The Role of Zero Trust in Reducing Your Cost of Security

The zero trust security model has gained popularity recently as organizations seek more robust controls against cyber attacks and more effective methods for protecting critical data. As an additional benefit, implementing zero trust can reduce your overall cost of compliance by replacing a disjointed security approach with a cohesive, connected security model that goes beyond the traditional technology-centric control structure. In this article, I will provide a foundational understanding of zero trust and explain how you can leverage the model to achieve reductions in the cost of security.

Five Principles of Zero Trust

Zero trust is a security model that assumes that no user, device, or service can be trusted implicitly, even if they are already inside the enterprise. The approach stems from the concern that a bad actor can do more harm from inside your network, and they can exploit employees with legitimate access to wreak havoc on your systems through social engineering. Instead of granting access and occasionally reviewing appropriateness, zero trust requires continuous verification of every access request, regardless of the user’s identity or location. To accomplish this level of security, the zero trust model incorporates the following five principles:

1. Never trust, always verify: Every access request must be verified, regardless of the user’s identity or location. By requiring constant verification, you reduce the impact of someone taking advantage of the interim between access reviews.
2. Principle of Least Privilege: Users and devices should only be granted the minimum access privileges needed to perform their tasks. With limited privileges, even with access, individuals cannot perform unauthorized actions.
3. Principle of Least Functionality: Least functionality, also called hardening, removes or restricts non-essential functions, ports, protocols, and services that are not required. Removing potential attack points reduces the likelihood of an incident.
4. Separation of Duties: No user should be granted enough privileges to misuse a system on their own. At least two individuals are responsible for the separate parts of any task. A common example is to separate the ability of an accounting team member from creating a false vendor and authorizing payments to the fake vendor.
5. Separation of Roles: An individual should not play multiple roles in a process. A typical example is preventing system end-users from acting as system administrators. A person with both roles could perform inappropriate transactions and cover their tracks.

With these five principles in place, the organization establishes a well-controlled environment that is less likely to fall victim to an incident and can recover more quickly without significant damage.

Reducing the Cost of Security

Zero trust reduces the overall cost of security in a variety of ways. First, limiting the exposed attack surface reduces the likelihood of a breach. The principles of least privilege, least functionality, separation of duties, and separation of roles create a more focused technology landscape to protect. Then, if a breach were to occur, these principles limit the damage a bad actor can do by reducing the ‘blast radius’ – in the same way that watertight doors on a ship prevent a breach in one compartment from sinking the entire ship. The isolation of the attacker also results in a faster resolution and less disruption to the organization’s operations.

Zero trust also reduces cost in the security strategy by alleviating complexity and creating a solid foundation that cuts across the entire landscape. Deloitte points out that zero trust reduces “security costs by minimizing IT complexity through automating, simplifying and standardizing the way we do cyber.” Many large organizations have hundreds or even thousands of systems to protect; traditionally, teams of people manage each system separately. Zero trust provides a single method for protecting assets and removes the need for costly one-off solutions.

A well-controlled environment can realize a further financial benefit by attracting and retaining loyal customers. According to McKinsey, “Many [consumers] will only buy from companies that are known for protecting consumer data.” Often, businesses must dig deeper into their vendors and partners to understand the potential for third-party risk exposure. By implementing zero trust, your organization can stand out as a leader in a competitive field. With zero trust in place, even in the event of a breach, your ability to contain and recover from the threat can also have a long-term positive impact on your reputation that would otherwise have been tarnished by lost data, privacy violations, legal fees, and enforcement actions.

Take the Guesswork out of Identity Management

Adopting the zero trust model means granting access to assets only to the people who need access and only for as long as they need it. The approach takes the guesswork out of identity management for each server, database, and application, along with the hundreds of hours spent on user access reviews. Instead, zero trust forms a foundation for security through a connected risk model that reduces the likelihood and impact of a breach, reduces the complexity of the organization’s security infrastructure, and builds brand trust by taking a proactive approach to protecting the organization’s most valuable assets – its data and reputation.