{"id":61186,"date":"2022-03-28T11:18:00","date_gmt":"2022-03-28T15:18:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=61186"},"modified":"2024-08-15T13:22:36","modified_gmt":"2024-08-15T17:22:36","slug":"buy-in-zero-trust","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/buy-in-zero-trust","title":{"rendered":"What It Takes to Get Buy-In on Zero Trust"},"content":{"rendered":"\n
Buy-in applies to everyone in the organization, including end users, IT, and leadership, and each group\u2019s buy-in is critical to a Zero Trust<\/a> program\u2019s success. Without buy-in from leadership, a Zero Trust initiative will never make it off the ground. Without buy-in from users and IT, it will never stay in flight. <\/p>\n\n\n\n Further, buy-in must span the entire Zero Trust journey, from initial investment and adoption through maintaining best practices. In addition, it\u2019s important to understand what you\u2019re up against so you can break down buy-in barriers when they arise. This article will discuss best practices for garnering Zero Trust buy-in and cover common barriers to Zero Trust buy-in and how to overcome them. <\/p>\n\n\n\n The proposal can make or break a Zero Trust program. With the right messaging, it can cultivate strong buy-in among leadership that trickles down to end users and spans the entire length of the Zero Trust program. A compelling proposal should include the following elements:<\/p>\n\n\n\n The benefits of Zero Trust security. <\/strong><\/p>\n\n\n\n Leaders are focused on reaching their goals and supporting their bottom line: orient your proposal around the benefits and impacts of a Zero Trust implementation<\/a> to keep it relevant to leadership. <\/p>\n\n\n\n While some discussion of the logistics around implementing Zero Trust may likely be necessary for context, focusing too heavily on technical details often detracts from a proposal\u2019s effectiveness. <\/p>\n\n\n\n Hard numbers<\/strong><\/p>\n\n\n\n A proposal without hard numbers lacks context and will quickly lose a leadership audience and be dismissed as unrealistic. Contextualize your proposal with dollars, months and years, percentages, and other hard numbers that can quantify proposed actions and investments. <\/p>\n\n\n\n Competitor activity <\/strong><\/p>\n\n\n\n Cite competitors\u2019 Zero Trust initiatives and their effectiveness to justify your proposal and inspire leadership to remain competitive.<\/p>\n\n\n\n News stories and anecdotes of breaches. <\/strong><\/p>\n\n\n\n Give examples of real breaches that have occurred<\/a> \u2014 especially those where the victim was similar in size, industry, or security practices to your organization \u2014 to underscore the seriousness of your risk. <\/p>\n\n\n\n Risk formulas<\/strong><\/p>\n\n\n\n The most barebones risk formula is risk = likelihood X impact<\/em>. <\/em>Use this formula to identify your high-risk threats, then show how Zero Trust would mitigate them. <\/p>\n\n\n\n A Zero Trust program will almost certainly require some level of training, whether to introduce employees to new initiatives or to teach IT how to manage new tools.<\/p>\n\n\n\n Leverage training documentation. <\/strong><\/p>\n\n\n\n Training documentation makes information readily available and prevents time-consuming repeat sessions. Training documentation can take the form of:<\/p>\n\n\n\n Collateral.<\/strong> <\/p>\n\n\n\n Written documentation, diagrams, and other collateral can act as helpful reference guides available on demand. Some tool providers offer their own education material \u2014 check for any training or certifications they offer before creating your own.<\/p>\n\n\n\n Recorded training sessions.<\/strong><\/p>\n\n\n\n Record all in-person training sessions. This prevents the instructor from having to repeat sessions and creates another form of on-demand documentation. <\/p>\n\n\n\n Community forums.<\/strong> <\/p>\n\n\n\n Community forums or similar spaces \u2014 like a Slack channel for the IT department \u2014 allow your team to help one another. This can prevent mistakes, encourage on-the-job learning, and reduce the number of questions that need to escalate to leadership. It also becomes a self-writing repository of common questions and answers over time. <\/p>\n\n\n\n Demonstrate new tools and UIs.<\/strong><\/p>\n\n\n\n Leverage screenshots, screen recordings, demos, and hands-on workshops to get people comfortable with a new process or a tool\u2019s interface.<\/p>\n\n\n\n Use a variety of training methods.<\/strong> <\/p>\n\n\n\n People learn in different ways. Reach more people and help them better retain information by diversifying training materials and methods: written documents, recorded video, and hands-on demonstrations are great media types to start with.<\/p>\n\n\n\n Explain Zero Trust security’s benefits. <\/strong><\/p>\n\n\n\n Communicate that adopting Zero Trust best practices helps keep everyone\u2019s identities and data safe and streamlines their day-to-day experience with better, more user-friendly technology. This will help encourage active learning and adoption.<\/p>\n\n\n\n Make it easy to find help.<\/strong> <\/p>\n\n\n\n Make sure employees know where and who to go to for help, and keep those resources easily available and responsive. Also encourage employees to seek help from one another, and consider asking a few well-versed employees to be a point of contact for other employees\u2019 questions to minimize issue escalation.<\/p>\n\n\n\n Take feedback. <\/strong>Incorporate surveys or other means of feedback collection into your training to refine it over time.<\/p>\n\n\n\n Leaders, stakeholders, IT, and end users should be aware of Zero Trust principles and best practices. Communicate best practices through clear training and documentation, and err on the side of over-communicating; repetition will help people internalize the message.<\/p>\n\n\n\n In addition, leaders and IT should be aware of the Zero Trust program\u2019s trajectory and be kept up to date on implementation progress. This will help retain buy-in and encourage a trickle-down security culture. <\/p>\n\n\n\n Forrester released a Practical Guide to a Zero Trust Implementation<\/a>, which details how to construct a Zero Trust roadmap that breaks your Zero Trust journey into achievable milestones. Consult this guide to create your own roadmap so that the organization can remain unified around the program\u2019s goals, benchmarks, and progress. <\/p>\n\n\n\n A successful Zero Trust implementation must accommodate your environment and users. However, IT work is often independent and highly focused, and it\u2019s not uncommon for IT teams to fall into a bit of an isolated work pattern. <\/p>\n\n\n\n While this may help with teams\u2019 productivity and focus, it can cause IT teams to lose some context and nuance in their work. These oversights can have drastic consequences.<\/p>\n\n\n\n For example, integrating your collaboration platform into your single sign-on (SSO) solution<\/a> might not seem like a big deal, but if sales teams don\u2019t receive enough notice, it could cause confusion and lock them out of sales calls. <\/p>\n\n\n\n IT teams should stay informed of departmental developments, understand their users\u2019 needs and level of technology literacy, and be aware of the business day to day.<\/p>\n\n\n\n For in-person workplaces, this can be accomplished through immersion: seeing clients come for on-site visits, noting when team members come in and take breaks, and even water cooler chats offer important context. <\/p>\n\n\n\n In work-from-anywhere environments where your team can\u2019t absorb contextual knowledge from their environment, some structure around inter-departmental communication can help with this. Company-wide meetings, departmental updates, informal remote meetups, and community communication channels can help keep teams in sync. <\/p>\n\n\n\n No matter the work environment, encourage IT to communicate clearly and frequently when it comes to changes, downtime, or required action. Even if the change seems small or the required action seems easy, communicate it anyway. <\/p>\n\n\n\n Culture doesn\u2019t change overnight; however, it\u2019s a significant factor in Zero Trust adoption. In organizations with strong security cultures, everyone understands what <\/em>they should do and why<\/em>. <\/em><\/p>\n\n\n\n They also feel a sense of accountability: security is everyone\u2019s responsibility. Demonstrate these values in training and in practice, make sure security awareness training includes communication around risk, and assign training to everyone <\/em>\u2014 not even leaders should be exempt.<\/p>\n\n\n\n Zero Trust offers user-friendly benefits at the leadership, IT, and user level. For leaders, IT can configure conditional access policies to allow them to skip multi-factor authentication (MFA)<\/a> in secure locations, for example. Users, too, benefit from easier authentication and reduced password usage, among other advantages. <\/p>\n\n\n\n For IT, a Zero Trust architecture provides improved visibility and reporting, more intuitive controls, and more reliable security \u2014 all of which make IT\u2019s job easier. Additional wins include the ability to manage Bring-Your-Own-Device (BYOD)<\/a> environments with mobile device management (MDM)<\/a> tools, unifying operations across work-from-anywhere environments, and cutting down on helpdesk tickets by reducing friction. Learn more in Does BYOD Fit Into a Zero Trust Security Strategy?<\/a> Users often misunderstand \u201cZero Trust\u201d to mean that they are not trusted, which can create resistance or resentment toward a Zero Trust program, hindering user adoption. <\/p>\n\n\n\n Similarly, IT teams and leadership sometimes assume Zero Trust is just a buzzword or a problem for Fortune 500 companies rather than small and medium-sized enterprises (SMEs). However, this is far from the truth: SMEs are targeted at almost the same rate<\/a> as large companies, and Zero Trust is critical to protecting them<\/a>.<\/p>\n\n\n\n Being aware of these common misconceptions can help you tailor your training and communication to address them head-on. Check out the blog, The Top 5 Zero Trust Myths, Clarified<\/a>, for inspiration on messaging around clarifying misconceptions. <\/p>\n\n\n\n Shadow IT<\/a> is a significant barrier to adoption: users turn to alternative solutions when the Zero Trust resources they\u2019ve been given can\u2019t do what they need them to.\u00a0<\/p>\n\n\n\n Shadow IT breaks down IT environments with rogue elements that multiply, disperse, and circumvent prescribed systems \u2014 all outside of your team\u2019s visibility and control. <\/p>\n\n\n\n Aside from the security risks of unmanaged accounts inputting and accessing corporate data, these shadow resources can wreak havoc on identity and access management (IAM)<\/a> and directory systems with multiple identities, siloed data in a shadow resource, and conflicting user data.\u00a0<\/p>\n\n\n\nBuy-In Best Practices<\/strong><\/h2>\n\n\n\n
Start with an Effective Proposal <\/h3>\n\n\n\n
Offer Strategic Training<\/h3>\n\n\n\n
Strategic Training Best Practices<\/h4>\n\n\n\n
Communicate with the Organization<\/h3>\n\n\n\n
Understand Your Environment and Users<\/h3>\n\n\n\n
Cultivate a Security Culture<\/h3>\n\n\n\n
Demonstrate the Usability Wins<\/h4>\n\n\n\n
<\/p>\n\n\n\nCommon Barriers to Buy-In<\/strong><\/h2>\n\n\n\n
Zero Trust Misconceptions or Skepticism<\/h3>\n\n\n\n
Solved: Clear Communication and Training<\/h4>\n\n\n\n
Shadow IT<\/h3>\n\n\n\n