Zero Trust

Zero Trust is the concept that no one and no thing, (whether that be a network, user, device, application, server etc) has access to perform an action until proven they should be trusted. In order to prove it, the entity must take as much context into account before making any trust decision. It combines this with the ethos of providing the same, consistent level of security, control, and visibility both outside and inside the perimeter equally. This allows users, devices, networks, and other assets to be secure anywhere.

Zero Trust involves always authenticating and authorising the use of all available data/context, such as the connecting user/resource identity, location, device health, and anomalies. This should be done consistently regardless of whether the asset/user is inside or outside the perimeter. It also requires architecting systems so that they can provide adequate context to the entity or policy engine expected to make the trust decision. Lastly, it removes the assumption-based trust model, where we place inherent trust in singular points of context i.e. source IP ranges since they could be breached at any time.

This is a common misconception. When we think of granting access, we often think of the network, because it gates access to many assets. To be clear: the network access controls are a big part of a Zero Trust strategy, but the concept goes much further than that. A trust decision is more than just network access, other considerations need to be made when considering how and when to grant trust. For example, when people click on an email, action a phone call request, allowing certain data to be uploaded to certain cloud applications, or granting access for an application to run on your endpoints. This is why we have The Eight Pillars of Zero Trust in our framework, so no stone goes unturned.

Once again, identities are a huge part of a Zero Trust strategy, but there are many other areas to implement Zero Trust principles across The Eight Pillars of Zero Trust.

Traditional security, which focused on protecting an organisation’s perimeter, which meant placing trust in devices inside the network and having full control over all data flows, has grown less effective as the technology landscape has changed. In today’s modern world, we see a rise in remote work, portable devices, collaboration with third parties, cloud application (SaaS) usage, cloud infrastructure, and a technologically savvy workforce. This means data now flows across many external networks, cloud services, and endpoint devices, often in locations outside of traditional security’s corporate controls. To account for this increased attack surface, an organisation's security architecture design should move to a Zero Trust model.

Yes and no. The pitfalls of VPNs are often a result of the way that they have been set up inside an organisation. In many organisations, the VPN allows a large amount of access to organisational assets and the network once an employee connects. This is a dream for an attacker because it means all they have to do is compromise one user’s account or device to get unfettered access to an organisation, which can cause astronomical harm. This isn’t due to laziness or a lack of knowledge in the organisation, but more how difficult is it to set up a VPN with the level of granularity necessary to have adequate risk mitigation.

To account for this, Zero Trust Network Access (ZTNA) is a relatively new technology predicted by many experts to be a more viable alternative to VPN for large-scale cloud networks. ZTNA works by using identity to grant extremely granular network access dynamically based on layers of context such as MFA, device security posture and more. This removes a huge burden from the network and cyber security team as the policy can leverage existing things like role-based access control groups (for example Okta, Active Directory, etc) without creating thousands of VPN profiles. It also works more effectively in cloud contexts than VPNs because it doesn’t require a heavy hardware footprint, unlike VPNs that require firewalls. This is one of the key areas where Zero Trust can actually provide security, ease administrative burden and create a better user experience simultaneously.

Sekuro looks at Zero Trust as a holistic solution, using the principles to augment a modern cyber security program. It does this while having a very business-centric mindset. Not only do we provide a large security uplift, but we also help your organisation use Zero Trust for other benefits, such as using all this additional context to allow you to say “yes” to the business more often, without the added risk. This takes your security program from the oppressor to the protector. We also have four strict rules in all of our controls and recommendations: Clear, Realistic, Beneficial and Actionable. No high-level unclear goals, no pipe dreams , just beneficial and actionable recommendations you can begin implementing immediately.

Yes, identity is the second pillar in Sekuro’s Zero Trust Strategy. Identity and access management (IDAM) solutions are critical for cloud security, ensuring that your users, assets, and data interactions are frictionless and secure. Sekuro’s IDAM solutions deliver a host of benefits, including SSO, MFA, and user lifecycle management.

This highly depends on what your board values. Some may consider customer trust and reputation the highest priority, others may consider it to be operational impact and cost (and many consider both equally important!). Sekuro can help you gain buy-in from your executive audience as part of building a Zero Trust Strategy service, but these statistics below are also helpful:

Cost Impact: In its 2022 data breach report, IBM published:“Organisations with zero trust deployed saved nearly USD 1 million in average breach costs compared to organisations without zero trust deployed.The difference was USD 0.95 million, representing a 20.5% savings for organisations with zero trust deployed.”

Reputational Impact: Bitdefender’s research showed that “83% of consumers in the US claim they will stop spending at a business for several months immediately after a security breach. 21% will never return to that business.”

Stock Price Impact: Istari Global’s research indicates that “a cyberattack can sink a company’s share price. When Capital One disclosed that they suffered a data breach, its share price immediately dropped nearly 6% in after-hours trading. In the two weeks that followed, the share price plummeted by nearly 14%. This story isn’t unique. Equifax’s share price fell by 60% in the wake of their cyber breach in 2017.”

NOTE: Depending on an organisation’s response, their stock has shown to be able to recover over time.

Director/Executive Culpability: Directors and executives can be held personally liable for data breaches. Uber suffered a data breach in 2016 that wasn’t disclosed by an executive and the individual was “sentenced to a three-year term of probation and ordered to pay a fine of $US50,000 ($93,663)”

Sekuro’s Zero Trust Strategy has been tailored to both compliment compliance frameworks and extensively cover areas that popular frameworks do not. ISO27001 is a framework for establishing a management system to govern your security risks and controls. By design, it provides high-level controls and control areas allowing organisations to use more prescriptive control frameworks like NIST or ISM. In order to be used broadly, these frameworks contain good but mostly high-level recommendations that often lead to organisations spending large amounts of time trying to translate these recommendations into actionable programs of work suited to them.

Our Sekuro Zero Trust Strategy and assessment dives deep, past the design effectiveness and into the actual operational effectiveness of your technical controls to provide a tailored strategy supported by clear, realistic, beneficial and actionable recommendations. Zero Trust aligns with any existing framework as an assurance tool to provide you with a very truthful and factual view of your security posture and of the initiatives required to get to the level of resilience that is right for your organisation. In short, ifyou partner with Sekuro on Zero Trust, you can rest assured you'll know what you have to do, why you have to do it, when you should do it, and the steps required to get there.