Zero Trust Security in the Face of Today’s Threat Landscape

What is zero trust?  

Zero trust is a security framework that requires all users to be authorized and continuously validated before being granted access to an organization’s network and its assets. Unlike traditional security models, a zero trust architecture removes implicit trust and does not allow in-network users free access to all data within the network. When implicit trust is removed, every access point must be assessed and verified, increasing resilience.  

The zero trust approach: 

• Secures access across applications and networks and encrypts assets 
• Extends trust when necessary to support modern enterprises across the distributed networks 
• Establishes trust at every access request regardless of where it comes from 

How does zero trust work? 

In a zero trust model, an organization identifies its most valuable assets in its network and prioritizes security around it. An effective zero trust approach secures all access across your applications and environment, from any user, device, and location, by: 

Establishing trust 

The founding principle “never trust, always verify,” means at every point of access, all users and applications are considered hostile until trust is established on three fronts.  

User and device identity. The right mechanisms and processes ensure that only authorized users access your resources. Regardless of location, users and their devices are verified through secure processes like multi-factor authentication.  

Device integrity. A device could be free of vulns one day and contract malware the next. Effective zero trust security identifies risky devices and can either enforce context-based access policies, or block compromised devices.  

Access policy. Enterprises set and enforce user, data, and application access requirement policies based on their risk tolerance level. 

Enforcing minimal access 

Zero trust also employs the principle of least privilege (POLP). This means users, devices, and applications are only allowed bare-minimum access needed for their roles, restricting any lateral movement. Micro-segmenting sensitive resources establish perimeters around assets, allowing for total traffic control within and between segments based on access policies.  

That means even if an attacker managed to breach your network or cloud through a vulnerability, they would not be able to access your data. The zero trust micro-segmentation approach provides superior visibility and control compared to over-privileged access in traditional frameworks.  

Monitoring continuously 

One-time verification doesn’t cut it anymore as threats and user attributes are constantly changing. In a zero trust model, organizations continuously verify that a user and their device are trustworthy.  

Continuous authentication doesn’t have to mean a low-friction workflow for frustrated users. Workloads that communicate with one another like applications running in the cloud and data centers can support these frequent checks. Zero trust policies require real-time visibility to a number of factors to grant access, including but not limited to: 

• User type (human, software) 
• Dynamic device behavior 
• Endpoint hardware type 
• Firmware and OS versions 
• Risk assessments and incident detections 

Users and applications require constant monitoring because trust is not permanent. Just as zero trust networks continuously verify trust, they require organizations to regularly reassess their own trust policies. Effective zero trust organizations monitor their security environment and evolve their policies as applications, attacks, and the enterprise as a whole evolves too.  

Why is zero trust so pertinent now? 

The last two years of soaring connectivity accelerated the pace of change on the cyber front. With the surge of remote and hybrid work, home devices used for work purposes ballooned attack surfaces and sparked an increase in cyber attacks for 90% of organizations. 

As 13.1 billion connected devices are predicted by the end of the year, it’s clear our world is more connected–and more vulnerable–than ever. From ransomware attacks on tech companies to major healthcare facilities, threats are increasing in number. And so are their severity. The stakes are no longer just contained to your most valuable data, but potentially include human lives. Gartner analysts predict that by 2025, threat actors will have weaponized operational technology environments enough to result in human casualties.  

But the widespread lack of preparedness is nearly as sobering. Despite an uptick in cyber training during the pandemic, a study of 1,200 employees showed only 4 out of ten were able to pass a cyber hygiene assessment. Yet 74% of those who answered all questions incorrectly reported they felt safe from cyber threats. People are fallible, and it’s no wonder 95% of cybersecurity issues can be traced to human error.  

What are the benefits of zero trust? 

No security strategy is perfect, but zero trust is one of today’s most effective. With zero trust, you can: 

• Gain visibility. Zero trust allows IT teams to maintain visibility across users, devices, applications, and more with verification at every access request, improving security resilience. 
• Reduce risk in real-time. To create the most accurate response to risk, the zero trust approach requires continuous monitoring of behavioral data for anomalies. If outliers emerge, trust is either removed or changed to protect assets. 
• Manage hybrid and remote work environments. Nearly six in ten American employees are able to work from home at least once a week. Zero trust extends security from the enterprise perimeter to verified users, regardless of location, what endpoints they are using, or whether applications are on-site or in the cloud. 
• Defend against attacks. Least privilege access helps to reign in your expanding attack surface and mitigates chances of ransomware, malware, and phishing attacks. No enterprise is totally safe, but the network at large can be protected with the right micro-segmentation of encrypted assets and automated response systems in place. 
• Implement with existing architecture. A zero trust approach doesn’t require a complete renovation of your infrastructure or booting existing investments. Effective solutions can and should fluidly integrate into a complex and layered environment. 

How do I get started with zero trust? 

With increasing stakes and fallible systems, what can you do to strengthen your security? Trust no one. In today’s threat landscape, we can no longer assume that internal or known entities are trustworthy or that one-time verification is enough. That’s one of the reasons why 60% of organizations are on track to adopt a zero trust policy by 2025. Only half will actualize the full benefits of a zero trust framework–and you want to be in that half. 

Cisco Zero Trust is a comprehensive approach to securing all access across your applications and environment, from any user, device, and location. This complete zero trust security model allows you to mitigate, detect, and respond to risks across your workforce, workloads, and workplace. As an effective, open solution should, it integrates tightly with a suite of other products to provide complete zero trust security for any enterprise environment. 

Learn more about how Cisco Zero Trust Security’s comprehensive solution makes your environment Cisco Secure.

This blog was originally written for Kenna Security, which has been acquired by Cisco Systems. Learn more about Cisco Vulnerability Management.