RX Patient Tools
Use these quick guides before reading the article, or return to them when you need help preparing questions for a doctor.
The rules for corporate cyber security have evolved over the years, as new attacks pose greater threats to the networks and infrastructures companies work so hard to protect. The traditional model centered on a “castle and moat” philosophy, with an assumption that anyone inside a network was not a threat, but those outside certainly could be. Unfortunately, even trusted users inside can become a threat if compromised.
Zero-Trust Changes the Rules
The more effective modern framework doesn’t put the perimeter at the focus of the discussion. In zero-trust security, users are granted access not based on their location (such as at the office or at home), but rather based on their role and identity, and authentication occurs on a continual basis, rather than just at the network perimeter. Zero trust restricts unnecessary lateral movement between service, systems and applications, with the thinking that any user’s identity could be compromised. By limiting who has privileged access to data assets reduces the threats from bad actors.
According to a Gartner study, zero-trust network access is the fastest-growing segment in network security, and it is expected to grow 31 percent in 2023, up from 10 percent in 2021. The group says 70 percent of new remote access deployments for corporate environments in 2025 will have transitioned to zero-trust from virtual private networks (VPNs). VPNs were found to be less secure by IT professionals, more easily breached, and less efficient with network bandwidth.
Zero-Trust Security Best Practices
Zero-trust security is designed (to a great extent) to prevent malicious activity in the network. Network managers can rely on a few best practices as they build out their zero-trust protocol:
Deploy Micro-Segmentation
A zero-trust framework most commonly relies on micro-segmentation to enable the IT organization to wall off network resources in specific zones. Doing so helps contain potential threats within the silos and prevents them from spreading laterally throughout the network infrastructure. Micro-segmentation allows administrators to apply granular role-based access policies, particularly those that content the most sensitive systems.
Limit Long-term Access
As hackers and other bad actors easily adapt to the nuances of a digital ecosystem, it is important to ensure that user access is limited with a permissions and validations based on each individual request, rather than allowing long-term access to a network and its resources.
Identify Anomalies
Organizations should continually manage and trace access requests to understand where they originate and where they exit. Identifying patterns can help surface abnormalities that could indicate bad actor intent.
Think Beyond Bad Actors
Today’s networks are inherently expansive, and IT organizations are charged with allowing an increasing number of people and devices to connect with it. The bottom line: we trust far too much. Sharing information and assets with so many can be a positive thing, of course, but it is also a failing for cyber policy when too many have access to too much. The zero-trust model allows for better monitoring of corporate resources and assets that are accessed (legitimately) by employees, customers, and partners from a huge range of devices and locations.
Benefits of Zero-Trust Security
The zero-trust model offers a range of benefits for IT and cyber security professionals.
-
Addresses Threats From Anywhere
If you put too much emphasis on the boundary of your network, it’s difficult to detect a breach if the first line of defense is compromised. In zero-trust, every activity from a user or a device is subject to the same stringent access policy. Even though users don’t see it, verifying every attempt to access data assets strengthens ongoing security.
-
Adapts to Hybrid Work Models
Particularly since the pandemic changed where people work, companies have had to create hybrid office/remote access policies. Zero trust allows for remote access authentication and enables organizations to extend zero-trust corporate network access policies to the remote world.
-
Enables Better Organizational Collaboration
Zero trust gives more users access to data and applications to they can collaborate more effectively from group to group. IT can grant access to specific data assets across organizational boundaries with the confidence that only the intended audiences are viewing the documents and content that they are authorized to see. And it enhances a user’s ability to get a richer picture of what’s happening in a business and IT environment by having unfettered access to more devices, data, and content.
Training for Zero-Trust
Setting up a zero-trust security framework doesn’t have to be uber-complicated. Network security professionals can rely on various certifications such as the Certified Information Systems Security Professional (CISSP) to learn how to design and deploy modern IT architectures, and Certified Information Security Manager (CISM) to learn how to match IT security goals with corporate and strategic objectives. Both are great starts to building better access enforcement with zero-trust approaches.
