Zero Trust is one of those most critical terms that already live rent-free in IT managers’ heads. It’s way past the emerging buzzword stage — now, Zero Trust is a security model that dictates organizational cybersecurity strategies and general security approaches.
But how influential is the Zero Trust model? What’s its role in the near future and its place in a broader picture of cybersecurity? Let’s take a look at what trends to expect in the Zero Trust department.
Password is dead; long live Zero Trust?!
The new cybersecurity era will likely be marked by another iconic moment in the digital age. Rumor has it that we will be done with the passwords in 2023. Hard to say if it’s true, but passwords as single-factor authentication are outdated in the context of the current cybersecurity landscape.
Lost or stolen credentials surge black markets imposing risk to data security. A glance at the high numbers of the latest data breaches of 2022:
- Slash Next reports 255 million phishing-related attacks in 6 months — a 61% increase compared to 2021.
- According to Verizon, weak or stolen passwords contributed to 81% of hacking-related data breaches. 82% of breaches were triggered by human error (including social engineering attacks).
- Nvidia suffered an attack and lost the credentials (email addresses and Windows password hashes) of 71,000 employees.
Keeping in mind that 73% of employees recycle the same personal passwords for work-related accounts – NordLayer’s research about bad cybersecurity habits concluded weak passwords as one of the top vulnerabilities of organization security – the number of leaked personal credentials is a huge red flag for organizations.
Despite education and targeted reminders of password hygiene, more than half (59%) of workers tend to reuse passwords while being familiar with existing risks.
The remaining high data breach statistics only confirm the insufficiency of current actions regarding securing credentials and company data accordingly.
The Zero Trust mindset to ‘trust none; verify all’ is a straightforward change for companies to dismiss careless passwords from their systems and elevate security levels effectively.
A quick recap: ZT, ZTA, and ZTNA
Zero Trust (ZT) is a trust algorithm that ensures resources within specific networks can be accessed only by verified endpoints — devices or users. Yet when discussing cybersecurity, additional concepts of Zero Trust Architecture (ZTA) and Zero Trust Network Access (ZTNA) emerge — what’s the difference?
An easy way to differentiate Zero Trust, Zero Trust Architecture, and ZTNA is to define Zero Trust as the driving idea, model, or mindset that puts the theoretical foundation for the application of the method.
The Zero Trust principle turns attention to the main focus points:
- Make sure to check and verify every endpoint connection request to the network.
- Solely job-mandatory access rights must be granted to perform role objectives.
- Plan for the maximum constraint of user movement in the network in case of a breach.
Zero Trust Architecture is a practical application of the Zero Trust approach when building security policies and IT infrastructure as if there was no traditional perimeter. ZTA combines and implements solutions for:
- Endpoint verification
- Network supervision.
ZTNA is a segment of Zero Trust Architecture that provides a solution to trusted-only application access. ZTNA is integral to the SASE and SSE frameworks for establishing security in remote cloud environments.
What changes does Zero Trust employ: ZTNA’s focus
Instead of discussing Zero Trust at theoretical levels, it’s beneficial to investigate ZTNA to understand what changes it suggests and how companies apply them.
According to Statista, the most common solution organizations used to enable Zero Trust segmentation in 2021 was ZTNA. Identity, Credential, and Access Management followed it.
The popularity of ZTNA comes from its adoption as a more efficient identity- and context-supported solution for controlling increasing attack surfaces in hybrid environments.
As ZK Research indicates, VPN was a go-to solution to manage and protect companies’ IT perimeters. However, VPN performance and security fallbacks brought by backhauling network traffic and open network access make it refer to VPN as a remote work solution only as a temporary one.
Therefore, to secure and connect remote workers while managing distributed endpoint, user, and application networks under the organization’s scope, companies turned to secure network access (SaaS, cloud, and edge) solutions, including ZTNA.
Shrinking the attack surface – limiting the threat actor’s activity in the network by requesting additional authentication or assigned permits to access internal applications – is the key feature of the ZTNA solution.
Prospects of Zero Trust in cybersecurity
Cyberattacks continuously challenge everyone, from consumers to federal agencies, hitting the weakest link — passwords. Attacks are disrupting business operations from intelligence businesses to manufacturers — any company with internet-connected systems and networks is vulnerable.
The Zero Trust approach can mitigate hardly controllable external and internal factors that might lead to a breach. ZTNA enables IT administrators to monitor, manage and interact with connections between endpoints and ultimately conclude whether the connection should be approved or denied.
Driving factors of ZTNA adoption
The peak of ZTNA matched with hybrid and remote work developments globally introduced by the COVID-19 pandemic. Although opinions tend to clash, remote work is here to stay, and ZTNA maintains its importance to business network security.
To securely return to old ways of working – the static office-contained perimeter, which is the least challenging to maintain and control – all of the workforce should come back to their corporate desks.
Migration to the cloud is gaining momentum as it offers more flexibility and reduces the complexity of traditional IT perimeter.
The password more often causes security issues than prevents it and needs to be reconsidered and redesigned to move to more sustainable solutions.
Evolved understanding of a workplace with WFA (Work From Anywhere) quickly showed the comforts of working from home or cafe, answering work emails from a personal phone, or watching TV series on a corporate laptop after working hours. Yet these blurred lines stretch the reach of unapproved applications and devices blending into the company network.
Although the digital landscape and new modern habits might be alarming, going backward seems unrealistic. Thus ZTNA helps manage current cybersecurity challenges in this technological evolution.
State of remote work
There’s no denying that companies will have to accept the turned tables — employees now consider not how many days they will decide to work from home but how often they are willing to show up in the office.
If the workforce is not to return to the office full-time, ZTNA naturally cannot be discarded from the company’s cybersecurity strategy.
According to ZK Research 2022 Work-from-Anywhere Study, just one – or even less – out of 10 employees consider 100% work on-site, leaving most of the workforce a risk factor to data and application security.
How do companies adopt Zero Trust?
Zero Trust is dominant in creating security strategies. Statista survey revealed that one-third of polled companies, as of January 2022, already had a formal strategy actively embracing a Zero Trust policy. Only 20 percent of respondents had no Zero Trust strategy as of 2022.
Statista also concluded that almost one-fifth of respondent organizations completely discard the Zero Trust model as a cloud security strategy while the vast majority (81%) fully or partially embrace Zero Trust model guidelines for building internal security policies.
It’s safe to say that Zero Trust has been assigned an important and influential role in shaping the security infrastructure face. The mindset combines Zero Trust backed practices of accountability, consistency, dependability, and transparency to activities and processes within the organization network.
How to transition to Zero Trust?
Benefits for businesses that adopt ZTNA to enhance the security of their network. Deploying Zero Trust-based features establishes secure cloud access and allows network segmentation for least privileged access to resources.
The model reduces insider threat by protecting internal applications and lowering the potential of account breach risk. Overall, ZTNA adoption supports the company’s journey to achieving compliance requirements.
Zero Trust Network Access is a predominant framework of any setup that deals with hybrid work as an alternative to VPN. NordLayer solution makes implementation of ZTNA easy and integrable despite the existing infrastructure in your company. Reach out to learn more about securing your business network with ZTNA within minutes.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
Marvin Petzolt, Senior Application Security Engineer at Nord Security
Tom Okman, Co-founder of Nord Security
Since the establishment of Nord Security and until this year, we have operated without external funding – and we have learned many lessons. Last week, I had the great honor of presenting our main takeaways from this bootstrapping journey on the stage of Web Summit. Here are the four main insights that I shared for founders focused on bootstrapping their business:
#1 Perfect your company’s mission
Your company’s mission is not just a catchy slogan you place on your “About” page and then forget about it. Your mission is the underlying DNA of every meeting and every creative solution, and it works in the background every time your people decline offers from other companies.
When you raise funding, it’s easy to lose sight of why you started your company in the first place. But when you are bootstrapping, your mission and your customers guide your business path. So bootstrapping founders, instead of focusing on raising the next round of funding, look for innovative ways to turn their mission into a reality. They are also more receptive to what customers are saying to them. That feedback naturally helps polish and evolve your mission over time, which in turn helps improve your corporate and product strategies. And it comes with a bonus – the company develops a solid internal culture.
#2 Build local, ship global
Some entrepreneurs are wary of using local talent pools, especially if the business is starting outside established startup hubs like Silicon Valley or Israel. However, that was not the case in our story. In fact, we were fortunate to start our company in Lithuania. While funding was scarce when we started, the local ecosystem, partners, and infrastructure helped us immensely in getting our business off the ground. People in Lithuania are talented and keen to prove themselves to their international peers. So one of our best decisions early in the business was to tap into that talent pool and support from local associations and policymakers.
Today, more than ever, talent and support for entrepreneurs are spread throughout Europe, both in traditional tech hubs and rising startup center’s. As a result, the startup world is getting flatter, so now is the best time to take advantage of building locally while shipping globally.
#3 Focus on the customer
Customers are royalty, especially when entrepreneurs operate without external funding. In such cases, customers become leading investors and the most sustainable source of financing, and startups must focus on them above all else. So to be successful, entrepreneurs have to build a product that their customers will love and want to pay for, meaning that creating a market fit for products becomes central to a startup’s survival. Unfortunately, you don’t have a large treasure chest on your side when you are bootstrapped, so the key is to be efficient in adapting to your customer’s feedback.
#4 Take risks and be nimble
The bootstrapping route empowers entrepreneurs to take charge of the big decisions when it comes to vision, hiring, operations, or finances. That gives self-funded startups an edge because they can be much more flexible, agile, and tenacious than other companies. But at the same time, not taking outside financing pushes entrepreneurs to be hungrier in finding ways to improve their business. Because knowing that customers are critical, you can’t simply spend your way out of problems. In Nord Security’s case, it usually meant taking risks and being the pioneer in educating the market and customers about a new use case, product feature, or upcoming challenges.
While such a situation might sound precarious, in a way, it also means returning to what makes startup culture great – the ability and willingness to be inventive and take risks. But it is essential to be decisive when things need to be fixed and be bold in pivoting because inertia can sometimes be more dangerous than recklessness. This combination can prove extremely potent if entrepreneurs allow themselves to be guided by their leading investors – the customers – and their mission-driven culture. But only if founders are willing to lean into it fully. 
