Eager to close the loop on corporate assets and improve threat protection, many global enterprises are looking for new ways to approach cybersecurity.
Enter the Zero Trust framework. Originally coined by former Forrester analyst John Kindervag in 2010, this dynamic strategy has the power to harden cyber defenses and take security to the next level.
However, implementing Zero Trust isn’t a walk in the park. In most cases, it’s a multi-year journey that requires company-wide effort to accomplish. Luckily, organizations can assess their progress and take guidance from the Zero Trust Maturity Model (ZTMM).
In this guide, we’ll walk you through the basics of Zero Trust and how the maturity model can help you complete a successful implementation.
Zero Trust security explained
Zero Trust is based on the principle of “never trust, always verify.” It encompasses many cybersecurity tactics where access to data, networks, and infrastructure is kept to a minimum, and the legitimacy of that access is continuously authenticated. The combination of these various techniques layered on top of one another is what’s known as a Zero Trust architecture (ZTA).
According to the National Institute of Standards and Technology (NIST), a ZTA is an enterprise cybersecurity strategy that applies Zero Trust principles to component relationships, workflow planning, and access control policies. In short, organizations that implement Zero Trust security take a hard stance against implicit trust, assuming that all users, devices, and cloud applications requesting network access may be potential threats.
Like any data security policy, the Zero Trust model aims to protect sensitive data and other corporate assets from unauthorized access and exposure. But, unlike traditional methods, it focuses not only on the network perimeter but on any and all vulnerabilities inside and out. Simply put, Zero Trust security assumes internal traffic isn’t any more trustworthy than traffic coming from outside the network.
This makes all the difference in today’s environment. With users needing to leverage critical work applications from anywhere, at any time, and on any device, organizations must adopt new policies that can flexibly adapt to their changing risk landscape.
Why is Zero Trust necessary?
The truth is that cybersecurity has never been more complex. In an era of rapid digital transformation and cloud acceleration, traditional network security tools don’t stand a chance of protecting sensitive data — and certainly not at the success rate expected of today’s organizations. Beholden to both compliance regulations and consumer responsibility, enterprises are under pressure to upgrade their cyber defenses and keep information under lock and key.
Attacks on the rise
Here’s the problem: Cyber threats are evolving and becoming more sophisticated over time. Yet, perimeter-based security controls are stuck in the past.
Take malware, for instance. This threat vector saw a rapid resurgence in 2022, climbing to a whopping 2.8 billion attacks just one year after hitting a seven-year low. However, what’s more frightening is that hackers deployed over 270,000 malware variants, the likes of which security experts had never seen.
Traditional detection-based techniques rely on a combination of technology and human judgment — and with that comes human error. With an infrastructure based on implicit trust, it’s only a matter of time before an attack slips through the cracks and bypasses your cyber defenses.
Even worse, enterprises are dealing with an increasingly high volume and velocity of threat vectors. From ransomware and phishing to DDoS attacks and insider risks, organizations are under fire like never before. In fact, 68% of businesses around the world have experienced a cyber attack in the past 12 months.
Keep in mind that successful attacks can have significant consequences. According to IBM, the average cost of a data breach is almost $4.5 million per incident. By 2025, global cybercrime will cost companies a combined $10.5 trillion annually — up from $3 trillion in 2015.
Regardless of size, businesses simply can’t afford the long-tail costs of poor data security. Critical events can impact organizations in many ways, whether it be a prolonged business disruption or a major compliance violation. No matter the type of attack or how it originates, the mess created can take months, if not years, to clean up.
Digital transformation
These challenges are compounded by the recent and sudden transition to hybrid, cloud-first work environments.
It’s no secret that the COVID-19 pandemic greatly accelerated cloud transformation. In fact, McKinsey research indicates the majority of organizations speeded the adoption of digital and cloud services by an average of seven years. Now, it’s predicted that the total amount of cloud data — which includes public, private, and government clouds — will surpass 100 zettabytes by 2025. For context, that’ll be over 50% of the world’s data at that time, up from 25% of what was stored in the cloud in 2015.
This surge is no doubt a response to the increasingly distributed work environment. Currently, 78% of global employees prefer remote or hybrid to in-office work. So, more likely than not, flexible arrangements are here to stay. Unfortunately, this is putting a tremendous strain on enterprise security teams.
Not only are distributed workforces relying on cloud applications to stay productive, they’re also accessing them — alongside other network resources — on unmanaged devices. That means security teams cannot secure data in use or in movement to and from personal endpoints, creating a glaring hole in their perimeter. Worse yet, because cloud adoption continues to rise, these vulnerabilities are growing at an exponential rate.
Bottom line: With attack surfaces stretched thin, existing cyber defenses are inadequate against a growing swarm of potential risks.
What is the Zero Trust Maturity Model?
Developed by the Cybersecurity & Infrastructure Security Agency (CISA), the Zero Trust Maturity Model is a roadmap for transitioning to a Zero Trust architecture. The model, originally intended for federal agencies, aims to help organizations leverage Zero Trust principles and better protect sensitive assets.
CISA released version 1.0 in September 2021, as directed by President Biden’s executive order on cybersecurity. An updated version, released in April 2023, added a fourth maturity stage alongside additional guidance on Zero Trust implementation.
The model reflects the seven tenets of the Zero Trust framework, as established by the NIST:
- All data sources and computing services are considered resources.
Translation: Networks are composed of many devices, applications, and other resources that may have access to enterprise-owned assets. Therefore, they should be treated as potential risks.
- All communication is secured regardless of network location.
Translation: Location alone doesn’t imply trust. Access shouldn’t be automatically granted based on the device being on enterprise network infrastructure. Regardless of where a request originates, it must meet the same security requirements.
- Access to individual enterprise resources is granted on a per-session basis.
Translation: Just because a device is trusted in a previous session doesn’t mean it should be inherently trusted for the next. Each session must be authenticated so that the user’s identity can be continuously validated.
- Access to resources is determined by dynamic policy.
Translation: Authorization decisions should take external sensors into consideration. This includes a user’s location, device, and real-time application context.
- The enterprise monitors and measures the integrity and security posture of all owned and associated assets.
Translation: No device or asset receives implicit trust. Every request triggers a security posture assessment, and all assets are continuously monitored to ensure they’re updated, safe, and uncompromised.
- All resource authentication and authorization are dynamic and strictly enforced before access is allowed.
Translation: Trust is granted on an ongoing basis, factoring in a myriad of elements before making an enforcement decision.
- The enterprise collects as much information as possible about the current state of assets, network infrastructure, and communications and uses it to improve its security posture.
Translation: Collecting analytics and insights on assets can enhance decision-making and avoid risky approvals.
These tenets lay the groundwork for an effective ZTA and are therefore essential to achieving Zero Trust maturity. As we dive into the model in more detail, it’s best to keep these principles in mind.
The levels of Zero Trust maturity
CISA created the ZTMM to help agency IT departments strengthen their security postures through a Zero Trust strategy. However, its highly prescriptive nature lends itself to organizations of all varieties, outlining actions that any enterprise can take to better protect sensitive information.
The four levels of Zero Trust maturity include:
- Traditional: At the most basic level, organizations have manually configured lifecycles and attribute assignments, static security policies and solutions that only address one pillar at a time, and siloed policy enforcement capabilities.
- Initial: Organizations at this stage start to automate configurations, attribute assignments and enforcement decisions. They begin implementing responsive changes to least privilege after provisioning and aggregate more visibility into internal systems.
- Advanced: Enterprises use automated controls for lifecycle configurations, attribute assignments, and cross-pillar coordination. They have centralized visibility and identity control. They’re also able to enforce integrated policies across pillars and dynamically make changes to least privilege based on risk and posture assessments. They’re actively building toward enterprise-level awareness.
- Optimal: At the most mature level, organizations have fully automated lifecycles and assignments of attributes to assets and resources that self-report with dynamic policies based on automated triggers.
Generally, these maturity stages represent the ideal progression from a traditional security stature to one that features dynamic updates, automated processes, integrated capabilities, and other best practices.
5 pillars of Zero Trust maturity
The ZTMM consists of five main pillars, each with its own individual and cross-functional security controls. By addressing these areas, organizations create a comprehensive and adaptive security framework.
1. Identity
Perhaps the most important pillar, identity focuses on user access management in a dynamic environment, emphasizing continuous validation and behavioral analysis. Why? Because in a post-perimeter world, people are at the forefront of security.
According to Verizon, over 80% of breaches due to hacking involve lost or stolen credentials. Zero Trust mitigates this risk by enforcing a policy of least-privilege access. In short, this means users are only allowed to access resources that are essential to their role, thus preventing lateral movement in case of a breach.
2. Devices
The ZTMM defines a device as any asset — including hardware, software, firmware, etc. — that connects to a network, including servers, computers, printers, mobile phones, IoT devices, and so on.
Regardless if the device is enterprise-owned or not, Zero Trust advocates for maintaining an inventory of all assets with network access. By enhancing visibility into these devices, organizations can keep tabs on their configurations, associated vulnerabilities, and patch requirements.
3. Networks
A network is considered any open communications medium used to transport messages. That includes internal and wireless networks, the Internet as a whole, as well as cellular and application-level channels.
Organizations that have a mature Zero Trust architecture focus less on perimeter-based security and more on managing internal and external traffic flows. This allows them to isolate risks, enforce encryption, and practice “microsegmentation” — the process of breaking the network down into pieces, thereby creating boundaries that keep threats at bay.
4. Applications and Workloads
This pillar encompasses all systems, computer programs, and services that execute on-premises, on mobile devices, and in the cloud. This area is of particular importance now that the majority of businesses are adopting cloud services at lightning speeds.
According to the ZTMM, organizations should apply granular access control and threat protection policies capable of mitigating application-specific threats.
5. Data
Data at rest, in use, or in motion — it doesn’t matter. Zero Trust principles say that all structured and unstructured files and fragments should be continuously monitored, encrypted, categorized, and labeled regardless of where or how they’re stored.
Specifically, organizations should deploy mechanisms to detect and prevent data exfiltration. The ZTMM also says it’s best to craft and review governance policies to ensure security procedures are enforced across the enterprise.
Cross-cutting capabilities
Additionally, CISA’s maturity model also outlines three “cross-cutting capabilities” that organizations are meant to use throughout their Zero Trust journey. They’re intended to support interoperability and cross-functionality, thus weaving together the five pillars.
These include:
- Visibility and Analytics: Increases line of sight, informs policy decision-making, and facilitates response activities in case of threat detection
- Automation and Orchestration: Leverages analytics and other insights to streamline operations and mitigate security risks as they arise
- Governance: Enables organizations to manage and monitor their regulatory, legal, environmental, federal, and operational requirements
Strengthening these abilities is key to a fast and effective Zero Trust migration. Organizations can conduct a maturity assessment to better understand where they’re currently at in their journey. Once you’ve evaluated and identified your stage, you can implement CISA’s guidance for progressing to the next phase of maturity.
Identity Access Management: The foundation of Zero Trust
Mobile and cloud-first transformations have erased the traditional security perimeter. In its place stands a distributed, decentralized, and sprawling environment. With threats looming on the horizon, secure access is a must-have for enterprises of all shapes and sizes — if only it were that easy.
The fact of the matter is Zero Trust is a complex, multi-year commitment. The good news? There are ways to simplify the process.
Users are your first line of defense in today’s threat landscape, but they’re also your greatest risk. Protecting identities is key to preventing unauthorized access and exposure — that’s why Identity Access Management (IAM) is a pivotal first step in the right direction.
At Entrust, we designed our comprehensive IAM portfolio to empower organizations as they begin their Zero Trust journey. Our solutions use a variety of technologies to help you protect identities, secure data, and safeguard applications, including:
- Multi-factor authentication
- End-to-end encryption
- Single sign-on
- Adaptive risk-based authentication
- Passwordless security
- Identity proofing
As your partner, we can help you strengthen your security posture and advance your place on the Zero Trust Maturity Model. So, take the next step in your journey and explore Entrust’s Zero Trust solutions today.
