Zero Trust

SPOTLIGHT
Sponsored by: Akamai
As IT buyers look to adopt zero trust, they must also keep business and technical
considerations in mind.
Key Zero Trust Considerations:

Adapting Security Strategy to
Enterprise Business Requirements
October 2022
Written by: Christopher Rodriguez, Research Director, Security and Trust
Introduction AT A GLANCE
Cyberthreats have become more aggressive in recent years as advanced
persistent threats (APTs) elude detection through stealth and ransomware KEY STATS
attacks maximize damages through speed. Devastating data theft IDC research found that 38.7% of
organizations in all industries are expecting
campaigns, costly cyber extortion, and hidden zero-day exploits represent
to increase cyberdefense capabilities
a looming sword of Damocles for wary CISOs. following the Russia-Ukraine War (IDC's
Future Enterprise Resiliency and Spending
Unsurprisingly, the elevated level of risk is driving urgency to rethink and Survey, Wave 3, April 2022, n = 828).
realign security. Zero trust is one framework of security principles and The number jumps to 50.2% for the financial
practices that aim to adapt security to the modern threat landscape. industry and 50% for transportation and
Zero trust has emerged as a critical strategy for enterprises, federal logistics.
government agencies, and other organizations seeking to modernize their
security architecture.
Businesses must navigate this threat landscape while managing a high rate of technological change and growing user
expectations. Cloud environments and cloud-native technologies are expanding the attack surface and introducing new
security requirements. Similarly, the growing prevalence of remote and hybrid work challenges existing security practices.
Early approaches to security adaptation have proven to be incompatible or insufficient.
As a result, security transformation is a business imperative, enabling organizations to adopt valuable new technologies
while minimizing risk of a catastrophic data breach. But nobody expects the security modernization process to be easy —
nor should they. As IT buyers look to adopt zero trust, they must also keep business and technical considerations in mind.
SPOTLIGHT Key Zero Trust Considerations: Adapting Security Strategy to Enterprise Business Requirements
Definitions
» Zero trust: "A collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least
privilege per-request access decisions in information systems and services in the face of a network viewed as
compromised," according to the National Institute of Standards and Technology (NIST)
» Subjects: Primarily human end users such as employees, partners, or contractors; also, devices, applications, or
other non-human systems depending on the context
» Resources: Anything of value, but typically specified as applications, data, and workloads
» Zero trust network access (ZTNA): Enables access to specific resources based on user identity under
well-defined, controlled conditions in line with zero trust principles
» Microsegmentation: A zero-trust-based security technology to enforce granular access control, monitoring, and
visibility at a workload level
Benefits for the Zero Trust Adopter

Zero trust principles, controls, and best practices are designed to modernize security architecture in response to new
technologies and modern threats. Zero trust offers both business and security benefits for enterprises.
Zero Trust Security Improvements

Zero trust strategy has gained momentum as the proper way to implement security in the modern digital transformation
era. It offers the following improvements over existing security architecture:
» Granular policy enforcement. Zero trust strategy enables creation of fine-grained policies to enforce least privilege
access, allowing a user to access only specific resources required per given session. This eliminates the excessive
permissions provided by legacy controls that considered local users to be "trusted" with full network access and
granted remote users a similar level of access via VPN connection. Granularity of policy also applies workload to
workload, where the ability to write rules on port, process, and services for allowable communications between
assets is required. By comparison, broad policies and excessive permissions greatly increase the potential for data
theft from insider threats or compromised accounts.
» Contextual risk-based control. Zero trust strategy requires security practices that account for contextual risk
factors, including environmental and temporal factors such as identity, role, group, device type/device security
posture, time of day, or location. Controlling access dynamically, based on contextual factors, is important to
minimize risk. For example, if the security posture of a user's device is not compliant, then the IT organization can
limit access to applications in read-only mode or remove access completely.
» Continuous monitoring. While contextual risk-based controls and granular policies are important foundations for
improving organizational security posture, zero trust also requires continuous monitoring because of the risk of insider
threats, account compromise, and vulnerabilities exploitations. In some cases, these risks overlap, such as in the case
of the LAPSUS$ group that is known to bribe employees for credentials or to answer MFA prompts. Behavior-based
detection is necessary to disrupt insider threats and APTs early in the kill chain to mitigate damages.
#US49728722 Page 2

Zero Trust

Uploaded by

Copyright:

Available Formats

Zero Trust

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Zero Trust

Uploaded by

Copyright:

Available Formats

SPOTLIGHT

Sponsored by: Akamai

Key Zero Trust Considerations:

Written by: Christopher Rodriguez, Research Director, Security and Trust

Benefits for the Zero Trust Adopter

Zero Trust Security Improvements

You might also like