Zero Trust Security

2020 Hindsight – The Rise of the Hybrid Workplace

The consumerization of corporate IT is a trend that goes back decades. As technology became more pervasive, and more and more employees began using their own personal devices and networks for work, IT leaders have been challenged to maintain governance and control over the security and reliability of their systems.

Even before the pandemic, a new generation of digital-native employees came to expect their employers to be able to handle this trend, expecting seamless onboarding, business app stores and do-it-yourself helpdesk calls. In short, the employee experience, not just the customer experience, became incredibly important.

And then the pandemic hit, accelerating many of these trends and introducing new dynamics that nobody could have predicted. During lock-down, with employees quarantined at home, we saw a sea change in how our technology infrastructure worked, or at times, did not work.

As we emerge from the pandemic, many employees are opting not to return to the office because they have grown used to working from home and many companies are reducing their office space to minimize their operating costs. In short, thanks to the events of 2020 and the first half of 2021, the hybrid workplace has quickly become the default model for small and medium-sized enterprises (SMEs) everywhere.

A recent survey of small and medium enterprise (SME) IT leaders shows exactly how common the new hybrid workplace is, and how important it is to find new ways to secure it.

Absolute Zero – The Foundations of a Zero Trust Architecture

The origins of Zero Trust Security can be traced back more than a decade. In 2010, a Forrester security analyst at the time, John Kindervag, popularized the use of the term and set forth many concepts that still serve as its foundation today. Around the same time, Google began developing its own Zero Trust Security architecture, BeyondCorp. In 2018, the National Institute of Standards and Technology (NIST) issued a special publication (SP) 800-207, Zero Trust Architecture.

With so many giants involved in Zero Trust, and hundreds of pages of technical papers written about it, it is easy to become overwhelmed. However, the essence of Zero Trust Security is highly intuitive: when an organization trusts the validity of its users, its devices, and its network at face value, that trust creates a security risk; it is far too easy for criminal hackers to compromise, mimic, and otherwise falsify their identity and behaviors to gain illicit access by taking advantage of that inherent trust.

To put it succinctly: trust nothing, verify everything.

More precisely, Zero Trust Security is focused on establishing trust whenever access is requested, which can be simplified into a straightforward framework:

• Trusted Identity – Confirm the user is who they say they are
• Trusted Devices – Ensure the device is healthy, secure and managed
• Trusted Network – Secure the network path
• Authorization Policies – Enforce correct authorization to access IT resources

Authorization policies, which are also referred to as conditional access, are essential to managing Zero Trust. A user must demonstrate that their identity, device, and connection are trustworthy before they can gain access to enterprise resources. Behavioral anomalies, such as connecting from a new device or a new location, may require a user to re-establish trust before access is granted.

Closely related to conditional access is the Principle of Least Privilege, which states that a user should be granted the minimum access required to complete their job. For example, a sales team member should not have access to HR systems.

Managing conditional access and least privilege can be complex in cloud and hybrid workplace environments. According to ESG Research, Trends in Identity and Access Management: Cloud-driven Identities, the average organization says 30% of their cloud identities are overly permissive.

There are a variety of solutions to help manage the Zero Trust Security framework, but as the hybrid workplace has become increasingly fragmented, it has become increasingly challenging to manage.

One Directory to Rule Them All

One reason that Zero Trust Security requires so many solutions is because cloud and hybrid workplaces are so fragmented with services and devices. However, a cloud-based directory addresses these issues of fragmentation because its infrastructure is available anywhere and its open standards integrate with any service or device.

Organizations can manage the full breadth of identity, devices, and network access through a cloud-based directory, so it’s a simple step to enforce the conditional access of Zero Trust security.

The most important elements to look for in any Zero Trust solution are:

• The Right Authentication – A cloud based-directory can streamline IAM and MFA
• The Right Device – A cloud-based directory can link the identity of a user to the identity of a device through MFA
• The Right Access and Privileges – A cloud-based directory can manage and enforce access rights (i.e. conditional access and least privilege)
• The Right Location – A cloud-based directory can detect behavioral anomalies, such as a user connecting from an unusual location, to enforce conditional access

What’s more, by utilizing a cloud-based directory, organizations of all sizes can realize the benefits of a domainless enterprise, as more and more SMEs are discovering:

• Build Unified Identities – View and manage users across directories, services, devices and networks
• Configure and Control Devices – Manage devices across multiple operating systems (OS)
• Securely Access Anything from Anywhere – Verify identity, verify devices, verify networks, authenticate, and authorize access
• Transform Logs into Insights – Centralize data, monitor and troubleshoot, and establish an audit trail for forensics and compliance