Zero Trust ArchitectureCybersecurity continues to be a top priority for leaders all over the world. Over the last decade, high-profile cyberattacks have revealed how vulnerable our information and systems are when sufficient protections don’t exist. In some situations, the consequences have been enormous.
For example, target paid out nearly $20 million to make amends for a massive security breach in 2013 that affected millions of customers. In 2014, hackers stole private information, sensitive documents, and valuable IP from Sony in a widely publicized cyberattack. Fast-forward to today, and many organizations still haven’t updated cybersecurity practices to keep up with innovation that is changing how we live and operate.
More companies are migrating to cloud environments, and workforces are becoming increasingly mobile. The current pandemic is only accelerating these trends. At the same time, the Internet of Things (IoT) continues to explode at an alarming rate, with tens of billions of new devices expected to flood the market over the next five years.
For these reasons, perimeter-based cybersecurity models don’t cut it anymore. They worked for keeping intruders outside of the “castle walls” and for protecting centralized offices. However, they fall short when information and IT infrastructure move beyond the perimeter walls.
Today, we need information-centric security models built on zero trust security principles. With zero trust architecture (ZTA), we can efficiently protect resources, data, and applications no matter where they are located. In this post, we explain what “zero trust” means and how it solves modern cybersecurity challenges.
Zero trust security is a cybersecurity model built around the assumption that anything or anyone with access to data is a potential threat. Zero trust architecture (ZTA) evaluates authenticity on a per-transaction, per-request, or per-session basis, allowing organizations to apply permissions at a granular level.
According to a National Institute of Standards and Technology paper, zero trust architecture is an “end-to-end approach to enterprise resource and data security that encompasses identity (person and non-person entities), credentials, access management, operations, endpoints, hosting environments, and the interconnecting infrastructure.”
In simple terms, ZTA allows organizations to issue the minimum-necessary permissions to the minimum number of people. Zero trust models ensure workers, contractors, and devices only have access to the information they need.
BeyondCorp from Google is one example of the zero trust model in use today. BeyondCorp allows Google teammates to work from anywhere without the need for virtual private networks (VPNs). The model validates users rapidly and enables the company’s workforce to spread out geographically as needed.
Zero trust architecture is critical for IoT, as well as remote computing more broadly.
IT teams can’t effectively manage hundreds or thousands of connections outside of digital perimeters in real time. In the IoT Age, security architects may need to oversee 100,000s or even millions of smart devices that are capable of gathering and processing data independently.
Zero trust security models can scale with the IoT in the way that perimeter-based approaches can’t. In the past, it made sense for centralized authorities to manage data access and permissions when people and infrastructure sat in the same place. Today, the attack plane is too wide for perimeter-based models to handle.
ZTA reduces the size of the attack plane by requiring all people and devices to prove authenticity in every instance. In a world where hackers can also physically manipulate smart devices, zero trust security keeps the actual assets themselves safe.
Why does this matter?
The ultimate purpose of the IoT is to “give machines a voice.” We need to ensure those voices are who they say that are at all times.
At WellAware, we treat machines like people, not just in terms of data connections and operational assets, but also as security resources. Every connected machine needs a well-understood identity so that we know what it is doing and why. As we adapt to our new remote work reality, we need to “treat smart machines like adults” and govern them in the same way that we do people.
Whether you are using IoT technology for industrial applications, smart air purification, or other use cases, zero trust security is the only way to protect your information at scale.
Having a data challenge? You're not alone.
Sign up for our blog and receive a free eBook on the 10 data challenges in Industrial IoT and how to overcome them.
