Guides

Zero Trust Strategy

Building Your Zero Trust Security Strategy in 7 Steps

What Is a Zero Trust Strategy?

A zero trust strategy is a plan that organizes an organization’s security controls and practices around zero trust principles. It ensures that in order to access applications and data, all users inside and outside your organization’s network must be authenticated, authorized, and continuously verified.

A zero trust security strategy addresses the challenges of today’s complex IT environment. It can provide solutions for concerns such as:

  • Securing corporate environments that do not have a clearly defined perimeter
  • Defending identities (such as user accounts and service accounts), possibly the biggest attack surface in the modern enterprise
  • Protecting remote workers and the assets they access
  • Storing data across hybrid and multi-cloud environments
  • Preventing lateral movement and privilege escalation
  • Enforcing security measures like strong authentication and encryption
  • Protecting against malware and other risks from unmanaged, personal devices

In this article:

Why Is a Zero Trust Strategy Important?

The scale and severity of data breaches are always on the rise, making it increasingly important for businesses to take a proactive security approach to protect their data. Traditional security approaches that treat everything internal as trusted, with protective measures focused externally, are no longer adequate because breaches can come from inside the organization.

Adopting a new security strategy is daunting, but zero trust provides a simple, scalable way to boost an organization’s defenses. Standard security tools like VPNs and firewalls don’t protect against malicious insiders and human error because they implicitly trust all entities within the protected network. Attackers can steal sensitive data as soon as they breach the network.

With zero trust, attackers cannot move laterally or perform harmful actions once they’ve infiltrated the system. Every resource enjoys full internal and external protection. Everything is closed by default, and access only becomes available when needed. It also alleviates the burden on IT teams and programmers to build secure applications, extending the responsibility for security across the organization and implementing ubiquitous access controls.

Related content: Read our guide to zero trust security

Challenges of Implementing Zero Trust

Complex Infrastructure

In modern organizations, infrastructure consists of multiple data centers, some owned by the organization and some by third-party providers. In each of these data centers there might be servers, containers, networks, proxies, databases, applications, and software-as-a-service (SaaS) solutions. All these assets and infrastructure elements must be included in the zero trust security model.

Another dimension of complexity is the need to protect legacy applications together with modern, cloud-based infrastructure. The interfaces between these two types of systems can create yet more security challenges, which can make it difficult to consistently implement zero trust across the entire enterprise.

Lack of an Integrated Toolset

Many organizations attempt to build a zero trust architecture based on point solutions. For example, they try to integrate microsegmentation tools, software-defined boundary tools, and identity-enabled proxies. To enable access control they might use a mix of VPN, multi-factor authentication (MFA), device approval systems, and single sign on (SSO) solutions.

However, many of these systems depend on a cloud provider, operating system, and device. Many organizations do not have a homogenous set of devices, and operate in multiple clouds and physical data centers. Users run Mac, Windows, and Android devices, and servers can be multiple Linux distributions. Networks are often built with equipment from multiple vendors.

Relying on zero trust tools that are specific to certain elements of the ecosystem can create needless complexity and lead to uneven and inconsistent implementation.

Cost and Effort

Implementing zero trust requires a significant investment of time, human resources, and financial resources. It takes careful thought and collaboration to understand how the network is partitioned and who needs to be given access to which areas. Next, teams need to figure out the best way to authenticate each user and device before granting access.

Adjusting Mindsets

Building a zero-trust model in large organizations requires the consent of key stakeholders to ensure proper planning, implementation, and training. This program affects almost everyone in the organization, so all leaders and managers need to agree on a plan. Many political factors can significantly affect the success of a project, and this means organizations require time to align and agree to the transformation.

7 Steps to Building Your Zero Trust Security Strategy

1. Use Identities to Control Access

Identities (representing people or service accounts) are a common denominator throughout an organization’s networks, applications, and endpoints. The zero trust security model is a granular and flexible way to control data access. New boundaries created by zero trust systems are based on strong, validated identities.

When an identity requests access to a resource, the security controls use strong authentication to verify that identity and ensure the access request complies with the organization’s policies, and that the relevant identity is accessing resources according to the least-privilege principle, and that the access attempt is not anomalous.

2. Adopt a User-Centric Approach

At the heart of the zero trust concept is understanding the transfer of responsibility to end-users, and the need to emphasize security at the user level. End-users should be empowered to access the resources they need, and should be accountable for their actions after gaining access.

End-users should have access to self-service systems that can help them enroll devices in MFA and install certificates. They should be made responsible for patching personal devices to the level required for access, and complying with other relevant security policies.

3. Incorporate Passwordless Authentication

Passwordless authentication replaces a traditional password with an authentication factor protected by two or more pairs of cryptographic keys. After registration, the device generates a public key and a private key. It is possible to unlock the private key using a mechanism like a PIN sent to a mobile device or via biometric authentication.

4. Segment Your Corporate Network

Firewalls are an existing form of segmentation in most organizations, but the segmentation they provide is not sufficiently granular to implement zero trust.

For zero trust, it is critical to implement deeper microsegmentation within the network, because in a mobile and cloud-first ecosystem, all access to business-critical data is through network infrastructure. Network controls compatible with zero trust principles can increase visibility and help stop attackers from moving laterally through your network.

Related content: Read our guide to zero trust network

5. Segment Your Applications

It is important to find the appropriate balance between providing smooth access and maintaining controls to protect applications and their data. Apply security controls and scanning technologies to identify shadow IT, enforce proper in-app permissions, block access according to real-time analytics, restrict certain user actions, monitor network activity for anomalous behavior, and verify secure configuration options.

Learn more in our guide to application segmentation

6. Secure Your Devices

In the zero trust model, it is important to secure access from any device—whether it is company-owned or personally-owned (known as Bring Your Own Device or BYOD), and whether it is accessing systems from within the corporate network or over public networks.

Employees, contractors, partners and guest devices are all subjected to security checks—whether IT fully manages the device or only protects applications and data. This is true regardless of whether the endpoints (PCs, Macs, smartphones, tablets, wearables, or IoT devices) use a home broadband, secure corporate network, or public Internet connection.

7. Define Roles and Access Controls

With the growth in remote work, companies must consider alternatives to implementing modern security controls. Enabling roles and associating them with policies is critical for authorization, passwordless access, single sign-on, and segmentation. However, each defined role creates management overhead, so you should carefully organize and limit the number of roles you define.

Zero Trust Security with Calico

Calico Enterprise and Calico Cloud enable a zero trust environment built on three core capabilities: encryption, least privilege access controls, and identity-aware microsegmentation.

  • Encryption – Calico utilizes WireGuard to implement data-in-transit encryption. WireGuard runs as a module inside the Linux kernel and provides better performance and lower CPU utilization than IPsec and OpenVPN tunneling protocols. Calico supports WireGuard for self-managed environments such as AWS, Azure, and Openshift, and managed services such as EKS and AKS.
  • Least privilege access controls – Calico implements least privilege access controls by denying all network traffic by default and only allowing connections that have been authorized. This applies to traffic between microservices as well as ingress and egress outside the cluster. Calico also integrates with native Kubernetes RBAC to provide authorization and authentication for various users and teams.
  • Identity-aware microsegmentation – Calico leverages its cloud-native model to divide workloads into smaller security segments and then applies security policies for these segments. This prevents lateral movement of threats by reducing and minimizing the attack surface.

Next steps:

Join our mailing list​

Get updates on blog posts, workshops, certification programs, new releases, and more!