The Ultimate Guide to Implementing Zero Trust in an Imperfect World

No business can implement Zero Trust all at once. In fact, Forrester developed a method for drawing up a Zero Trust roadmap that generally spans 2-3 years. The roadmap is meant to aid companies in developing an incremental rollout that works within their environment rather than bulldozing it to start from ground zero.

This helps companies optimize costs, leverage their current technology where they can, and make use of a partial Zero Trust architecture along the way.

Set Expectations

– Leaders, stakeholders, and your IT team should understand that achieving full Zero Trust security is a long and incremental process.

– Clarifying the roadmap and timeline helps leaders understand the associated costs and IT teams contextualize how much time they’ll have to learn and implement new solutions.

– The best way to communicate this is by sharing the Zero Trust roadmap and keeping goals, milestones, and progress transparent.

If you aren’t able to secure, upgrade, or replace an element of your infrastructure to make it Zero Trust compliant, develop a short-term plan to mitigate its risk. The short-term solution should outline how to best secure the non-compliant element for the time being, with the understanding that the long-term solution will prescribe a more permanent fix.

Addressing Non-Compliant Elements: Short-Term Security Measures to Mitigate Risk

– Quarantine: Quarantine non-compliant equipment with an air gap, VLAN, or firewall rules to prevent lateral movement in case of a breach.

– Create back ups (on a separate network): If non-compliant equipment is breached, backups make sure you don’t permanently lose any data it stored. See Implement Backups for backup best practices.

– Migrate sensitive data: Where possible, move sensitive data out of the non-compliant technology and into a more secure solution, like the cloud.

– Enable remote lock and wipe: Make sure you can remotely lock and wipe non-compliant devices to prevent a breach if they’re lost or stolen.

– Assign tight access controls: When it comes to assigning access to non-compliant resources, be especially strict with the principle of least privilege (PLP): people should be given the least amount of privileged access that they need to do their work. Fewer people with access means fewer attack vectors.

Instead of constantly upgrading and fixing legacy and outdated equipment, use their depreciation as a vehicle for fueling cloud adoption. The costs of maintaining legacy equipment will only increase as they become less relevant; these compounding costs can help back your case for the need for cloud adoption.

When it comes to prioritizing based on security needs, protections for the following data and users should receive the highest security measures and should be secured first.

• Core business operations.
• Customer data.
• Personal identifiable information (PII) and IP data.
• Financials.
• Users who can access the above resources.

CRMs, ERPs, accounting software, payment or billing software, and HR platforms are common tools that fall under these priority categories. Similarly, users with admin privileges should receive priority security measures.

Not everyone needs access to all resources — according to PLP, a cornerstone of Zero Trust, everyone shouldn’t have access to all resources. In some cases, Zero Trust implementations could start with a small rollout (say, to IT admins only) to facilitate a test phase followed by incremental adoption where needed.

Consider only purchasing licenses for a few employees, reallocating licenses instead of purchasing more, or making a limited free trial work to get started using the tool in your environment.

In addition, only invest in the features that fit your organization’s needs; you may not need all the extras in a top-tier license designed for large enterprises. The more features you have, the more costs and resources will go toward managing them: be economical in your licensing decisions.

When prioritizing new software purchases and new Zero Trust initiatives, let your roadmap guide you. For context, most SMEs start at the identity or device level, as these initiatives form strong foundations for a Zero Trust architecture.

Risk assessments and cost/benefit analyses can help quantify the costs of security measures and the costs of a breach. Usually, the potential cost of a breach far outweighs the cost of the security protecting it; however, in some cases, securing low-risk items may provide little monetary benefit.

For example, the cost of updating an outdated legacy server that doesn’t house critical data might be higher than the cost of a breach to the server if it were air-gapped from the central network.

While the ideal approach would be to update the server, the organization in this scenario might choose to hold off on the update and instead proceed with short-term risk mitigation, like air gapping and backups.

• Using a tool that uses open rather than proprietary standards helps prevent vendor lock-in and improves interoperability with other solutions.
• This will make your infrastructure more flexible, allowing you to incorporate new tools, implement changes, and scale with ease — all of which are critical to an SME’s success.

• Instead of looking for one tool to solve each problem, look for ways to solve multiple problems with one tool. Tool consolidation is important at the outset of your Zero Trust implementation as well as during your journey.
• If you find yourself overwhelmed with too many tools in your stack, look for options to roll one tool’s functionality into another existing tool, or for alternative tools that can accomplish multiple functionalities at once.
• Similarly, when purchasing additional solutions, look for ways to meet several functionality needs with one tool. An infrastructure with consolidated tools has fewer fragile dependencies and fewer opportunities for data to deviate, making it easier to manage and scale.
• In addition, investing in fewer tools cuts down on upfront costs as well as ongoing maintenance and management.

• If you need a certain integration or capability that’s not available with your current tool, consider customizing the tool, either in-house or by working with the provider. Quality providers are always looking to improve their products and may be open to granting your request.
• Building a custom integration or feature in-house is better for the short term than the long term, as workarounds are rarely as smooth as native functions and integration.
• Changes to the environment can cause custom APIs to break, customizations usually require more manual care than a native integration, and they can create intricate dependencies that are difficult to untangle when it comes time for a change.
• When push comes to shove and the vendor won’t budge, it might be time to switch. When you do, look for one that prioritizes the user experience and can consolidate several functionalities you need or will need later in your Zero Trust journey.
• Unifying functionalities both cuts costs and streamlines security by maintaining native integrations, clear visibility, and a single source of truth.

You likely already have some Zero Trust implementations in place. If you can’t afford to purchase new tools yet, expand on your existing Zero Trust implementations while you come up with a more long-term budgeting plan to keep moving toward your Zero Trust goal.

While Zero Trust security helps defend against and mitigate threats, no security program is foolproof. Backups help minimize losses in an attack: in the event of a ransomware attack, for example, if the victim had the data backed up, they can forgo the need to pay the ransom.

(Note that having backed-up data doesn’t protect against identity breaches and compromised PII).

Integrating tools and automating processes reduces the burden on the user by cutting out manual steps, streamlining tool usage, and creating intuitive workflows.

For example, integrating resources with a central directory can automate provisioning and include them in SSO.

Integration and automation can apply almost everywhere, from user onboarding to integrating IT help desk tickets with project management tools. As a rule of thumb, aim for a distribution of 90% integration, 9% automation, and 1% manual work.

Make sure you fully understand what’s on your network. From old outdated servers to unused licenses, inventories can highlight areas to leverage, optimize costs, and identify areas that need immediate action to secure unprotected assets.

When you find an element that isn’t Zero Trust compliant that you can’t rectify right away, consult Develop Short-Term and Long-Term Plans for Mitigating Risk on Unprotected Elements, for some short-term measures you can take to mitigate its risk.

If a challenge can be solved with an upgrade, it’s often worth the cost and labor. Not only will it fix the problem at hand, but the upgrade will likely be more secure and better-suited to supporting a modern organization’s needs.

If you only need one or two features from a higher-priced package than your current subscription, consider working with the provider on a compromise.

Business accounts are valuable, and the cost of losing your business as a whole is likely a much bigger hit to the vendor than offering a security feature to your company at a discounted price. This is never a guarantee, but it’s worth a try before you switch vendors.

Keep your proposal oriented around the benefits and impacts of the Zero Trust implementation. While some discussion of the logistics around implementing Zero Trust will likely be necessary for context, getting too focused on technical details often detracts from a proposal’s effectiveness.

Leaders are focused on reaching their goals and supporting their bottom line: orient your proposal around these big-picture ideas to keep it relevant to leadership.

A proposal without hard numbers lacks context and will quickly lose a leadership audience and be dismissed as unrealistic. Contextualize your proposal with dollars, months and years, percentages, and other hard numbers that can quantify proposed actions and investments.

Some figures that often make a strong case for Zero Trust include:

– Total cost of ownership (TCO): Adopting cloud-based technology and security lowers a business’s TCO over time by reducing the cost of housing, maintaining, and scaling legacy equipment.

– Security data: For example, over half of SMEs are pursuing or plan to pursue a Zero Trust program. In the last year, 41.8% of SMEs were victims of a cyber attack, and the average cost of a data breach is $4.24 million.

Cite other SMEs’ Zero Trust initiatives and why they’re working for those companies to justify your proposal and inspire leadership to remain competitive.

Cite examples of real-world breaches — especially those where the victim was similar in size, industry, or security practices to your organization to underline the seriousness of your risk.

The most barebones risk formula is risk = likelihood X impact. Quantify risk by identifying notable threats — like ransomware — and labeling their likelihood of impacting your organization and the severity of those consequences.

Risks that are “high” in both likelihood and impact (ransomware usually falls in this category for SMEs, for example) are the most critical. Use this formula to identify your high-risk threats, then show how Zero Trust would mitigate them.