Widespread remote-working has forced many Zero Trust policies to be re-evaluated. Can organizations tweak zero trust to stay productive yet secure?

Instituting Zero Trust represents an attainable step forward for many organizations, especially if they have yet to take any precautions of this sort.

In today’s threat environment, Zero Trust is a key stepping-stone for organizations to improve their cybersecurity. However, if they are to maintain their place amidst a cybersecurity landscape and IT needs that are ever-changing, organizations must move towards True Zero Trust, especially in the post-WFH environment.

While the term “zero trust” is something almost everyone is familiar with, many organizations have yet to make it a part of their cybersecurity posture. With the current rush to under digital transformation, many organizations without this cybersecurity posture may be exposed to risks directly related to the rush to digitalize, given that different cloud providers use different security controls.

Opportunistic cyberattacks

Between January 2020 and April 2020, McAfee observed a 600% increase in the usage of cloud collaboration services in its customer base. Amid this increasingly complex landscape, cyberattacks continued to increase.

With attacks targeting cloud services soaring, attackers are quickly turning any advantage they can use into a significant risk for enterprises. The overall global scale of these attacks is also continuing to escalate, with nation-state and organized crime actors making substantial investments in these cyberattacks, as the rewards are considerable if enterprises can be breached.

In an organization without Zero Trust, once attackers have broken into its networks, they attain “trusted” status, meaning that they can move largely unfettered to reach valuable data.

The meaning of True Zero Trust

The Zero Trust concept was initially designed to focus on networks. In today’s environment, we must think beyond networks, and think about all facets of companies’ threat profiles.

However, since many organizations are still playing catch-up to implement Zero Trust in the first place, they may be missing the mark by not considering True Zero Trust.

True Zero Trust insists that data is the starting point for all trust decisions. This means that we do not think of things from a ‘user’ or ‘end device’ perspective exclusively.

Rather than thinking about restricting access based on who your users are, or simply barricading sensitive data behind passwords, True Zero Trust starts by thinking of everything you must protect: critical assets, applications, data, and services. You must now micro-segment your data in order to decide who needs access to what data, and how to restrict that access.

Remember, this is a starting point: improvements must be constant and iterative to maintain the security of your data.

True Zero Trust also entails striving for real-time visibility, so that we can have a complete and updated picture of the data, so that if anything goes wrong, we can make necessary adjustments in short order.

Zero Trust must evolve for the cloud

The expanded vision for True Zero Trust also considers something many enterprises face today: users, the devices they use, and the applications that support them—are now widely distributed across the world.

Furthermore, the use of personal devices from remote locations to access secure applications is a new normal that would have been prevented by zero trust systems. A True Zero Trust system must necessarily be extend to secure this new scenario. It is insufficient to address your on-premises activity, but maintain weaker security in support of cloud and teleworker initiatives.

True Zero Trust is also flexible. Sometimes users will be doing necessary work through what may be considered untrusted devices, and your cybersecurity posture will need enough dynamism to allow this while maintaining the appropriate level of security.

Finally, True Zero Trust should be an end-to-end solution for users. It will touch your data, validate identity, segment networks, and much more. It must integrate end-to-end with tools to enforce your policies and remediate threats across your entire security ecosystem.

Cyber threats continuing to grow

While organizations may still be playing catch-up, increasing digitalization means more opportunities for cyber attackers to seek out the weakest points in the ever-expanding threat surfaces.

In this new landscape, one of the most important questions is: As an organization’s data proliferates, who is handling it? True Zero Trust focuses on answering that question before access is granted and monitored continually.

Just as Zero Trust was an iterative shift in organizations’ approaches to cybersecurity, making the shift to True Zero Trust will be critical. However, even more importantly, organizations must continue to make improvements in their all-round cybersecurity posture.