A mature and measurable zero-trust programme might be an enterprise’s goal, but few organisations have actually completed their implementations, said Gartner recently.
While zero trust is top of mind for most organisations as a critical strategy to reduce risk, the advisory firm predicted that only 10% of large enterprises will have a mature and measurable zero-trust programme in place by 2026, up from less than 1% today.
Gartner defines zero trust as a security paradigm that explicitly identifies users and devices and grants them just the right amount of access so the business can operate with minimal friction while risks are reduced.
Many organisations established their infrastructure with implicit rather than explicit trust models to ease access and operations for workers and workloads, said John Watts, VP Analyst at Gartner.
“Attackers abuse this implicit trust in infrastructure to establish malware and then move laterally to achieve their objectives,” he noted. “Zero trust is a shift in thinking to address these threats by requiring continuously assessed, explicitly calculated and adaptive trust between users, devices, and resources.”
To complete the scope of their zero-trust implementations, it is critical that organisations start to develop an effective zero-trust strategy which balances the need for security with the need to run the business.
“It means starting with an organisation’s strategy and defining a scope for zero-trust programs,” said Watts. “Once the strategy is defined, organisations must start with identity, which is foundational to zero trust.”
In addition, organisations need to improve not only technology but also the people and processes when building and managing those identities, he added.
Watts warned that organisations should not assume that zero trust will eliminate cyberthreats, adding that zero trust helps reduce risk and limit impacts of an attack.
Gartner analysts predict that through 2026, more than half of cyberattacks will be aimed at areas that zero- trust controls don’t cover and cannot mitigate.
The enterprise attack surface is expanding faster and attackers will quickly consider pivoting and targeting assets and vulnerabilities outside of the scope of zero-trust architectures (ZTAs), said Jeremy D’Hoinne, VP Analyst at Gartner.”
“This can take the form of scanning and exploiting of public-facing APIs or targeting employees through social engineering, bullying or exploiting flaws due to employees creating their own “bypass” to avoid stringent zero-trust policies,” he noted.
Gartner recommends that organisations implement zero trust to improve risk mitigation for the most critical assets first, as this is where the greatest return on risk mitigation will occur.
In addition, organisations need to run a continuous threat exposure management (CTEM) program to better inventory and optimise their exposure to threats beyond the scope of ZTA, Gartner pointed out.
