Enterprises have gone past the consideration phase with zero trust and are now acting on it. But adopting zero trust is far from straightforward, and many organizations are beginning to hit considerable hurdles. To smooth the path to zero trust, it’s important to remember that it can’t be approached as something that can be bought, that the auditing and mapping phases can’t be skimped on, that tying together fragmented identities is essential, that rigid approaches can affect user buy-in and productivity, and that it’s an ongoing process rather than a box to be checked.
The majority (89%) of organizations have either adopted zero trust or are actively transitioning to it, but only a quarter believe their security architecture fully aligns with zero trust principles.
This isn’t just because the market is still maturing – Gartner believes that nearly a third of organizations will abandon their zero trust initiatives by 2028, due to insurmountable barriers like complexity, poor integration, and cultural resistance. Let’s take a look at five of the challenges we’re most commonly encountering, and how to get around them.
1. Zero Trust Isn’t Available off the Shelf
One major issue is a lack of understanding at the executive level about what zero trust really is. The fact that some vendors are positioning offerings like next-generation firewalls (NGFWs) as zero trust solutions hasn’t helped with these misconceptions, either.
Zero trust is an architectural framework that requires a multi-step implementation methodology. This process is likely to make use of next-generation security offerings within the zero trust framework, but there’s no single solution or set of products on the market that can enforce zero trust on their own without wider change.
Adopting the core zero trust principles demands an overarching strategy and a fundamental shift in security mindset. It’s just as much about governance, compliance, and adopting the right framework and policies as it is about technology. While a product like an NGFW can support zero trust, it can’t single-handedly provide the answers to the questions a zero trust policy has to ask – who, what, when, where, why, and how.
2. Get the Fundamentals Right, or Suffer Later
The first two steps of most zero trust methodologies involve auditing the organization’s assets and mapping and understanding how they interact with each other. Not spending enough time on these steps is a common mistake, but without putting these foundations in place, zero trust projects are highly likely to hit impassable roadblocks further down the line.
Most organizations have a complex mix of network and security assets, which creates gaps, blind spots, and inconsistencies. From a security perspective, for example, it’s not unusual to have policies that aren’t in sync with each other – the data center firewall might have a different type of policy from the ones at the branch offices and at headquarters.
Designing and implementing a consistent global security architecture across inconsistent tech and siloed point solutions is a massive undertaking. The task is even harder if there are gaps that no one knows about or assets that haven’t been audited, and there will inevitably be cracks in the defenses as a result.
The second step – mapping transactions between users, applications, infrastructure, and other assets – explores how these flows work today, and how they ought to work in the future. This is the basis for effective microsegmentation and deciding how security gateways should behave.
A Breach Mindset Helps With Zero Trust Planning
A zero trust mindset involves assuming the network has been breached, and this goes for the early implementation phases too.
Auditing and mapping are far more effective if they’re carried out as if there’s been a breach that needs remediating. Rather than just recording where the firewalls are, for example, comb through applications and access paths and the ways that internal and external users can connect to them.
This approach provides a much more complete picture of the risks the organization owns, the consequences of an incursion, and what data flows and access permissions need to be supported by zero trust. This helps with planning and prioritization, since not every asset needs the same level of protection.
Platformization Overcomes Fragmentation and Provides Visibility
Achieving this level of visibility is a challenge for many organizations, though. Point solutions that were rolled out to solve specific problems have led to security silos and fragmented systems that make it almost impossible to follow the way users are accessing data and applications.
Some vendors are addressing this with a platform approach to security, which consolidates multiple tools and systems and provides a comprehensive view of user behavior. This allows context-aware security decisions to be made based on uniform, centralized policies.
3. Zero Trust Needs Unified Identities
Identity is fundamental to zero trust adoption. The monitoring of assets, interactions, and data flows should take place at a granular level to build an understanding of how identities are behaving.
Many organizations, however, have disparate identity and access management systems, making it difficult to get the unified visibility and the wider contextual information that zero trust needs to effectively verify access requests. So it’s not surprising that only 29% of enterprises use identity-based access as their primary model.
This is particularly worrying given that non-human identities (NHIs) are arguably becoming a far bigger risk than human users. NHIs, which are often inadequately managed and under-secured, exist in huge numbers and represent a growing area of vulnerability – already, two-thirds of organizations have experienced a successful cyberattack resulting from compromised NHIs.
An identity fabric addresses the fragmentation problem by tying together different identity, privilege, and access management systems into a single architecture. This provides the centralized visibility that zero trust requires, brings human users and NHIs into the same model, and allows identity to become the control plane for securing enterprise infrastructure.
4. Protection Must Be Balanced Against User Needs
As zero trust is more widely adopted, user friction is likely to become more of a problem.
The staff member who’s used to signing into a VPN to access all the resources they use at work is suddenly having to navigate more authentication checks when they’re switching between tools and systems.
Even the name has the potential to offend users, as it can be interpreted to mean they’re not trustworthy – though zero trust is something of a misnomer anyway, since the approach limits trust rather than removing it completely. Training, sensitive communication, and change management can all help overcome these issues and make the roll-out go more smoothly.
Unnecessarily aggressive zero trust policies can affect people’s ability to get their jobs done or prevent processes from being completed – 42% of organizations say fears of disrupting workflows or integrations delay security upgrades like this. Close collaboration with other departments is essential to understand how users go about their work and to avoid creating productivity barriers.
It’s important, then, to balance the risks each particular organization faces with the access that users need for their everyday tasks – there’s no one-size-fits-all approach when it comes to zero trust. Less critical systems like HR policy or internal news portals, for example, can often have more flexible policies without increasing risk.
5. It Can’t Be Done All at Once and It’s a Continuous Process
It’s not realistic to implement zero trust across an entire organization at the same time. This is why identifying the risk associated with each asset is so important, as it allows an achievable roadmap to be developed for a phased roll-out approach. Some areas will be a higher priority for zero trust than others.
Zero trust adoption doesn’t necessarily go in a straight line, either. One thing we regularly see is that the introduction of new zero trust policies highlights the activity on the network that no one knew about. Once this has been revealed, it can be reviewed and incorporated into the wider plan.
It’s easy to approach zero trust as something that can be finished and considered done. Like most aspects of security, though, it’s an ongoing process. Risks change, the threat environment evolves, technology moves on, tools and devices are added, new staff join, and people leave the company, so regular review and constant maintenance are essential to keep security systems aligned with zero trust.
This Is a New Approach for Everyone
Zero trust asks questions that are fundamentally different from those that security systems needed to answer in the past. It’s a completely fresh way of doing things, so this is new even to the corporate security specialist with a couple of decades’ experience under their belt. The enterprises that make zero trust adoption a success will be the ones that do the groundwork properly, that treat it like a long-term organizational change rather than a technical box-checking exercise, and accept that it involves a learning curve for everyone involved.