In the era of cloud-first distributed enterprises where people collaborate across time zones and device types, the Zero Trust security methodology is increasingly key.
According to research by Foundry, over half of organizations either have Zero Trust in production or are piloting it. The Zero Trust security market is expected to be worth $88.8bn by 2030, at a compound annual growth rate of just over 16%.
And this investment is urgent: according to research, 98% of CISOs expect cyber attacks to increase over the next three years. These attacks can have huge consequences: US financial services firm Equifax incurred $1.4bn in settlements after a single vulnerability in a web application was exploited by hackers.
It’s clear that security leaders must use the most effective tactics available to counter these threats.
Zero Trust is a holistic approach to security, rather than a product or service. It assumes there will be a breach, and that hostile actors could already be inside the network.
In order to counter threats, the architecture is therefore based on an approach of constant verification. And security is delivered not just at the network layer, but at the application level too.
shutterstock/Gorodenkoff
Beyond walls
This approach delivers more effective and efficient security. It does not replace existing network or endpoint security measures, but layers defenses in a way that makes the organization more resilient.
As Germany’s Bundesamt für Sicherheit in der Informationstechnik (BSI) states, “Zero Trust describes an architectural design paradigm developed from the ‘Assume Breach’ approach.” Zero Trust, the BSI says, provides better protection for applications and reduces the damage from cyber attacks.
But this does not mean no trust, it means constant verification, across the network and applications.
As the UK’s NCSC puts it: “As a term, ZT [Zero Trust] can be misleading, as there is actually plenty of trust required… The key principle is don’t inherently trust any user or service requesting access to systems or data.”
Conventional security measures are no longer sufficient
Hostile groups can breach or bypass defenses, often through phishing. Once inside, they can move across networks (lateral movement) and use privileged access to attack other systems.
These risks are greater still as organizations use more IoT and personal devices, more cloud applications, and employ more remote workers.
Restoring trust, building security
Both businesses and regulators are putting more emphasis on organizational resilience. The EU’s NIS2 directive, for example, requires Zero Trust.
To implement this successfully, security leaders must have a clear view on their infrastructure.
This includes multifactor authentication, microsegmentation with granular access controls, least privilege access, device access control, endpoint protection, data encryption, and identity and access management (IAM).
Microsegmentation allows organizations to contain any threats that break through perimeter defenses, isolating hostile traffic within the network. It is software defined, so it can respond quickly to evolving threats.
Managed detection and response (MDR) adds another layer of defense. It shields endpoints, detecting and blocking attackers before they can move into the organization. Moreover, MDR draws on the latest threat intelligence and network analysis to stop breaches before they cause damage. Vitally, these controls are dynamic and context aware. They continuously verify user identity and device health.
Zero Trust is often described as a journey, not a destination
Smart security leaders need to keep their progress towards Zero Trust under constant review, as the threat landscape changes, and technology evolves. The key is to establish a Zero Trust mindset, and implement a strategy aligned with business objectives.
Find out how T-Systems can help security teams on their journey to Zero Trust.
