3 Common Mistakes in Zero-Trust Initiatives

Mistake No. 1: Thinking That Zero Trust Can Be Installed

A zero-trust security framework is not a product that can be licensed or installed. It is a strategy that defines a holistic approach to cybersecurity that shifts the traditional network security focus from protecting a perimeter to protecting assets and users.

“Zero trust is the term for an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets and resources,” according to the National Institute of Standards and Technology’s Special Publication 800-207. “A zero-trust architecture uses zero trust principles to plan industrial and enterprise infrastructure and workflows.”

NIST adds that zero trust has been made necessary by a number of trends in recent years, including an increase in remote workers and BYOD policies, as well as the growth of cloud-based assets located outside organizations’ own perimeters. SP 800-207 notes that “zero trust focuses on protecting resources (assets, services, workflows, network accounts, etc.), not network segments, as the network location is no longer seen as the prime component to the security posture of the resource.”

The Cybersecurity and Infrastructure Security Agency spells out five pillars of a zero-trust model: identity, devices, networks, applications and workloads, and data. By far, identity and data governance serve as the model’s cornerstones; any zero-trust initiative must prioritize identity and data access controls, Candillo says.

In a zero-trust environment, that verification happens continuously, ensuring that even when bad actors somehow gain access to a network, they can’t hang around for long.

LEARN MORE: Uncover 4 adaptive cybersecurity controls to include in a zero-trust strategy.

Mistake No. 2: Ignoring User Experience Quality

Implementing a zero-trust framework typically requires shifting an organization’s philosophy around cybersecurity, Candillo says. Often, organizations embark on a zero-trust journey thinking that they can continue to use “their old siloed teams and management styles, isolating security teams, network teams, application teams and system administrators,” he says. “A successful zero-trust transformation also requires a cultural transformation.”

Beyond ensuring that essential teams work together to implement the approach, thoughtful consideration must be given to users, especially clinicians, and their experiences engaging with or working for the organization. User education and opportunities to make users part of the solution help create “a culture where securing organization assets and patient data is a top priority and taken very seriously by everyone,” Candillo says.

Ultimately, when users aren’t satisfied with the tools required or with their experience gaining access to resources, they’ll turn elsewhere. For employees, that may involve reliance on outside software or tools. Patients, on the other hand, may seek a new health system or clinic for a better experience.

Mistake No. 3: Failing to Set Effective Policies for Accessing Data

As an organization’s zero-trust adoption matures, getting a handle on the data or resources that specific users need can be an ongoing challenge — but it’s not an insurmountable one.

When every user, piece of data and device is considered an asset to be protected, IT teams can no longer rely on manual network inventories. Cloud-native network management and inventory management tools provide real-time insights and visibility on use, helping teams set priorities and appropriate access privileges.

“Combining due diligence around access governance and implementing things such as behavior analytics and adaptive authentication can be steps in the right direction,” Candillo says. “Don’t try to achieve 100 percent zero trust across the entire organization in the short term. Instead, after you’ve laid the foundation, focus on locking down a specific protect surface or a group of critical systems or assets that you are trying to protect.”