Like rust, risk never sleeps. As mobile devices flood the enterprise (especially for a younger generation of workers), the internet of things (IoT) expands, and cybercriminals grow in both numbers and sophistication, many security professionals think zero trust is the safest approach to defending against constantly evolving network and data security threats.

Network vulnerabilities can be found in the most unlikely places. Bloomberg Businessweek, for example, described a case in which an internet port in a hotel room’s motorized, remote-control curtains offered access to the hotel’s internal computer systems. Fortunately, a cybersecurity contractor discovered that particular security gap during an audit, but the lesson rings true: In today’s connected world, unlocked doors, backdoors and trap doors could be almost anywhere.

What Is Zero Trust Security?

The term zero trust was coined in 2013 by analysts at Forrester Research in a report submitted to the National Institute of Standards and Technology (NIST), which had sought input from technology experts as part of a U.S. government cybersecurity initiative. Forrester, citing a new environment in which “changes like mobility and big data have made ‘building stronger walls’ an expensive farce that will not adequately protect networks,” introduced the concept of zero trust, urging organizations to “make security ubiquitous throughout the network, not just at the perimeter.”

Zero trust refers to both a set of practices and a network design philosophy, which “demands that you build security into the DNA of your IT architecture by investing in situational awareness and developing robust vulnerability and incident management capabilities.”

In short, zero trust inverts the “trust but verify” approach to “verify and never trust.”

Achieve Zero Trust Security in 3 Steps

According to Forrester, organizations should ideally rebuild their networks “from the inside out,” starting with the “system resources and data repositories that we need to protect as well as the places where we need to be compliant.” But while rebuilding the network may be a desirable long-term goal, there are myriad ways organizations can gain the benefits of zero trust without embarking on a project of that magnitude.

Here are three steps you can take to introduce zero trust security principles into your organization.

1. Strengthen Identity Validation

Although passwords are the first line of defense for most networks, 59 percent of users have the same password for multiple accounts — and it’s a good bet that the remaining 41 percent vary their passwords by only a few characters. Identity and access management (IAM) solutions enable organizations to enhance security by applying multifactor authentication (MFA), which may require biometric factors, such as a fingerprint or iris scan, or the use of a physical object, such as a FIDO2-supported device.

2. Segment Sensitive Data

Segmenting or microsegmenting your network enables you to keep large portions of the network safe in the event of a breach, thereby minimizing the damage. The human resources system, for example, is an obvious choice since it contains personally identifiable information (PII). Experts recommend implementing network microperimeters, such as a next-generation firewall and data security controls, so that intruders cannot access more than a defined subset of data, even if they are able to breach the perimeter defenses.

3. Scrutinize Access Behaviors

In addition to guarding the network, an effective zero trust strategy includes monitoring access behavior and using analytics to search for patterns and trends. Analytical tools, tracking access behavior, and identifying patterns, trends and potential threats can reinforce data privacy — supporting compliance and increasing customer confidence.

The Success of Your Business Is at Stake

A network data breach puts not only customer information, such as credit card numbers, but also corporate intellectual property, employee records and more at risk. In addition to financial damage, loss of reputation and customer confidence — as well as potential legal liability if a breach is found to violate the General Data Protection Regulation (GDPR) or other privacy laws — are at stake.

Malicious hackers never rest, but neither do the good guys on corporate cybersecurity teams. The zero trust approach offers myriad weapons for the fight.

To learn more, listen to the SecurityIntelligence podcast, “Zero Trust and the Evolving Role of Identity and Access Management.”