Zero trust is about more than products

Blocking malicious actors

Since then, organisations have increasingly understood the need to put more controls in place to identify and block malicious actors on networks, said Tolbert, adding that anyone still operating on a flat network without network and server-level access controls is far more at risk of both insider and external attacks.

“Applying the principle of least privilege ensures that only people who need access to sensitive information are allowed any access to the server that contains it so that to all other users, that server is inaccessible and even invisible, and this can be extrapolated out to cloud services.”

Applying the principle of least privilege as part of a zero trust approach to security, said Tolbert, also helps to reduce the likelihood of opportunistic attacks by disgruntled insiders as well as external attackers, pointing out that the lines between insiders and outsiders are continuing to blur as corporate networks necessarily become more accessible to remote workers, partners, suppliers and even customers.

“If an internal or external attacker is browsing a network, but can’t see what data stores are connected to the network, there is less likelihood that they will target that information and find a way of accessing it.”

While a zero-trust approach will not stop cyber criminals from stealing legitimate credentials to move around networks once they have breached the perimeter defences to get inside the network, Tolbert said zero trust means attackers will have to steal a much greater number of credentials before they are able to move around a network without restriction.

“This will slow them down and force them to make many more attempts at stealing credentials to access data – particularly the most sensitive types of data, which will typically require higher levels of authentication that do not rely on usernames and passwords alone.”

Zero trust a design principle

Observing that a growing number of security technology suppliers are claiming their products are based on zero trust principles, Tolbert reiterated that zero trust is a design principle, and that it cannot be achieved or implemented simply by buying products labelled as such.

“Implementing a zero-trust model typically involves several different security-related projects and deploying a combination of things such as network segmentation, network detection and response, and network traffic analysis to ascertain if network sessions are authenticated and authorised, and shut down those that aren’t.

“You can't buy a specific product to make your enterprise zero trust. It is about improving security by decreasing trust in all those entities seeking to make connections and requiring them to authenticate properly before granting appropriate authorisation based on policy.”

Tolbert is to discuss these topics in more detail in a session entitled Identity is at the centre of zero trust, not the network at the European Identity and Cloud Conference 2019 from 14 to 17 May in Munich.

He is to be joined in a panel discussion on placing identity at the centre of security designs and models by Richard Bird, chief customer information offer at Ping Identity, and David Lee, senior identity strategist at Sailpoint.