A zero trust network is exactly what it sounds like. The network trusts no one and no machine, demanding that everyone on the network be authenticated, authorized, and continuously validated. Prior to zero trust networks, IT environments didn’t need to authenticate every single interaction within their network. But things have changed.
Imagine a small office with a single security guard. He checks IDs at the door but sometimes waves through people he recognizes. He’s supposed to look over manifests for deliveries but sometimes his work is very cursory, especially when some of the manifests are the same week to week. And he doesn’t have a firm grasp on what’s going on inside the building, save for his walkthroughs now and again.
You can see the problem here. A person he’s rightly trusted for years might be the person who eventually steals from the building. A manifest that’s not looked over too carefully might mask a delivery sneaking something bad into the building. And just because people are rightly let into the building doesn’t mean they won’t access rooms they aren’t supposed to.
That’s basically what networks prior to zero trust networks were like. In a building that looks more like a zero trust network, everyone’s movement is authenticated every time. Every manifest is scrupulously examined. No more cursory walkthroughs or waving people through the guard sees every day. Everyone must prove they are who they say they are, they’re supposed to be where they are, and they’re allowed to do what they’re doing.
Traditional network security used the old “trust but verify” model. Once a trusted user is past the endpoint of the organization’s network, they’re fine. But as the widespread move to remote work has shown us, it’s hard to measure where an endpoint is or demarcate a perimeter to an organization’s network. Trust but verify is obsolete with the cloud migration of businesses. The above metaphor falls apart because there isn’t really a building anymore—a business is a network of people. How do you draw a perimeter around that?
A zero trust network assumes there is no network edge. That is, a network might not be local, it might not be entirely in the cloud, and the people/machines in the network might not always be acting as part of the network. Parts of the network must always have access to the network, but the network must be protected. Hence, the three main concepts of zero trust are:
Let’s go through some of the major areas of IT infrastructure and examine the challenges related to embracing a zero trust model.
Legacy Platforms: Legacy applications may have taken a piecemeal approach to cybersecurity, which creates gaps. System-to-system traffic may be a problem.
IT Commitment: A zero trust network isn’t something you just implement one day and then move on with your life. It requires ongoing commitment from management.
IoT: There has been a significant growth in the number of IoT devices on networks, which means there’s a larger attack area than ever before. Many IoT devices were not designed with enterprise security in mind. In fact, some don’t even have passwords or automatic update functionality. And even if you forbid these devices on your network, it doesn’t mean they won’t be used.
The Cloud: Cloud-based applications need multiple layers of cybersecurity, especially when users are connecting from public connections. As a result, zero trust principles require constant scrutiny of those services and the companies offering them.
Users: Users are the weak point in any cybersecurity plan. Users must be trained in cybersecurity basics, and they must be engaged and informed about their role in keeping networks secure.
Zero trust networks will grow over the next few years as a much more secure replacement to the VPN. Organizations will look at IT network models like Managed SD-WAN and Managed Network as a Service, which include a zero trust approach at their core.
The comments are closed.