Current state of Zero Trust
How remote work has accelerated network security
The global pandemic has drastically and unexpectedly accelerated the need for a new network security model. Zero Trust security is hardly new, but it has taken center stage — and security leaders agree it will improve security and simplify security processes for distributed teams and hybrid networks.
However, rolling the model out has proven to be complicated, presenting organizations with a mixed bag of successes and obstacles.
A widespread move to remote work — and the corresponding need for better remote workforce security — has spurred investment in Zero Trust security. The ability to authenticate and monitor all traffic, regardless of its position inside or outside of a corporate network, promises to reduce or eliminate many security risks.
But many organizations find it complicated to implement a Zero Trust security approach. One key reason is that Zero Trust adoption is a logistical challenge, not just a technical one. Security modernization often depends on the progress of user identity consolidation and cloud transformation — both complex, long-term projects.
So what is the current state of Zero Trust adoption? And what challenges have organizations faced along the way?
To answer these questions, during the 2020 pandemic, Forrester Consulting conducted a study on behalf of Cloudflare. The survey reached over 300 global security leaders, and polled respondents on their organizations’ successes and challenges with these changes. The study identified:
The top business and technology trends driving Zero Trust adoption
The most popular planned use cases for Zero Trust security
Common obstacles in Zero Trust adoption
The top external trends impacting corporate IT: Remote work, data breaches, and VPN
The dramatic shift to remote work brought changes no business was prepared for. Fifty-two percent of security leaders surveyed identified remote work as one of the top factors impacting their IT security programs.
Amidst the pandemic, the survey also identified a rise in security incidents related to corporate networks and confidential data. Fifty-five percent of security leaders reported that their organization experienced an increase in phishing attacks this year. Additionally, 58% of security leaders said their organization experienced a data breach of some kind.
Simply staying connected was a challenge, as well. Many security teams found that their out-dated VPN platforms could not handle all the traffic of remote employees, with 46% reporting latency issues due to increased VPN usage.
A Zero Trust security framework is a natural answer to these growing risks because it accomplishes the following:
Stops phishing attacks by putting additional identity verification measures in front of every application.
Prevents attackers who do gain access to one application or service from getting carte blanche access to the entire internal network.
Removes the need for VPNs, because identity verification is required to access individual applications.
Zero Trust use cases: Organizations look ahead to a variety of benefits
Zero Trust provides benefits beyond network security. It also simplifies access processes and allows employees to work from a wider variety of locations and devices, which both increases productivity and improves the employee experience.
Our survey findings reflect this variety. When we asked security leaders about their high-priority Zero Trust use cases, a wide-ranging use case came out on top: gaining visibility into cloud workloads, which was selected by 87% of respondents. It’s not hard to imagine why — understanding how employees use the cloud helps the organization make smarter cloud investments, in addition to giving the ability to monitor and secure data wherever it sits.
The next three most popular Zero Trust use cases were similarly multifaceted:
Ensuring safe and fast developer access (selected as important by 83% of respondents). In addition to stronger security, this use case also helps developers access tools and environments more reliably — a significant productivity boost.
Starting or expanding a bring-your-own-device (BYOD) program (selected by 81% of respondents). This use case also offers cost savings, and can spare IT teams from managing and updating corporate devices.
Replacing overburdened VPNs (selected by 71% of respondents). Not only is Zero Trust more secure than VPNs, but it also allows employees to access applications more reliably and saves IT teams from keeping track of VPN clients.
Progress and key obstacles in Zero Trust adoption
All of these external pressures and use cases have created widespread interest in Zero Trust security. The survey found that 80% of security leaders say their organization is committed to Zero Trust adoption. Additionally, half of all organizations recently elevated their chief information security officer to board-level visibility because of the importance the organization places in Zero Trust and reducing cyber risk.
However, this interest has not yet led to concrete adoption. Only 39% of organizations surveyed reported having completed at least one Zero Trust pilot this year.
What are the reasons for this widespread lack of progress?
One culprit could be challenges with overall cloud transformation. Eighty percent of organizations accelerated their cloud adoption plans in 2020, but were unprepared. When large chunks of data have not yet moved to the cloud from isolated data centers, it can become harder to secure using a single security tool.
Another obstacle proved equally challenging for Zero Trust adoption: identity and access management (IAM) complexity. Seventy-six percent of security leaders surveyed said they struggled to shift to a Zero Trust approach due to the complexities of user access needs in their organization. Zero Trust relies on a single source of truth for identity management, yet larger organizations in particular have often accumulated multiple incompatible identity providers over the years. They must also understand access patterns across a huge number of applications — most of which cannot be shut down even for a moment in order to be migrated to a new identity platform.
What can security leaders do to overcome these challenges? Here, briefly, are three approaches to consider:
Choose a Zero Trust platform with self-service functionality. Like cloud transformation, managing user access patterns will never be simple. To make time for this important work, security leaders should look for Zero Trust tools that make other access management actions — e.g. integrating applications, or creating roles and role-based permissions — as easy and self-directed as possible.
Gradually reduce dependence on a VPN, starting with developer apps. Security leaders agree that VPNs are overburdened and ineffective in a remote work environment. Zero Trust Network Access platforms replace the traffic-hauling latency of a VPN with identity-based protection on a per-application basis. Developer apps like Jira, Jenkins and Grafana are a great, common starting point on this journey.
Consider integrated platforms that can grow with you along your adoption journey. Using multiple point solutions for Zero Trust implementation is harder to manage. It also adds risk, since each solution is an additional point of failure.
Explore these findings in more depth
These findings were compiled by Forrester in a study commissioned by Cloudflare. The results are a culmination of surveys of 317 global security leaders across more than 20 industries. Respondents come from companies of a variety of sizes, with 32% working at organizations with more than 5,000 people and 17% working at organizations of less than 500 people or less.
This article is part of a series on the latest trends and topics impacting today’s technology decision-makers.
Key takeaways
After reading this article you will be able to understand:
The trends impacting corporate IT
Survey results from over 300 global security leaders
The most popular Zero Trust use case
How to overcome key obstacles in the adoption of Zero Trust
Related resources
Dive deeper into this topic.
To explore the complete findings in more depth, download the Leaders Are Now Committed To Zero Trust report.
Get the report