What is Zero Trust and Why Should I Care?

What is Zero Trust?

Zero Trust seems to be everywhere at the moment, in fact our CTO recently wrote about the importance of Zero Trust as a defence against cyber crime in Northern Insight. But what is ‘Zero Trust’ and why the hype?

Most frequently credited to John Kindervag’s 2009 research for Forrester, the Zero Trust cybersecurity model promotes a ‘verification always’ ethos. Since its original conception, many technological leaders, from Microsoft to the National Cyber Security Centre, have cultivated individual variations of the Zero Trust model. However, these models always promote verification over trust, staying true to the heart of the Zero Trust concept.

Microsoft’s Zero Trust Model operates under three key principles: verify explicitly, use least privileged access, and assume breach. Their business plan promotes starting small, taking simple but proactive steps to improve your cyber security across a multiyear plan, keeping security improvements affordable and achievable. The end goal can be customised to suit your needs dependent on your organisation’s goals and risk level, but ultimately the steps will work to build a solution that always authenticates, authorises, and encrypts to ensure secure cloud working.

Zero Trust is often broken down into close variations of 5 key areas: users, applications, data, networks, and devices. By ensuring each of these areas is suitably secured, businesses can cultivate a robust, end-to-end security solution.

Zero Trust: Broken Down

Users: People are the heart of any business, but it is vital to ensure that you can verify, monitor, and control the users accessing your sensitive data, reducing the threat posed to its security.

Some processes and tools to improve user security include:

- Elevated privilege review
- Joiners, movers, and leavers (JML) process review
- Multi-Factor Authentication
- Identity management
- Token Based Identification (Passwordless)
- Role Based Access

Applications: Applications can empower users to work smarter. However, it is important to ensure that appropriate in-app permissions are in place and that the applications used within business processes can be monitored.

Some processes and tools to improve application security include:

- Cloud App security
- Security Information and Event Management (SEIM)
- Application Patch Management
- Server Hardening
- Conditional Access Policies

Data: Data is king. It powers our processes, fuels our insights, and allows us to work more intelligently. But data also comes with great responsibility. Organisations must protect their sensitive data to maintain credibility and relationships grounded in trust, and to avoid any non-compliancy fines. Zero Trust encourages a move towards perimeter-less, data-driven protection with data classification, encryption, and restricted access in place.

Some processes and tools to improve data security include:

- Data Loss Prevention
- Data Encryption – in transit/at rest
- External SaaS Data Backup
- Policy Reviews
- File Integrity Monitoring
- Asset Classification

Networks: In keeping with Zero Trust’s emphasis on verification first, it is important for businesses to ensure that any users and devices on internal networks are still authenticated.

Some processes and tools to improve network security include:

- Configuration Management
- Asset Visibility
- Network Monitoring
- Firewall Reviews
- Firmware Patching
- Policy Based Networking
- Network Segmentation (VLANs)

Devices: With users working on the go and from a variety of devices, it is vital to ensure that this flexible working is supported yet secure. By unifying endpoint and device management, businesses can protect data and ensure device compliance, whilst still facilitating modern working styles.

Some processes and tools to improve device security include:

- Endpoint Security
- Asset Management
- Device Encryption
- Mobile Device Compliance, Protection & App controls
- Bring Your Own Device (BYOD)/Mobile policy
- Endpoint Detection and Response (EDR)

Why should you care?

Prevalence of threats

With the prevalence, sophistication, and cost of cybercrime on the rise, organisations need to have a robust and sophisticated cyber security solution in place. In 2020, FireEye reported that 51% of organisations felt they were ill-equipped to respond to a cyber attack. And with IBM reporting that 70% of organisations believed that remote work would increase the cost of a data breach, those ill-equipped could find themselves with serious issues to deal with. Zero Trust offers a simple, structured, and affordable way for organisations to protect themselves from these ever prevalent cyberthreats.

Rise in mobile, remote, and hybrid working

With cloud working operating as the foundation from which many innovate technologies are being built, businesses need to know how to keep their cloud-stored data secure and what their responsibilities are. Cloud working can support more flexible working styles, such as working on the go, reporting onsite, remote working from home, and hybrid working, empowering users to work in a style that best suits their needs. As these flexible working styles become expectations for the new generation of workers, businesses need to invest in a security solution that will allow them to securely provide this.
Read more about cloud-provider responsibilities versus business responsibilities here.

Advantages of Zero Trust

It is easy for security solutions providers to rave about the importance of cyber security (and understandably so), however, the reality for many organisations is that limitations on budget, time, or expertise make the realities of implementing a solution difficult. This is why businesses should care about Zero Trust. Zero Trust can operate on an iterative, staged, long-term process, allowing you to set goals that feel affordable and realistic and work to your budget and time-scale. Additionally, with the support of an MSP (Managed Service Provider), like Synergi, expert hands are always there to inform, assist, and guide you.

So, despite being a part of security dialogue for over a decade, Zero Trust is now receiving great attention, likely due to the recent rise in accessibility of security tools for SMEs. Zero Trust models promote a mentality in which no access requests are trusted, all are verified, authorised, and encrypted. As a Microsoft Gold Partner and trusted MSP, Synergi can help organisations build and execute a Zero Trust businesses plan that suits their unique needs and budget.

To find out more get in touch by calling 0191 4770365, emailing enquiries@teamsynergi.co.uk or completing the form below.