Zero Trust has become a standard approach for many organizations to secure network access for their remote workers. Based on the principle that no user, device, or application can be trusted by default, the security framework has seen rapid adoption.
However, the nature of work is changing in this post-pandemic era, and there has been a dramatic rise in hybrid work. Today, employees regularly work both in the office and remotely. Recent reports show that by the end of 2022, 53% of U.S. workers were engaging in this “hybrid” work model.
Unfortunately, current Zero Trust Network Access (ZTNA) models have yet to adapt to this changed reality. While they have proven to be valuable for protecting remote workers, this approach only covers part of the problem. Today's ZTNA solutions for remote workers are cloud-delivered, and they typically become inactive when the user is onsite, thereby reverting to less secure, perimeter-based security approaches in the LAN. This presents a major challenge in today's hybrid work world, where organizations would like to extend the security benefits of Zero Trust to all employees, not just their remote workers.
In brief, the concept of Zero Trust requires all users, whether inside or outside an organization's network, to be authenticated, authorized, and continuously validated before accessing certain applications and data. Benefits of ZTNA include:
At the end of the day, by adopting this approach, security teams can ensure a more robust defense against breaches, adapt to the evolving business landscape, and achieve a clearer oversight of network activities. This not only enhances the organization’s security but also reduces the administrative overhead and complexities traditionally associated with securing network access.
According to an Okta report on the state of Zero Trust security, 55 percent of organizations have already implemented a Zero Trust initiative, and 97 percent plan to launch one in the next 12 to 18 months. According to the report, as early as 2025, at least 70 percent of all new remote access deployments will be handled predominantly via ZTNA instead of VPNs of the past.
Despite workforces' partial migrations back to the corporate campus, Zero Trust concepts have largely not followed them onsite. Hybrid working models present a challenge for security teams because ZTNA solutions, which are designed to secure remote workers, automatically disable themselves once the user logs in to the office environment. This means that users who work onsite regress to a less secure "perimeter" approach to security. It also means that security teams must maintain two distinct and separate security stacks for their users – one for users when they work remotely and one for users when they work onsite.
Campus network security is typically powered by traditional Network Access Control (NAC), 802.1X, and VLAN-Provided products that assume users and devices can be fundamentally trusted within the protected corporate environment. This legacy "perimeter" security model presents a serious problem when compromised devices or malicious actors get into the network. Once trusted access is gained, they can move laterally in the network to steal data or run ransomware.
Zero Trust takes a different approach – the philosophy is to "assume breach ."If organizations want to minimize their security risks, they must assume that breaches have already taken place or that it is only a matter of time before they do.
Some vendors suggest that they can deliver ZTNA for on-premises workers via the cloud or via a virtual machine dropped into the local area network. There are a number of significant shortcomings to these approaches that security teams should be aware of, including:
Despite these diverse challenges, new approaches are emerging that make it possible to implement a holistic Zero Trust strategy for on-premise users. These new emerging solutions combine all the key principles of Zero Trust – identity validation, least privilege access, and continuous trust validation – with an additional set of innovations required for the requirements of on-premises security – OT/IoT device awareness, adaptive micro-segmentation, and deployment to the LAN edge as close to the user as possible. IT and security leaders should consider a key set of requirements for this type of solution:
ZTNA solutions proved themselves invaluable during the pandemic. But their principles are not just for securing remote work. Advanced Zero Trust solutions can support all hybrid environments in which applications are provided via the cloud to ensure the security of today’s remote and onsite workforce.
Dan Maier is the CMO at Versa Networks.
Related articles:
NetOps teams, like Spider Man, have great powers and great responsibilities. Increasingly, they are adopting a Zero Trust approach to network operations to help fight their battles.
Senior stakeholders who want to hold on to their CISOs must ensure that they have sufficient incentives and, more importantly, support to cope with the burden of risk that they are carrying.
The most alarming takeaway from Cisco’s new Cybersecurity Readiness Index report is that even after decades of having the importance of cybersecurity driven home, cyber threats are still taken too lightly.
