How can you overcome the challenges of zero trust security models?

Defining the scope means defining what resources and assets you possess. It is an endeavor into visibility that goes beyond a network map. Visibility across a system includes your infrastructure, endpoints, workloads, data, and users. Discovery and classification of assets is the frame to which the zero trust journey begins. Moreover, it is equally important to ensure visibility of processes and activities occurring across assets. Therefore, defining the scope is essential and should progress under the motto “You can’t protect what you don’t know about”. Skipping this step will likely leave assets unprotected, vulnerable, and create potential access points for intrusion.

As much as it appears challenging at first glance, in most of the organization this information would be ready - assets/users/ access right etc. This is baseline requirement today for most standards. That information can be leveraged to great extent to build scope for zero trust. In this scope, organizations need to ensure that every component is included to add authentication /authorization at each layer

One thing that can be helpful for defining the scope for zero trust arhitectura is to implement it into phases. On phase 1 you can the scope by critical level. Once that is complete, you can gradually move to a more segmented approach, that is more micro-segmented, specific application or processes. Phase 3, continuous monitoring to determine additional changes on the scope.

Establishing identity means hardening IAM procedures. A tenet under the zero-trust model is continuous verification. To achieve this, organizations can implement a range of multi factor authentication (MFA) or two factor authentication (2FA). This may include a mobile push or passwordless options such as face recognition, QR codes or FIDO tokens. This level of identity assurance is crucial to zero trust. Coupled with defense-n-depth layers, organizations can begin segmenting a network as they look to achieve zero trust architecture.

“Simplify” may not be an accurate word choice. Perhaps “redefine” and “customize” better capture the sense of what this activity includes. Only necessary communication is allowed for the minimum necessary sources and destinations. That’s a lot of work, and it’s anything but simple.

Network should be segmented to align with business processes and to reduce attack surface. Organizations have been doing it at a very high level through DMZ/internal/LAN type of segmenents. With microsegmentation, its a deeper drive to ensure risk is brought to acceptable level, contained within the segment. Without building clear policies, microsegmentation may not be possible.

One of the challenges with implementing a zero trust model may be user resistance. A potential solution to this can be to offer training and awareness programs to help users understand the importance and benefits of a zero trust model for example, but most importantly, how these changes will be beneficial to them/their productivity and security. For example, an improved and smoother user experience, with tools like Single Sign-On (SSO).

Well-defined, well-communicated processes will be important, especially if “zero trust” is a new strategy that will create friction for your customers. There is nothing quite as frustrating as trying to drive a project, and learning last minute there is a whole new cumbersome process that adds an entire dimension of complication you’ve never had to plan for previously.

Incorporating a zero trust model requires a paradigm shift in how security is approached. For any security program to be successful it is vital to have executive buy-in, a dedicated team to manage the transition, and regular reviews to ensure the model meets the organization’s changing needs.