What Zero Trust Means to Security Leaders

Zero trust is a new approach to network security that aims to eliminate the concept of “trusted” devices, users, or applications. It’s based on the idea that every device or user could be malicious, so it should be assumed that every connection is hostile until it can be proven otherwise.

Zero trust architecture embeds authentication into every aspect of your business infrastructure, so you always know who is accessing what data and when they’re accessing it.

And because you don’t have to make any exceptions or allowances for trusted users—because there aren’t any—you can make sure that your entire enterprise is protected from threats both internal and external.

When we look at 2022 investment priorities for CISOs, zero trust security models have jumped up in the layers of importance and focus.”

We asked some of the world’s foremost security leaders and experts what zero security means to them, and how they are overcoming challenges in implementing it.

Authenticating every user through IT architecture

Zero trust is an architecture and design philosophy that shifts the traditional concept of a hardened perimeter and trusted inner network to one where every user, device, and packet of data is evaluated in real-time context before being allowed or denied.

Zero trust is not a single product or category of products, but instead is an implementation of security controls and policy coupled with deep understanding and visibility into the data flowing across all of your systems regardless of their proximity to your internal network.

Migrating to Zero trust architecture is costly and time-consuming, and those costs skyrocket when you do not adequately perform the discovery, inventory, and mapping phases of preparation.

Zero trust is not a single product or category of products, but instead is an implementation of security controls and policy coupled with deep understanding and visibility into the data flowing across all of your systems regardless of their proximity to your internal network.”

 Melissa Bischoping
Director of Endpoint Security Research at Tanium

In Zero Trust you focus on taking the power back from those that are attacking your infrastructure and you do so smartly, over time, with a focus on business-related outcomes that are aligned with a well-crafted security strategy.

Zero trust is a strategy, period. This is not a piece of technology that one turns on and is “zero trusty”. There are technologies that can enable a ZT approach but fundamentally this is about removing the capabilities that an adversary needs to be successful following a compromise.

In Zero Trust you focus on taking the power back from those that are attacking your infrastructure and you do so smartly, over time, with a focus on business-related outcomes that are aligned with a well-crafted security strategy.”

 Chase Cunningham
Chief Security Officer at Ericom Software

I see Zero trust as the only path forward for IT security because it brings explicit control across all layers of the IT environment.”

Zero trust is a paradigm shift in how we approach security, not just an incremental improvement. There are three changes that happen when you move to zero trust:

1. Authentication of everything
2. Policy that assures good behaviour happens and everything else doesn’t
3. Threat management becomes deeply embedded and real-time.

I see Zero trust as the only path forward for IT security because it brings explicit control across all layers of the IT environment.

 John Roese
Chief Technology Officer at Dell Technologies

The endpoint attack vector now moved to homes.”

You have to consider a new paradigm in how you secure that. We accelerated the journey on zero trust architecture very, very quickly and put that in place.

 Sri Shivananda
EVP at CTO PayPal

If I boil down what the zero trust aspect is about, it is about reducing the attack surface.”

If you do get attacked, then reduce the blast radius.

 Imtiaz Khan
Chief Information Security Officer at Roads and Maritime Services

The biggest obstacle to adopting zero trust is that it’s an architecture and all the integration burden is left to the user. “

The way we can accelerate it is by making it a shared responsibility between the industry and customer base.

 John Roese
Chief Technology Officer at Dell Technologies

“Zero trust is an aspiration for many organisations.”

They recognise they need to expand security down to the application development layer, but they still spend most of their time defending the perimeter.

 Matt Boon
Senior Research Director at ADAPT

Gaining buy-in to achieve security initiatives for customer trust

Do not jump ahead into “implementing a zero trust solution” if you have not done the critical foundation work of asset inventory and patching hygiene.”

If you get your inventory and patch lifecycle in top shape, your journey to Zero Trust is much easier to build on top.

One of the most important aspects of this is having face-to-face conversations with the business unit owners who use the systems you’re protecting every day. Understand how data moves through their workstream, and how you can clearly define that data flow.

This valuable exercise has two important benefits: you gain actionable insight into exactly what’s needed to enable secure workflows for the business, and you are in a unique position to identify opportunities for efficiency improvements and removing bottlenecks.

Build solid foundations. Do not jump ahead into “implementing a zero trust solution” if you have not done the critical foundation work of asset inventory and patching hygiene. If you get your inventory and patch lifecycle in top shape, your journey to Zero Trust is much easier to build on top.

Taking on a complex roadmap to Zero Trust without addressing the fundamental security principles will amplify the technical debt and reduce your ROI down the road.

Melissa Bischoping
Director of Endpoint Security Research at Tanium

“I don’t think we’re going to get to a zero trust architecture, 100% for a while.”

Many of our corporations depend on legacy systems. It’s about appropriately putting the safeguards in place for those.

 Shawn Bowen
VP, of Information Security (CISO) at World Fuel Services

For more of the latest ANZ tech market research, benchmarking data, and executive interviews, get them delivered to your inbox fortnightly.