3 Ways to Implement Zero Trust (ZT) Without Rebuilding Your Network

By Adam Case ( Technical Offering Manager – Cloud Identity, IBM Security )

Risk never sleeps. As mobile devices flood the enterprise (especially for a younger generation of workers), the Internet of Things (IoT) expands, and cybercriminals grow in both numbers and sophistication, many security professionals think Zero Trust is the safest approach to defending against constantly evolving network and data security threats.

Network vulnerabilities can be found in the most unlikely places. Bloomberg Businessweek, for example, described a case in which an internet port in a hotel room’s motorized, remote-control curtains offered access to the hotel’s internal computer systems. Fortunately, a cybersecurity contractor discovered that particular security gap during an audit, but the lesson rings true: In today’s connected world, unlocked doors, backdoors and trap doors could be almost anywhere.

What Is Zero Trust Security?

The term Zero Trust was coined by John Kindervag, an analyst at Forrester Research, in 2010 when the model for the concept was first presented. A few years later, Google announced that they had implemented Zero Trust security in its network, which led to a growing interest in adoption within the tech community. ZT further gain traction when in 2013, Forrester Research submitted a report submitted to the National Institute of Standards and Technology (NIST) seeking input from technology experts as part of a U.S. government cybersecurity initiative. Forrester, citing a new environment in which “changes like mobility and big data have made ‘building stronger walls’ an expensive farce that will not adequately protect networks,” introduced the concept of Zero Trust, urging organizations to “make security ubiquitous throughout the network, not just at the perimeter.”

Zero Trust refers to both a set of practices and a network design philosophy. In short, zero trust inverts the “trust but verify” approach to “verify and never trust.”

Achieve Zero Trust Security in 3 Steps

According to Forrester, organizations should ideally rebuild their networks “from the inside out,” starting with the “system resources and data repositories that we need to protect as well as the places where we need to be compliant.” However, while rebuilding the network may be a desirable long-term goal, there are myriad ways organizations can gain the benefits of zero trust without embarking on a project of that magnitude.

Here are three steps you can take to introduce zero trust security principles into your organization.

1. Strengthen Identity Validation

Although passwords are the first line of defence for most networks, 59 percent of users have the same password for multiple accounts — and it’s a good bet that the remaining 41 percent vary their passwords by only a few characters. Identity and Access Management (IAM) solutions enable organizations to enhance security by applying multifactor authentication (MFA), which may require biometric factors, such as a fingerprint or iris scan, or the use of a physical object, such as a FIDO2-supported device.

2. Segment Sensitive Data

Segmenting or microsegmenting your network enables you to keep large portions of the network safe in the event of a breach, thereby minimizing the damage. The human resources system, for example, is an obvious choice since it contains Personally Identifiable Information (PII). Experts recommend implementing network microperimeters, such as a next-generation firewall and data security controls so that intruders cannot access more than a defined subset of data, even if they can breach the perimeter defences.

3. Scrutinize Access Behaviours

In addition to guarding the network, an effective zero trust strategy includes monitoring access behaviour and using analytics to search for patterns and trends. Analytical tools, tracking access behaviour, and identifying patterns, trends and potential threats can reinforce data privacy — supporting compliance and increasing customer confidence.

The Success of Your Business Is at Stake

A network data breach puts not only customer information, such as credit card numbers but also the corporate intellectual property, employee records and more at risk. In addition to financial damage, loss of reputation and customer confidence — as well as potential legal liability if a breach is found to violate the General Data Protection Regulation (GDPR) or other privacy laws — are at stake.

Malicious hackers never rest, but neither do the good guys on corporate cybersecurity teams. The Zero Trust approach offers a myriad of weapons for the fight.

To learn more, listen to the SecurityIntelligence podcast, “Zero Trust and the Evolving Role of Identity and Access Management.”