Zero trust and (why it isn’t always about) identity

Neil Thacker, CISO EMEA, Netskope.

---

What is the relationship between zero trust and user identity? There’s no doubt that identity is a fundamental component of an effective zero trust approach, but there is also a danger that organisations become so overly focused on this one element, they forget there are others.

To believe that achieving zero trust is all about user identity is, I believe, a fundamental misunderstanding of the concept. This misconception can lead to potential vulnerabilities that, in turn, can result in major cyber security events – the kind of events that the organisation was attempting to avoid by adopting zero trust in the first place.

Identity is indeed a fundamental factor of zero trust and, for many years, companies have used multi-factor authentication (MFA) to ensure their sensitive data is protected. However, the threat landscape is evolving and some experts now estimate that up to 70% of MFA options are as easy to breach with social engineering and phishing.

Outside of the cyber security world, we would not place our trust in someone based on one factor alone. Trust is a multifaceted process that must build up over time. Likewise, there must be multiple forms of verification in order for zero trust to be achieved. Oversimplifying the complexity of this process risks giving the false impression of safety and opens the potential for a major cyber breach.

Zero trust must start with the assumption that your system can and will be compromised. The more measures put in place to protect it, the more trust we can put into it. Crucially, a single policy enforcement point (PEP) must be used to control the traffic of information flowing in from these different measures.

Identity authentication is one of the first, and one of the most commonly used, measures for zero trust and should be a core part of any strategy. This includes things like decentralised identity, more advanced MFA frameworks and password-free biometric methods. However, it is not sufficient by itself.

1. Device

It’s not just who you are, but what device you’re using. A fully authenticated user on a compromised device is still a security risk. Zero trust should differentiate corporate and personal devices, examine device health, patch levels and security configurations before granting access.

2. Location

With the rise of hybrid working, organisations should anticipate users attempting to access material from different locations. Therefore, there must be a system that can flag unusual trends. For instance, if a user attempts to login one day from London, and then in the next hour from the other side of the world, this should be flagged in the system – it should not be left up to chance. Similarly, the system should flag if someone is logging in at the same time from two disparate locations.

3. App

With the rise in cloud services, there are many competing apps that perform the same function. Therefore, security teams should be vetting and approving specific apps for corporate use and, where necessary, putting in place advanced controls and/or restrictions on unapproved applications to mitigate potential data loss.

4. Instance

Within each cloud app, there are also different types of instances of the same app. For example, many organisations allow employees to use their personal cloud apps such as personal instances of Microsoft 365. This, however, can lead to an issue especially if confidential corporate data is being shared to a personal app. Therefore, each instance of each app should also be understood.

5. Activity

Zero trust extends into how applications interact with each other and how they access data. Even within a single user’s session, the actions an application takes on behalf of that user are subject to scrutiny.

6. Behaviour

Identity may grant users initial access, but behaviour thereafter should be continuously scrutinised. If an employee (or entity) starts accessing large volumes of data suddenly or downloads sensitive files, alarms should sound, even if the user was initially authenticated.

7. Data

At the heart of zero trust is data – it’s all about ensuring data integrity and confidentiality. This means encrypting data at rest and in transit, and monitoring data access patterns for anomalies, regardless of the user’s identity. This would include measures to automate data categorisation and implementation of specific or enhanced controls should that category require.

Identity is undeniably a cornerstone of the zero trust model, but it remains just one piece of a complex structure. If an organisation overly fixates on identity, they’re setting themselves up for failure and leaving themselves at risk to the kind of cyber breach that zero trust is designed to prevent.

True zero trust is only achieved when an organisation has an integrated, holistic approach that considers every touchpoint, user and device. By incorporating all eight elements into their zero trust approach (including identity), organisations can operate with far greater confidence and security can become a true enabler, making it possible to innovate and adapt to whatever the business needs, whether that means adopting new applications, integrating AI, expanding into new markets or encouraging hybrid work.