July 13, 2022
4 Min Read
During the past several years, Zero Trust has gone from being a buzzword to a strategic initiative for enterprises juggling the requirements of securing a complex environment that often includes on-premises and cloud applications, a hybrid workforce, and a growing number of identities.
It is this new world, where IT environments and users are increasingly distributed, that is driving Zero Trust adoption. Rather than the castle-and-moat approach in which devices inside the network perimeter are presumed trustworthy, the Zero Trust model repositions security around the idea that users and devices should never be trusted by default.
Done right, it can reduce the attack surface and help secure data and applications as organizations pursue their cloud plans. But even as Zero Trust adoption increases, there is still a mix of technical and business barriers to implementation. Perhaps the most troublesome ones are a lack of knowledge and resistance to change.
According to a survey released in June by the Cloud Security Alliance (CSA), some 80% of C-level executives consider Zero Trust to be a "medium" or "high" priority in their organization. However, when asked to choose the top business barriers to Zero Trust adoption, 37% cited a lack of knowledge and expertise. Twenty-three percent cited resistance to change, 29% noted a lack of internal alignment or buy-in, and 21% said a lack of formal strategy. Other responses included additional staffing needs (31%) and a lack of an executive sponsor (26%).
A critical part of getting started with Zero Trust is communicating what it is, what it requires, and how it can impact your business and IT processes. To separate marketing hype from reality, businesses must address common myths and misconceptions around Zero Trust.
Myth 1: Zero Trust is only for large enterprises
It is an unfortunate fact that cyber-attackers frequently target small businesses. As they embrace technologies like the cloud and Internet-of-Things, enforcing Zero Trust enables them to enact strict access controls that can protect their environment. The notion that Zero Trust is for large enterprises is often accompanied by the idea that implementing it is expensive.
However, Zero Trust is not necessarily about buying a new set of products. It is an approach, and its implementation need not be cost-prohibitive. Organizations should start by determining the business objectives they want to achieve, how Zero Trust can help, and assessing what they need to do from a technology and policy standpoint to begin their journey.
Myth 2: Zero Trust is too complicated to implement
Building on the point above, there is a myth that implementing Zero Trust can be too complicated or overwhelming. Implementing Zero Trust will take collaboration between multiple stakeholders, such as security and networking teams. However, it is not impossible. There is no single road to Zero Trust. Organizations can begin by tackling implementation challenges piece by piece. By understanding their needs and their environment, businesses can begin to establish a roadmap that makes sense for what they are trying to accomplish.
Myth 3: Zero Trust is just about protecting network connections
There is a tendency to think of Zero Trust in terms of network connections and to forget about endpoint security. Due to enterprise mobility and the bring-your-own-device trend, it is not uncommon for endpoints to be managed by the organization. The result is an expanded attack surface caused by endpoints that may be out of compliance with an organization's configuration and patch policies. To fully enable Zero Trust, organizations need to integrate network and endpoint security and maintain visibility over devices' security posture and activity. Zero Trust should extend throughout the entire IT infrastructure for the approach to reach its full potential.
Myth 4: Zero Trust hurts user productivity
When done effectively, Zero Trust should not negatively impact the experience of your users. For example, using behavioral analysis can make authentication decisions based on risk more automated and secure without complicating life for legitimate users. With Zero Trust implemented, organizations can revoke or grant access quickly, which can actually reduce friction for users. This ability allows organizations to quickly address threats while enabling seamless access for authorized users.
This factoid is false. The term was created back in 2010 by Forrester Research and over 12 years later, it has emerged as a leading security model to address modern, hyper-connected infrastructures.
This factoid is false. The term was created back in 2010 by Forrester Research and over 12 years later, it has emerged as a leading security model to address modern, hyper-connected infrastructures.
This is false. Moving toward a Zero Trust security structure can be achieved in incremental steps – there’s no single right way to get there.
This statement is false. Moving toward a Zero Trust security structure can be achieved in incremental steps – there’s no single right way to get there.
This is a true statement. 61% of data breaches happen at small companies (Verizon Data Breach Investigation Report). It can be inferred that smaller organizations simply don’t have the resources in place to protect themselves against attacks.
This is a true statement. 61% of data breaches happen at small companies (Verizon Data Breach Investigation Report). It can be inferred that smaller organizations simply don’t have the resources in place to protect themselves against attacks.
This is true. Enterprise devices are connecting from more networks and locations than before. This presents an increased opportunity for bad actors to compromise connections and corporate data.
This statement is true. Enterprise devices are connecting from more networks and locations than before. This presents an increased opportunity for bad actors to compromise connections and corporate data.
This is completely untrue. A Zero Trust architecture improves operational efficiency and can reduce network complexity, improving users’ experience.
This statement is completely untrue. A Zero Trust architecture improves operational efficiency and can reduce network complexity, improving users’ experience.
This is scary but true. An unencrypted enterprise device can carry a substantial risk for an organization. This risk becomes even greater if the device is being used outside the perimeter of the corporate network.
This is scary but true. An unencrypted enterprise device can carry a substantial risk for an organization. This risk becomes even greater if the device is being used outside the perimeter of the corporate network.
This is untrue. Zero Trust security extends beyond the narrower Zero Trust network access (ZTNA) definition. It is a philosophy that accounts for the protection of both network connections and the security of the endpoints themselves.
This statement is untrue. Zero Trust security extends beyond the narrower Zero Trust network access (ZTNA) definition. It is a philosophy that accounts for the protection of both network connections and the security of the endpoints themselves.
Making Zero Trust a reality
It is wise to think of Zero Trust as a journey. It is an approach that stretches from the data center to cloud workloads, and as the IT environment changes, an organization's implementation may need to change as well. Before investing in the technical components required to make it a reality, business and IT leaders need to get buy-in from their security team and business executives. All stakeholders in this process need a clear understanding of what they are trying to accomplish technically and the business case they are trying to serve. By abandoning misconceptions and preconceived notions, organizations can begin making headway in implementing a Zero Trust architecture that suits their needs.
To find a better way of implementing a Zero Trust strategy, check out “The value of Zero Trust in a WFA world.”
Share this article
