of end-user devices first, then working inward to protect interserver and infrastructure communications.
A second trend is the increased reliance on AI and automation to assist with tasks such as patch management and threat identification and prioritization. These create management and operational efficiencies from a maintenance and threat response perspective within zero-trust tools.
Finally, zero trust is using edge computing to place security services as close to local and remote workforces as possible. This improves performance and streamlines the end-user experience.
