From acronyms to action: Demystifying Zero Trust
Zero Trust: it's one of those terms that has been floating around for what seems like forever. Yet, despite its long tenure, there's a certain mystique surrounding it, an enigma that's been further complicated by a slew of acronyms that have been tossed into the mix - SSE, SASE, SWG, ZTNA, CASB, RBI - the list seems endless.
Enterprises, caught in the middle of the storm, are left in a whirl of confusion as an ocean of vendors each touts their own Zero Trust product as the definitive solution to all security woes. But, as every pundit and their dog will tell you, implementing Zero Trust isn't as simple as buying a product off the shelf. It's more of a philosophy. But alas, philosophies are tricky for businesses to deploy, and eventually, companies need some technology or a solution to make things real. And this is exactly where the confusion most often sets in.
Securing the user
Let's peel back the layers of Zero Trust and move from the esoteric to the tangible. We’ll zone in on where Zero Trust really makes its mark: safeguarding the user. Historically network users had nearly unfettered access to enterprise resources, save perhaps a username and password challenge. This can become a serious problem when a user's credentials or device is compromised by a hacker. Ideally, we’d have something in place to protect the user and their device without creating a burden that compromises productivity. It's been said that Zero Trust is like invisible bubble wrap for users. It’s a strange analogy, but one that strikes at the core of what Zero Trust is about - marrying enhanced security with a seamless user experience.
This brings us to the VPN, the oft-bemoaned step-child of cyber security. With its clunky, unwieldy nature, it's an echo of the dial-up Internet age, only without the modem tones. Launch your VPN client, enter your credentials, wait for the connection, navigate the Labyrinthine company intranet, then disconnect to return to the regular Internet. It's a well-rehearsed dance, the VPN tango.
The advent of remote work forced VPNs into the limelight, and the cracks started to show. Traditional corporate apps were being benched in favor of SaaS alternatives, leaving VPNs in a frenzied scramble to keep up. The result? Connection bottlenecks and slowdowns and even connectivity failures. VPNs are often secured by a login-password challenge and then provide the same network access typically granted to on-premises users.
The outcome is clear. VPNs are overly broad, disrupt the user experience, grapple with cloud integration, and stumble when it comes to scalability and ubiquitous access. Throw in the threat of a DDoS attack targeting the fragile VPN infrastructure and you've got a disaster waiting to happen.
Enter the new era. The "work from anywhere" era. The explosive growth of cloud-based applications, remote users, and personal devices calls for a total revamp of the network perimeter security model. The old guard, the appliance-based VPN solutions, just can't keep pace. Enter stage left, Zero Trust Network Access (ZTNA).
The Zero Trust philosophy in action
The philosophy behind Zero Trust is rooted in a simple principle: never trust, always verify. ZTNA embodies this ethos, providing direct, granular, context-aware access to resources sans overly-broad network access. It's a game-changer, offering a superior user experience, robust security, visibility, and scalability. It's the answer for today's hybrid workforce.
But wait, the Zero Trust philosophy isn't just about remote access. Of course not. Zero Trust principles extend to the Internet browser with Secure Web Gateways (SWG) and Remote Browser Isolation (RBI). And let's not forget about email. Over 90% of all cyberattacks start with a phishing email. I’ve come to believe the ‘never trust, always verify’ philosophy should extend to the email inbox with email phishing protection.
Defending end users is paramount, but protecting important company data is also critical. CASB and DLP are also part of the Zero Trust universe, helping to thwart data leaks. In an age of AI and chatbots, this is more pertinent than ever. Establishing, enforcing, and monitoring policies on how and where data moves in your network is a big part of Zero Trust too. And as companies reengineer their networks with software-defined security architectures, the relevance of the Zero Trust model only grows.
If Zero Trust is the promised panacea, why isn't everyone on board? If we were building from the ground up today, Zero Trust would be the unequivocal choice. We'd select a Zero Trust platform, link up the IDP of choice, and promptly start provisioning users with ZTNA and the rest of the arsenal. But transitions aren't instantaneous. Often, it's because network and security teams aren't in sync. At other times, it’s the sizable investment already sunk into the current VPN infrastructure that stalls the shift. There may even be a resource crunch to execute the change. But let's be clear, these are explanations, not justifications.
We know the threats to security are not only real, they are escalating. The user is exposed and they’re grappling with the constant dread of inadvertently triggering a cyber attack with a misjudged email click. Instead of blaming the user, it should be incumbent on us as security leaders to protect our users. The Zero Trust model, with its principles of 'never trust, always verify', offers an efficient and adaptable strategy that addresses the shortcomings of traditional VPNs and network-based security. And the simplest way to adopt Zero Trust is via a single platform instead of cobbling together point solutions from multiple vendors. Embracing Zero Trust, with its layered protection for both end users and data, doesn’t need to be complicated. But in an era of remote work, SaaS, and AI, adopting Zero Trust isn't just a strategic choice—it's a necessity.
Foundation for trust
Embracing the Zero Trust model represents a crucial paradigm shift in the ever-evolving cyber security landscape. By acknowledging that traditional perimeter-based defenses are no longer sufficient, organizations can reap numerous benefits, including heightened data protection, reduced attack surfaces, and enhanced resilience against sophisticated threats. Embracing Zero Trust is not just a technological choice; it is a strategic imperative that empowers organizations to safeguard their critical assets and build a foundation for trust in an otherwise uncertain world.
Cloudflare enables organizations to implement Zero Trust with a combined security and network-as-a-service (SASE) offering that delivers security, performance, and reliability in one complete package. Leveraging the global reach of the Cloudflare network, Cloudflare offers fast and reliable Internet connections, no matter where your employees are located. With Zero Trust security applied to every access request, all traffic is authenticated and protects your employees and data from threats. With Cloudflare Zero Trust, you can prevent unwanted access, mitigate data loss, and take control of everything through one unified interface. No matter where you are in your digital transformation journey, you're covered.
This article is part of a series on the latest trends and topics impacting today’s technology decision-makers.
Author
John Engates — @jengates
Field CTO, Cloudflare
Key takeaways
After reading this article you will be able to understand:
Requirements for safeguarding users and data have changed
Zero Trust enables comprehensive protection
How to build a foundation of trust and take control