The concept of "Zero Trust"

You can never be 100% sure of your Information Security. The development of new types of data protection is taking information technology to a higher level. Multi-factor authentication and privileged users, biometrics for access – all of this has become commonplace. In a corporate environment, we trust people inside the network by default and do not trust people outside it. Today, we will explore the relatively new concept of "Zero Trust" and its usefulness in a company perimeter, cloud and mobile security.

What is "Zero Trust"?

By default, all users, gadgets, clouds, systems and networks are compromised, regardless of whether they are protected by a firewall. The zero trust concept involves very strict control of access to systems, so even authenticated users undergo several stages of verification. This method helps to significantly reduce the likelihood of a successful attack on the system.

By restricting different users' access to segments of the corporate network, hackers have fewer opportunities to access protected or confidential data. Of course, the key value of the zero trust concept is multi-factor authentication (a security mechanism that requires an additional real-time authentication method using a data category that is independent of the user).

Corporate network vs "Zero Trust"

As we have already said, the outdated method of protecting a company's perimeter implies that any user within the corporate network is, by default, a "trusted person", and any user outside the corporate network is, accordingly, "untrusted". This model has existed and thrived for the past 20 years to justify the fact that only certain individuals have access to programmes and applications. However, over time, this model of perimeter security has proven to be less and less effective, particularly due to the huge leap forward in the development of cloud technologies, mobile technologies, data protection systems, and the widespread transition of employees to remote working. As a result, in the new environment, the concept of a "trusted person" within the company and outside the company network no longer exists. The new model treats all users as "untrusted" by default and forces them to go through all the steps of obtaining access, regardless of their privileges. The "Zero Trust" policy was first discussed in the mid-2000s, with the main idea being to "deperimetrisation" the company and transition to the strategy of protecting company data at all levels using encryption and multi-factor authentication.

The development of "Zero Trust"

In 2010, John Kindervag, an analyst at Forester Research, coined the term "Zero Trust" policy, the main idea of which was distrust of any user inside and outside the company. The company must verify anyone who tries to connect to the network before they are granted access. The "Zero Trust" policy calls into question the protective model of using a firewall between internal and external networks. Such a security strategy will fall apart if a hacker compromises the system within the perimeter and wants to steal confidential information. Thus, in a conventional system, Information Security inspectors must manually verify and protect all resources, granting and revoking access to each user individually.

Cloud and mobile security in "Zero Trust"

The three main principles of the zero security concept:

• companies must provide secure access to their networks regardless of the location of a company or employee;

• organisations must control user access so that users can only access resources they need. In addition, businesses must prevent users from accessing potentially sensitive information and clearly define roles for employees. This is done to ensure that private data remains within a company in the event of dismissal;

• companies must inspect and log traffic to ensure that users are acting lawfully.

With the growing number of devices connected to corporate networks, more and more organisations have begun to implement special software solutions that support the "Zero Trust" policy. Everyone has probably heard of DLP systems – special software designed to prevent confidential information leaks and monitor employee activity during the working day. Let's take a quick look at how such a system works, using Anexet Ultimate from Scinero Software Limited as an example.

Example of the Anexet Ultimate DLP system from Scinero Software Limited

Anexet Ultimate is a DLP system that protects companies from data leaks caused by employees, monitors their computer activity, identifies potential threats and, in the event of an incident, promptly reports a breach to the organisation's Information Security team or even prevents an incident from occurring.

The Anexet Ultimate Agent application is installed on the computer, which intercepts sent and received messages and files and monitors all actions performed on the computer. All intercepted information is sent to your Anexet server and undergoes intelligent analysis. If a violation is detected, the system can block an action and notify the company's Information Security service.

The DLP system can be used in local company networks, networks with complex architecture, geographically distributed offices and mobile workplaces. Thus, this software solution operates according to the principles of a "Zero Trust" policy and will help to significantly reduce the chances of losing confidential data belonging to an organisation.

Also, in accordance with "Zero Trust", the use of VPN is mandatory when working in a corporate environment. Currently, companies have their own corporate VPN, which works in conjunction with other technological methods of information protection.

The future of Zero Trust

As technology advances every day and attackers devise increasingly sophisticated ways to attack systems, the global IT community has already recognised the absolute validity of the "Zero Trust" concept and is widely implementing this model in companies. Of course, large technology companies are the first to realise the potential of "Zero Trust". Overall, analysts predict that by 2025-2030, the "Zero Trust" model will become widespread throughout the world.

Those for whom preserving confidential company data is a priority are the first to switch to "Zero Trust" and DLP systems. All of this works together to ensure maximum security for company data.