{"id":3729,"date":"2023-04-25T14:57:05","date_gmt":"2023-04-25T18:57:05","guid":{"rendered":"https:\/\/www.indigoconsulting.ca\/?p=3729"},"modified":"2024-01-31T18:17:26","modified_gmt":"2024-01-31T23:17:26","slug":"why-zero-trust-doesnt-mean-zero-threats","status":"publish","type":"post","link":"https:\/\/www.indigoconsulting.ca\/fr\/blog\/why-zero-trust-doesnt-mean-zero-threats\/","title":{"rendered":"Why zero trust doesn’t mean zero threats"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\"\"<\/p>

Traditional approaches to cybersecurity aren\u2019t working anymore, and here\u2019s why.<\/span><\/p>

We live in a world of smart homes and remote work, a world of sprawling digital supply chains and complex partner ecosystems. Traditional security controls were created in a different time for a different world. They are archaic, trust-based systems reliant on a security perimeter that no longer exists.\u00a0<\/span><\/p>

Zero trust has emerged as a touchstone of this new world, a worthy replacement for the old ways of network security. Unfortunately, as is often the case with buzzworthy concepts and ideas, there’s no shortage of myths and misconceptions.\u00a0<\/span><\/p>

One of the most prevalent is that idea that zero trust is some sort of magic bullet, the answer to all your cybersecurity challenges.<\/span><\/p>

To better understand why that’s not the case, it’s important to first understand the origins of zero trust \u2014 along with its shortcomings.<\/span><\/p>

\u00a0<\/p>

Leaving the Perimeter in the Past<\/span><\/strong><\/h2>

Traditional cybersecurity is predicated on the existence of a clearly-defined network perimeter. Under this security model, an organization has total control over everything within its digital walls. Those on the inside can access business assets and resources, while those on the outside cannot.<\/span><\/p>

Even in its earliest days, this approach was imperfect and ill-suited to deal with telecommuting. Supporting remote staff typically required the deployment of complex virtual desktops and virtual private networks, both of which came with their own security risks and integration challenges. At the time, however, remote work was enough of a rarity that this was a non-issue.\u00a0<\/span><\/p>

Then the world changed.\u00a0<\/span><\/p>

It started with cloud computing and mobile devices. Where there was once a clear division between internal and external, these two interrelated technologies blurred those lines. Attack surfaces, once static and clearly defined, had started to become mercurial and nebulous.\u00a0\u00a0<\/span><\/p>

Amidst this evolution, legacy methods of remote network access started to show their age from both security and a usability standpoint. Many of these tools treated remote users as though they were part of the corporate network, opening the door to all manner of threats. To make matters worse, legacy network access solutions suffered from frequent usability shortfalls. <\/span>
<\/span>Outdated software was not the only issue, either. Trusting every entity on one’s network \u2014 regardless of how or from where those entities gained access \u2014 was a clear recipe for disaster. All it would take for a breach was a single error in judgment on the part of a supplier, vendor, partner, or employee.\u00a0<\/span><\/p>

All a threat actor needed to do was get onto a business’s network, and they had the figurative keys to the kingdom.\u00a0<\/span><\/p>

The pandemic was the final nail in the coffin. As businesses around the world transitioned to distributed work, they could no longer ignore the shortcomings of legacy security. They needed a new approach.\u00a0<\/span><\/p>

Zero trust, a concept first introduced by analyst Forrester in 2010, proved a perfect fit.<\/span><\/p>

\u00a0<\/span><\/p>

Never Trust, Always Verify<\/strong><\/span><\/h2>

The core ideas behind zero trust are relatively simple:\u00a0<\/span><\/p>