Like rust, risk never sleeps. As mobile devices flood the enterprise (especially for a younger generation of workers), the internet of things (IoT) expands, and cybercriminals grow in both numbers and sophistication, many security professionals think zero trust is the safest approach to defending against constantly evolving network and data security threats.

Network vulnerabilities can be found in the most unlikely places. Bloomberg Businessweek, for example, described a case in which an internet port in a hotel room’s motorized, remote-control curtains offered access to the hotel’s internal computer systems. Fortunately, a cybersecurity contractor discovered that particular security gap during an audit, but the lesson rings true: In today’s connected world, unlocked doors, backdoors and trap doors could be almost anywhere.

What Is Zero Trust Security?

The term zero trust was coined in 2013 by analysts at Forrester Research in a report submitted to the National Institute of Standards and Technology (NIST), which had sought input from technology experts as part of a U.S. government cybersecurity initiative. Forrester, citing a new environment in which “changes like mobility and big data have made ‘building stronger walls’ an expensive farce that will not adequately protect networks,” introduced the concept of zero trust, urging organizations to “make security ubiquitous throughout the network, not just at the perimeter.”

Zero trust refers to both a set of practices and a network design philosophy, which “demands that you build security into the DNA of your IT architecture by investing in situational awareness and developing robust vulnerability and incident management capabilities.”

In short, zero trust inverts the “trust but verify” approach to “verify and never trust.”

Achieve Zero Trust Security in 3 Steps

According to Forrester, organizations should ideally rebuild their networks “from the inside out,” starting with the “system resources and data repositories that we need to protect as well as the places where we need to be compliant.” But while rebuilding the network may be a desirable long-term goal, there are myriad ways organizations can gain the benefits of zero trust without embarking on a project of that magnitude.

Here are three steps you can take to introduce zero trust security principles into your organization.

1. Strengthen Identity Validation

Although passwords are the first line of defense for most networks, 59 percent of users have the same password for multiple accounts — and it’s a good bet that the remaining 41 percent vary their passwords by only a few characters. Identity and access management (IAM) solutions enable organizations to enhance security by applying multifactor authentication (MFA), which may require biometric factors, such as a fingerprint or iris scan, or the use of a physical object, such as a FIDO2-supported device.

2. Segment Sensitive Data

Segmenting or microsegmenting your network enables you to keep large portions of the network safe in the event of a breach, thereby minimizing the damage. The human resources system, for example, is an obvious choice since it contains personally identifiable information (PII). Experts recommend implementing network microperimeters, such as a next-generation firewall and data security controls, so that intruders cannot access more than a defined subset of data, even if they are able to breach the perimeter defenses.

3. Scrutinize Access Behaviors

In addition to guarding the network, an effective zero trust strategy includes monitoring access behavior and using analytics to search for patterns and trends. Analytical tools, tracking access behavior, and identifying patterns, trends and potential threats can reinforce data privacy — supporting compliance and increasing customer confidence.

The Success of Your Business Is at Stake

A network data breach puts not only customer information, such as credit card numbers, but also corporate intellectual property, employee records and more at risk. In addition to financial damage, loss of reputation and customer confidence — as well as potential legal liability if a breach is found to violate the General Data Protection Regulation (GDPR) or other privacy laws — are at stake.

Malicious hackers never rest, but neither do the good guys on corporate cybersecurity teams. The zero trust approach offers myriad weapons for the fight.

To learn more, listen to the SecurityIntelligence podcast, “Zero Trust and the Evolving Role of Identity and Access Management.”

More from Data Protection

Transitioning to Quantum-Safe Encryption

With their vast increase in computing power, quantum computers promise to revolutionize many fields. Artificial intelligence, medicine and space exploration all benefit from this technological leap — but that power is also a double-edged sword. The risk is that threat actors could abuse quantum computers to break the key cryptographic algorithms we depend upon for the safety of our digital world. This poses a threat to a wide range of critical areas. Fortunately, alternate cryptographic algorithms that are safe against…

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Resilient Companies Have a Disaster Recovery Plan

Historically, disaster recovery (DR) planning focused on protection against unlikely events such as fires, floods and natural disasters. Some companies mistakenly view DR as an insurance policy for which the likelihood of a claim is low. With the current financial and economic pressures, cutting or underfunding DR planning is a tempting prospect for many organizations. That impulse could be costly. Unfortunately, many companies have adopted newer technology delivery models without DR in mind, such as Cloud Infrastructure-as-a-Service (IaaS), Software-as-a-Service (SaaS)…

Millions Lost in Minutes — Mitigating Public-Facing Attacks

In recent years, many high-profile companies have suffered destructive cybersecurity breaches. These public-facing assaults cost organizations millions of dollars in minutes, from stock prices to media partnerships. Fast Company, Rockstar, Uber, Apple and more have all been victims of these costly and embarrassing attacks. The total average cost of a data breach has increased by 2.6% since 2021 and is now $4.35 million. Organizations that don't deploy zero trust security models also incur an average of $1 million more in…