Trending Articles
Trending Topics
Trending
Zero Trust is a security practice organizations can employ to bolster their cybersecurity efforts and help prevent malicious actors from gaining access to sensitive data and critical systems. Here, we discuss some best practices networking and IT security professionals should follow when implementing Zero Trust policies.
In its simplest terms, zero Trust is a set of security policies IT and networking teams put in place to limit access and Trust to assets critical to an organization’s infrastructure. Access is limited not only to users, but to any app, service, or device trying to obtain access to protected assets.
Zero Trust is also known as least-privileged access, which means that Trust must be “gained” before access is provided. This “Trust” is based on a number of factors, including the context of the person or “entity” trying to obtain access, the identity of the device trying to gain access, and other authenticating measures.
A key difference from other security practices is that zero Trust requires continual authentication, versus a single level of authentication. For a more detailed overview, read our “What is Zero Trust” explainer.
Below, we outline some of the most important things to consider when implementing Zero Trust into your security protocols and the top best practices for adopting a Zero Trust mindset.
One of the most difficult hurdles to overcome when implementing a Zero Trust strategy is obtaining stakeholder buy-in. In most organizations, stakeholders include team members, employees on other teams that will be affected, management, and members of the board. Frequently, outside players, such as investors, vendors, and third-party contractors can be considered stakeholders as well. Since all of these individuals will be affected in some manner by the new set of security policies and workflows, each will need to “buy-in” to the concept before implementation can begin.
To get these key players on board with the concept, they must first understand what Zero Trust is, how it will affect them, why it is important, the potential cost of not implementing Zero Trust, the investment required, and the benefits of it, and the savings such an approach will bring to the company.
Be sure to highlight legal issues, compliance and standards implications, and the risks involved with taking a legacy security approach versus a more modern cybersecurity stance.
Laying out a detailed roadmap that includes timelines, budget, resources (including man hours, resources, and equipment) will go a long way towards convincing key stakeholders of the importance of adopting Zero Trust.
This next Zero Trust best practice can be considered part of securing stakeholder buy-in, but is worth including as its own step. Your roadmap and implementation plan should begin by identifying and listing any risks that can be mitigated or resolved through Zero Trust initiatives. Odds are, your organization has encountered some of these risks already. Other risks may already be on your radar. Identify each risk, assign a level to them (critical, not critical, etc), and make a checklist.
Once you have your list of threats, compare it to the company’s business objectives. Will these objectives be improved by taking a modern cybersecurity approach? Matching security risks to business goals and objectives will give you a way to identify where to start and help guide your implementation roadmap from an order of importance standpoint.
To understand weaknesses in security policies – and to better leverage Zero Trust concepts to strengthen them – you must first evaluate your current IT security setup. This includes policies and procedures, user access, third-party and vendor software access, hardware, and networking and cloud technology. As with risks, key in on pivotal areas where a Zero Trust stance can make the biggest impact first and incorporate that information into your roadmap. Be sure to highlight this information when seeking stakeholder buy-in as well.
Learn about the latest ransomware attacks and trends based on expert analysis of malicious data leak sites & discoveries from the world’s largest security cloud. Findings and insights include:
Creating a map of network assets will help you understand the underlying security architecture better and make implementing a Zero Trust architecture much easier. This map should include details on your user base, the devices that connect to your network, any vendors with access, apps, and services. Software, cloud assets, and hardware should also be part of this network map.
Make notes of any legacy technology that could have known exploits and any devices that have Internet connectivity. Go through each device’s security configurations and settings to see if they are configured properly and up-to-date. Adjust as needed.
Part of implementing Zero Trust initiatives involves training up not just stakeholders and employees to ensure they are following security best practices, but it can also revolve around ensuring current security and networking teams are trained as well. Include this process into your implementation roadmap and be sure to budget accordingly.
Consider too, the cost, resources, and time it takes to train up existing staff and weigh this versus hiring a consultant or using a managed security service provider. Platforms like the Zscaler Zero Trust Exchange can help reduce initial investment, training costs, and needing to add additional resources, as they are already built upon a proxy architecture with Zero Trust implementation.
Being able to properly convey the key benefits of Zero Trust security measures can make it easier to get stakeholders to agree to implementation. In particular, you will want to highlight the following advantages of Zero Trust:
