Read More>> 
Hype, Overhype and Misconceptions
Time and again, the world of marketing has witnessed several “buzzwords” being used vehemently to capture the attention of the audience. On different occasions and in different contexts, humans have elevated marketable terms into buzzwords to leverage the hype in the market.
The IT industry is not untouched by the buzzwords and the hype that are created from those catch-phrases. Over the years, terms such as AI and ML have been extensively used for something which is the result of automation.
In the same vein, “Zero Trust” is arguably one of those cliches that have been exploited and overused in the cyber security space. When Zero Trust started to become mainstream about four years ago, we saw literally every organization with its “Zero Trust solution” and every event organizer create a psychological hammering on the customers with this term. Numerous thought leadership webinars, roundtables, and panel discussions have been done around this, but the core value of this concept is somehow submerged under this overhype. On most occasions, people have missed the central idea of this concept. There are so many misconceptions.
Moreover, much to our surprise, we have recently come across many IT professionals and organizers who went on saying that Zero Trust is a thing of the past– so marketers should focus on some “new” catch-phrases.
So, that brings us to debate whether “Zero Trust” is really just a marketing buzzword. Or, is it more than that?
Zero Trust: Understanding the Framework
First and foremost, Zero Trust is a security framework and not a compliance mandate such as PCI DSS, ISO 27001 and SOX. This framework is based on the principle that all trusted IT entitlements in the ecosystem must be verified for trust at every level of access. Whether it is the network, user, device or data, each and every access to all IT infra components must be attested to a set of verification layers along with context-based authentication.
Why is Zero Trust so Important in Today’s IT Context?
The Zero Trust extended framework, which resonates with Gartner’s Continuous Adaptive Risk and Trust Assessment approach (CARTA) is a radical shift from a perimeter-centric security or network security to combined data- security and network-security centric approach.This model challenges the conventional security approach because the latter is tilted in favor of perimeter (network) security and assumes that there is no threat inside the inner realm of IT kingdom.
That thinking is wrong. If that’s the case then why are we witnessing so many data breach incidents? The Zero Trust extended model and CARTA never assumes “trust” but it continuously assesses “trust” using risk-based assessments available from information gathered.
Moreover, the modern-day enterprise IT ecosystem is highly distributed. End users access databases, applications, APIs, IaaS and PaaS resources from remote, third-party, and MSP environments. These emerging technologies and access use cases have necessitated implementation of a Unified Data Security and Access policy to protect IT resources.
The framework essentially requires constructing micro-perimeters and micro-segmentations for governing scattered digital identities including the entitlements so that access to every critical IT resource is secure, controlled, and documented.
The basic Zero Trust foundation therefore requires comprehensive understanding of the IT infrastructure. To successfully implement it, IT risks management must ensure that security analytics and orchestrated Zero Trust architecture offers greater security and visibility. There is nothing such as the ‘Zero Trust solution’, but a robust solution can help to build the Zero Trust architecture.
Building Zero Trust Privileged Access Security with ARCON | PAM
In 2109, ARCON was one of the first Privileged Access Management vendors to explain how comprehensive security can be ensured in the Privileged Access environment by implementing the Zero Trust model.
Having a comprehensive knowledge of emerging use cases arising from day-to-day IT operations, ARCON has architected the best-in-class solution to support the enterprise Zero Trust journey and the much evolved CARTA framework.
Here are the four enablers, on the basis of which ARCON | PAM supports the Zero Trust framework:
Enabler 1: Establishing Trust: ARCON | PAM has high maturity when it comes to verifying the “Trust”, as one can configure various tests to be performed before the “Trust” can be established. The solution allows for the establishment of trust not only in identity but also in various access management elements such as MFA, Adaptive Authentication, and device and location verification, all while continuously monitoring and assessing the same using risk-based assessment methodologies.
Enabler 2: Enforcing Access Control: If one were to apply the CARTA principles, then the expectation is to ensure that while one is accessing the systems, there is constant monitoring of whether what is done is right. This is echoed by the ARCON Predict | Protect | Prevent Model. If Knight Analytics is configured, it provides constant monitoring of who, when, and what is being accessed as well as what activities are executed on the systems.
Enabler 3: Micro Segmentation of Network: ARCON | PAM provides network overlays, network encryption, software-defined perimeter (SDP), and host-based agents to achieve network segmentation and micro-segmentation.
Enabler 4: Robust Detection & Response: ARCON | PAM offers robust threat detection capabilities in the form of session monitoring with textual context and commands executed on various systems. The detection capabilities have been further improved with the AI/ML leveraged Knight Analytics tool, which provides predictive capabilities and identifies anomalies or threats at an early stage.
Conclusion:
There are many misconceptions about Zero Trust, but if the model is properly designed, the framework can aid in the establishment of a solid foundation for network, device, user, and data security.
