Zero Trust: Never Trust, Always Verify

Written by: Jay H.

Zero Trust is a security concept first coined in 2010 by John Kindervag of Forrester Research Inc. This concept centres around the idea that organizations should not trust anything inside or outside their network perimeter. Instead, they should require strict identity verification for every person and device attempting to access resources on the network.

But why be so strict? Well, traditional network security makes it hard for an outsider to gain access from outside the network, but, once in, they have free reign over everything. The faults in this are apparent – what if an attacker breaches the outside defence? Considering that the average cost of a data breach is $3.86 million, organizations need to do everything in their power to keep cybercriminals out. Implementing the Zero Trust approach is one method firms can use to defend themselves.

Principles Behind Zero Trust

• Zero Trust assumes that there are attackers outside and inside a network, so trust no device or user.
• Another philosophy of this security model is least-privilege access. This means giving a user only the amount of permission they need and no more. As a result, this minimizes the exposure users have to sensitive data and their risk if they are compromised.
• The traditional security model is obsolete for today’s reality. No longer do firms have corporate data centres hosting networks of systems but instead have on-premise applications and others in the cloud. Employees, customers, and partners access these cloud applications from different devices from multiple locations.
• Multi-factor authentication (MFA) is another core component of Zero Trust. By enabling MFA, users must provide at least two pieces of evidence that they are who they claim to be. Instead of simply entering a password and gaining access, individuals may, for example, have to enter a code sent to another device as well. The importance of MFA cannot be stressed enough – in fact, according to one blog post from Microsoft, enabling MFA can stop up to 99.9 percent of attacks.
• Microsegmentation is another element of the security concept. Essentially, microsegmentation breaks up the security perimeters into small areas, maintaining separate access for different parts. So, a user with access to one segment would need separate authorization to access a different area.

Never Trust, Always Verify

By implementing a Zero Trust policy, businesses can strengthen their defences against external and internal threats. Firms should not retroactively incorporate this security model, but incorporate it into their overall cybersecurity strategy. This will help them achieve Zero Trust as more and more applications move onto the cloud.

Hackers are, unfortunately, advancing and evolving every day. Is your business prepared to defend against sophisticated attacks? Consider partnering with a credible managed IT services provider such as Design2Web to manage your organization’s network security.