Zero trust is a model for a new era of business. The path to zero trust is a rocky one, though, with 88% of organizations encountering major challenges implementing it. It’s easy to blame complexity or integration issues, but the problem runs deeper than technology – the root of it is in the age-old divide between security and networking.
Historically, NetOps and SecOps functioned separately because they had distinct responsibilities.
The network was inside a neat perimeter: employees worked in an office, and corporate data and systems were in a data center or server room. The network team’s remit was to give employees access to organizational resources, so their world was all about connectivity, uptime, and performance. The security team focused on reducing risk and stopping threats getting inside the network perimeter.
The two sides were often stereotyped as being at odds with each other – the network team felt security held back performance, and the security team viewed the network as harboring vulnerabilities that they weren’t aware of but owned the risk for. There were tensions, but the model more or less functioned. Or it did, until we stopped working like that.
The Old Security and Networking Models Have Vanished
Once enterprises put resources in the cloud, started using SaaS, connected IoT devices to wider IT environments, and staff got used to working in places that weren’t the office, the network perimeter dissolved. The implicit trust model, where anyone allowed inside the firewall at the perimeter edge was assumed to be safe, didn’t work anymore.
Now the challenge was to flexibly connect people, sites, apps, and data in a lot of different locations. With the performance and uptime for everything to work, and the security safeguards to protect against threats that were getting more and more sophisticated.
Zero Trust Should’ve Bridged the Gap Between Teams
That’s where zero trust came in. Designed for modern distributed enterprise operations, it promised to zip together network and security into a single framework.
Instead of a flat network with a security moat around the outside, zero trust approaches implement security controls throughout the entire architecture. Identity and privilege levels are continuously checked and challenged, everywhere. Microsegmentation contains the blast radius of breaches. Traffic is inspected inline against policies. Controls and protections travel with the data. Correlated network and security telemetry provide comprehensive views of suspicious behavior. It even offers the potential for suspect sessions to be revoked instantly, if real-time signals can be exchanged between network and security systems.
In a perfect world, zero trust would have brought together network and security teams into a deeply collaborative partnership – but in many cases, the opposite has happened.
Zero Trust Aggravated the Network-Security Divide
In many organizations, zero trust initiatives are driven by security departments, and architectures and roadmaps are designed without consultation with the networking team.
But zero trust involves modifications to the network, like microsegmentation and identity-based network flows. The security team aren’t the best people to assess the impact these changes will have on network performance and availability. It’s the network team who have the knowledge and visibility of critical processes like packet routing, failover, and application performance management.
They’re the ones who know how to build and manage multiple different network segments. Where the pain points are in corporate infrastructure that features legacy elements, and how difficult it might be to enforce policies across hybrid networks. And the risks of making changes in complex environments where no-one can confidently claim to understand how the network is configured or what the hidden application dependencies are.
So when network teams are presented with a roadmap they haven’t been involved in developing, they’re naturally raising red flags, and progress stalls.
This disconnect is creating big problems. Gartner predicts that by 2028, almost a third (30%) of organizations will abandon their zero trust implementations, thanks to complexity, cultural resistance, and lack of integration. And a similar number (32.6%) of network teams say conflicts and communication issues with security undermine their ability to support zero trust.
Successful Zero Trust Doesn’t Start With Purchasing Decisions
One of the reasons why networking and security teams have to work together for a successful deployment is that zero trust isn’t a product.
It’s a mindset rather than a single solution or platform – one that’s completely opposed to the legacy castle and moat model that blindly trusted any user or device inside the network. It requires a very different way of thinking about how organizations and their users, devices, and non-human identities (NHIs) connect securely to each other.
There are approaches, processes, and tools that help build zero trust frameworks – like microsegmentation, policy-based identity controls, and monitoring and analytics – but these are zero trust enablers, not solutions.
The companies that are succeeding with zero trust implementations start by identifying the highest-priority surfaces that need protecting, mapping the flows of data associated with them, and identifying who and what needs access.
Once these have been established, the gaps, existing tools and infrastructure, and alignment and integration challenges should drive an evaluation of what technologies and operational changes are needed to create a zero trust environment.
This process can’t be done by either networking or security alone. Since effective security controls are built into the fabric of the network, both teams need to be in the same room from the very beginning.
Change Must Be Structural as Well as Technological
In many organizations, security and networking teams are already working together around joint tools and a greater level of shared visibility. This is a strong start, but on its own it’s not enough for zero trust, which demands structural change to succeed.
Zero trust isn’t achieved by one team leading another. It must be approached as a joint infrastructure venture, and it demands a deep level of collaboration. This starts with shared goals, accountability, and even governance.
And critically, it needs to be led from the top. Change always meets resistance, but zero trust demands a new working model to succeed. Networking and security leaders must build trust by showing a clear willingness to move forward in partnership and leave behind the inter-departmental conflicts of the past.