Trust No One: The Anatomy of a New Security Model

The world of information technology sometimes feels like an old seafarer’s map showing monsters lurking in deep waters and warning, “There be danger here.” The digital world doesn’t need to be so melodramatic, but no company should ignore the warning that danger is all around.

From ransomware to malware to hackers stealing private data, businesses need a strong IT infrastructure to protect against these threats. Zero Trust Architecture, or the Zero Trust model, is a highly secure method of protecting your data that has gained popularity in the last few years. It switches up the traditional idea of “trust but verify” to “never trust and always verify” and can be implemented over time with existing technology.

What Does Zero Trust Mean?

Zero Trust is exactly what its name implies. Trust no one entering your network no matter where they are located, whether from the security of your office or logged into the unsecured Wi-Fi of a hotel. John Kindervag, creator of the Zero Trust model, refers to the danger of the current system as “relying on a broken trust model” where there is a consistent failure to verify when a person accesses the system from a trusted source. Once the user, harmless or malicious, is past the perimeter security, they become a trusted user and have access to the network.

The Zero Trust model eliminates this danger by having no trusted source or trusted user that could be overlooked in the verification process. All traffic, anywhere in the network, is subject to segmentation, authentication, and verification. According to the Zero Trust model:

• All resources should be accessed in a secure way regardless of location or user.
• No user receives access to all information. Strictly enforce access to information on a need-to-know basis.
• All traffic going into or out of the system is inspected and logged in order to catch malicious traffic.

What does this mean? Imagine your system is a battleship. Inside, there are hatches that can be sealed to cut off a breached part of the ship so the whole vessel doesn’t sink.

In the current popular method, all the hatches are open once you make it inside the ship. The only barrier is the outer hull, the perimeter security of your system, and you can move freely throughout the ship without reauthenticating.

In Zero Trust, every hatch on the ship is closed, and you must have the proper access codes to open each door. Once you’ve proven yourself, only the room you need information from is opened, all other hatches remain closed and protected. In order to get to information you’re not supposed to have, you’d have to break through each door one at a time, all while someone is monitoring your movement through the ship.

Via network segmentation and next-generation firewalls, Zero Trust uses existing security features such as multifactor authentication, analytics, encryption, security groups, and file system permissions to secure all information and allow in only those who have proven they should have access.

How Should I Start a Zero Trust Model?

Zero Trust is more than just the technology—it’s a way of thinking about who has access to your network. Trying to overhaul your entire system to a Zero Trust model in one go would be expensive and confusing and could lead to downtime that your business can’t afford. It also requires a great deal of technological know-how, IT security, and consistent management in order to give appropriate access to the correct people for the intended information.

For most businesses, when implementing a Zero Trust model, start small. While a complete overhaul would be costly, Zero Trust features can be easily adapted into current systems in pieces and, over the course of several years, be built into all areas of a business’s systems. Many new features of business technology, such as cloud services, already work well with the Zero Trust model and can be easily adapted.

Any business wanting to begin the move to a Zero Trust model should identify a small piece of their system, such as customer personal identifying information or credit card information, and institute segmentation and authentications around that information. You can then build your Zero Trust network from there over time.

Allow Managed Services to Bring Zero Trust to You

The Zero Trust model is a good way to secure your information, but if you don’t have your own IT department, it can be a challenge to implement. Zero Trust requires more than an IT company to set it up, walk away, and leave it to run. It will take time and constant adjustment to bring your current network into a complete Zero Trust model. A managed IT services company like Anderson Technologies is the best way to ensure your business is moving toward a Zero Trust model. Managed IT services can offer:

• equipment set up
• implementation
• maintenance
• employee training (most important)

For a small business, taking the time necessary to figure out IT improvements like this on your own can hinder the daily running of your business. Don’t let security get in the way of serving your customers. Zero Trust eliminates the threat of trusting too much but only if properly installed.

For more information about moving toward a Zero Trust model, contact Anderson Technologies by email at info@andersontech.com or by phone at 314.394.3001.