Cybersecurity vendor Forescout Technologies has partnered with cloud security provider Netskope to expand zero trust security coverage across enterprise networks.

The new integration combines Forescout’s real-time device intelligence with Netskope’s AI, cloud security, and private access controls to deliver zero trust for managed and unmanaged IT, OT, IoT, and IoMT devices.

The pair said the joint solution continuously adapts access decisions based on device posture and risk to ensure zero trust is enforced, regardless of where devices connect.

Unlike traditional zero trust network access (ZTNA) deployments that focus exclusively on north-south cloud traffic, the Forescout-Netskope integration secures east-west communications at the local network level.

In an announcement, Forescout CEO Barry Mainz said the collaboration will help organizations shrink their attack surface as digital environments continue to grow in complexity.

“The volume and variety of device types are exploding, along with the number of applications, users and access points,” he explained.

“By joining forces with Netskope, we are bringing together two best-of-breed solutions, granting customers complete visibility and control over their environments, with policies that automatically adjust as conditions change, and enabling north-south and east-west security policy enforcement.

“This is a gold standard of how ‘Universal’ Zero Trust Network Access is employed in practice, not just as a model.”

Addressing enterprise blind spots

The duo said the move addresses a crucial enterprise challenge in which disparate and disconnected security tools are often managed by siloed teams, creating blind spots and restricting control and policy enforcement.

To overcome this hurdle, the new integration applies granular zero trust policies universally, identifies unmanaged or hidden endpoints, and adapts access decisions in real time based on behavior, device health, and application sensitivity.

Other benefits include improved containment of cyber threats through its east-west local traffic controls, streamlined compliance with frameworks such as HIPAA, NIST, and CIS, as well as automated enforcement to reduce reliance on manual security updates

Sanjay Beri, CEO of Netskope, said a zero trust approach has become essential to secure data and ensure business resilience in the cloud and AI era.

“Our integrated solution with Forescout was designed for the scale, speed, and diversity of today’s modern enterprises, and provides the cohesive, centralized secure access organisations need,” he commented.

FOLLOW US ON SOCIAL MEDIA

A stereotypical view of cybersecurity extends the physical security metaphor, with servers bolted down with chains and only the most privileged employees allowed anywhere near them. However, doing cybersecurity thoroughly now encompasses entire supply chains, with weak links across suppliers, channel partners, and Managed Service Providers (MSPs) causing exploitable vulnerabilities of monumental proportions.

What’s often misunderstood is that many channel partners and MSPs sit directly in the middle of the modern supply chain. They frequently hold elevated access into multiple customer environments, operate critical components of those environments, and act as extensions of internal IT teams. This makes them unusual actors in the security ecosystem: they are simultaneously prime targets for attackers and frontline defenders for the organizations they support.

The cyber attacks that plagued numerous UK companies in 2025, including The Co-op, Harrods, M&S, and Jaguar Land Rover, forced many organizations to re-examine their security posture as the perimeters are redrawn so much more broadly. The M&S incident, which rendered online systems inoperable for weeks and led to a £300 million profitability hit, originated via a third-party supplier. And most recently, Salesforce confirmed they have faced two third-party incidents in one year, via its SaaS partner Gainsight.

Research we conducted before these high-profile incidents indicated that 42% of organizations had concerns about vendors triggering major cyber incidents. Given the recent supply chain breaches we have seen, we suspect that this figure is now underrepresentative. Even organizations that have zero-trust architecture and state-of-the-art disaster recovery plans are still vulnerable to human weaknesses across their whole extended supply chain.

These examples, among many others, highlight how much more complex the challenge is now: what happens when the breach originates with a partner who has deep, sometimes privileged access into your environment?

Channel partners and MSPs are part of the infrastructure

For many organizations, channel partners and MSPs are core building blocks of the operational estate. They manage cloud platforms, identity systems, monitoring tools, development pipelines, endpoint fleets, and security controls. In other words, they are part of the infrastructure.

This interconnectedness means that if an MSP is compromised, attackers may gain horizontal access to the environments of multiple customers at once. The Kaseya attack in 2021 demonstrated this at a global scale, but 2025 has shown it’s now a mainstream, recurring risk.

As a result, organizations must shift their mindset from “suppliers supporting the business” to “suppliers embedded inside the business architecture.” Visibility, governance, and shared security controls across MSP-managed systems are no longer optional but essential for maximum protection.

Protecting the human layer

Recent breaches have been attributed to human vulnerabilities in organizations that supply products and services to others. The M&S incident appears to have been borne out of a social engineering tactic, giving an entry point into the organization that bypassed regular technical defences. These attacks are successful not through sophisticated technical exploitation but by manipulating individuals who already have legitimate access to systems.

Artificial intelligence (AI) has amplified these risks by scaling up more sophisticated social engineering attacks. AI-powered tools enable attackers to create more convincing phishing emails, generate realistic deepfake communications, and personalise attacks based on information gathered from social media and other public sources. AI has effectively lowered the barrier to entry for cybercriminals and also increased the potential impact of their activities.

While many organizations have invested heavily in internal cyber-awareness programmes, the new reality is that every supplier and MSP with environment access must be held to the same behavioural and security standards. Regular compliance checks, audits, and zero-trust approaches must be extended to the partner ecosystem. Without continuous validation, the most secure organization may still be exposed through a partner’s weakest link.

The importance of resilience and recovery

After the security challenges of 2025, it's naive for anyone to believe that a complete modern security posture will prevent every breach. Beyond prevention, organizations must be able to detect, respond to, and recover from threats, including those triggered within their partner ecosystem.

This is where visibility becomes critical. Organizations need centralized oversight of MSP-managed systems, identity access, configuration drift, and partner-initiated changes. Hidden dependencies, particularly those controlled by partners, can dramatically extend downtime if they aren’t identified and tested in advance.

Our research showed big gaps in organizations being prepared to recover, with 84% of them lacking a decent incident response plan, and only 16% finding them effective if they had them. This means that most organizations need to find time and effort to actually test their plans before they're really needed.

Organizations need to define Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for critical systems, and to have their eyes open to systems that might be hidden dependencies, including those run by third parties or their staff. These need to be tested regularly through drills - this helps identify dependencies and other challenges that may not be apparent when things are running normally.

Critical systems also require offline, immutable backups that cannot be compromised during an attack. Too often, organizations discover after an attack that backups managed or maintained by partners were incomplete, inaccessible, or misconfigured.

Conclusion

The events of 2025 show that cyber attacks are increasingly sophisticated and now exploit not only technical vulnerabilities inside an organization but also those embedded throughout its supply chain. MSPs and channel partners, sitting at the centre of this ecosystem, have become both high-value targets and vital protectors.

Effective cybersecurity now requires that these organizations and their partners give equal attention to prevention and recovery capabilities, with the time taken to get back online having similar importance as the essential preventive measures.

Those that fully understand and lock down their supply chain from a security perspective, implement strict access controls with zero-trust architecture, and have properly tested recovery plans will have the best chance of surviving the next wave of threats to cybersecurity.

The US National Security Agency (NSA) has released Phase One and Phase Two of its Zero Trust Implementation Guidelines.

The guidelines cover what's needed to achieve the Department of War's (DoW) targets for zero trust maturity.

Phase One and Phase Two aim to move an organization from discovery to target-level implementation by mapping out the activities, requirements, precursors and successors that are needed.

According to the NSA, the phased design of the guidelines means they're modular and highly customizable, allowing the implementation of both foundational and advanced activities, as well as the ability to tailor them to align with individual goals and constraints.

They build on the NSA's Primer and Discovery Phases, released earlier this month, and are aligned with existing federal frameworks, including the DoW CIO’s Zero Trust Framework.

What the zero trust guidelines get right

Brian Soby, CTO and co-founder of AppOmni, said there's a lot that the guidelines get right, adding that the move represents a positive step in helping organizations shore up identity security.

"The guidance pushes maturity beyond 'authenticate, then trust', toward ongoing decisions driven by what the user is doing, what privileges are being requested, and what resources are being touched," he said.

"That matters because the attacks that are winning right now are post-auth. Device posture and login checks are necessary, but against modern SaaS compromise they can be largely performative if you cannot detect abuse happening inside the session, inside the application."

Soby also praised the way that zero trust is presented as an operating model, not a product.

Policies are required to be centrally defined, consistently applied, continuously assessed, and enforced through co-ordinated policy decision points and policy enforcement points.

This includes requirements for real-time monitoring and automation to adapt as conditions change.

When it comes to User and Entity Behavior Analytics (UEBA), Soby noted the guidance takes the right approach, focusing on behavior baselining, analytics, and context enrichment so that anomalies are detected based on behavioral patterns and resource access, not just simplistic indicators like login location.

"That's the right direction. ‘We saw a new IP’ is a weak signal,” he commented. “The higher-signal story is what happened in the application: Privilege use, data access, configuration changes, creation of integrations, unusual exports, and lateral movement across SaaS capabilities.

"The higher-signal story is what happened in the application: Privilege use, data access, configuration changes, creation of integrations, unusual exports, and lateral movement across SaaS capabilities."

Why some zero trust efforts fall flat

Soby warned that most zero trust implementation projects are missing the core points. A key factor here is that they focus too heavily on zero trust network access (ZTNA) considerations, and ZTNA-only architectures are often easier to bypass.

Meanwhile, organizations fail to recognize that each application is its own policy decision point and policy enforcement point.

“This is the core point that gets ignored. The guidance treats policy decision points and policy enforcement points as essential building blocks that must be coordinated. The problem is that many organizations pretend the only real decision and enforcement happens at the identity provider or a proxy," he said.

"In reality, every application, SaaS or otherwise, is itself a policy decision point and policy enforcement point. The application decides what a user, integration, service account, or agent can do, and it enforces that decision.”

Soby noted this is “especially true” in cases where identities don’t “traverse the enterprise front door” - for example, with customers, partners, and external collaborators.

FOLLOW US ON SOCIAL MEDIA

Fears over unverified AI-generated data are pushing organizations to implement a zero trust posture for stronger data governance.

Large language models (LLMs) are typically trained on web-scraped data, and as the use of generative AI grows these sources increasingly contain AI-generated content.

This is set to accelerate in the coming years, according to Gartner. Analysis from the consultancy found 84% of respondents expect their organization to increase funding for generative AI in 2026 – meaning that the volume of AI-generated data will continue to rise.

As a result, future generations of LLMs will increasingly be trained on outputs from previous models – outputs that may be inaccurate or biased. This means an ever-heightening risk of “model collapse,” where AI tools’ responses may no longer accurately reflect reality.

"Organizations can no longer implicitly trust data or assume it was human-generated,” said Wan Fui Chan, managing VP at Gartner.

“As AI-generated data becomes pervasive and indistinguishable from human-created data, a zero trust posture establishing authentication and verification measures is essential to safeguard business and financial outcomes.”

By 2028, Gartner found the proliferation of unverified AI-generated data is set to have prompted 50% of organizations to have implemented a zero trust posture for data governance.

Active metadata management practices will become a key differentiator for firms, the consultancy said, and organizations should consider taking several strategic actions.

How to approach a zero trust data governance strategy

According to Gartner, IT leaders should appoint a dedicated AI governance leader, responsible for AI governance, including zero trust policies, AI risk management, and compliance operations.

This person should work closely with data and analytics (D&A) teams to make sure that both AI-ready data and systems are capable of handling AI-generated content.

Cross-functional teams should also be established, including cybersecurity, D&A, and other relevant stakeholders.

These teams will carry out comprehensive data risk assessments to identify business risks related to AI-generated data - and decide which activities need new strategies.

Elsewhere, building on current D&A governance frameworks will be crucial to tackling the issue, according to Gartner. The creation of new or updated frameworks will focus primarily on updating security, metadata management, and ethics-related policies to address new risks arising from AI-generated data.

Regulatory compliance challenges are afoot

As AI-generated content becomes more prevalent, Chan warned that regulatory requirements for verifying ‘AI-free’ data are likely to intensify.

Crucially, these could differ significantly across geographies, posing serious compliance challenges.

“In this evolving regulatory environment, all organizations will need the ability to identify and tag AI-generated data," he warned.

"Success will depend on having the right tools and a workforce skilled in information and knowledge management, as well as metadata management solutions that are essential for data cataloguing.”

FOLLOW US ON SOCIAL MEDIA

Microsoft says agentic AI has helped identity and network access teams spot more than 200% more missing baseline policies – so now it's widening the public preview of its Entra Agent ID to keep tabs on agents and other new risks to zero trust strategies.

Microsoft first unveiled a preview of Entra Agent ID in May, and Joy Chik, president of identity and network access at the tech giant, said it quickly became clear that few companies were aware how many agents were active in their environment.

"Before you can securely manage, protect, and govern this new type of identity, you need visibility," Chik said in a blogpost.

"Then you need the right controls, because agent sprawl can quickly lead to excessive permissions, orphaned accounts, and increased risk."

Chik cited a recent Microsoft study that found admins using its Conditional Access Optimization Agent in Microsoft Entra finished key tasks 43% faster and with 48% more accuracy. Alongside that, she reported a 204% improvement in spotting missing baseline policies.

New AI tools for access

Microsoft has now added new tools to its existing Entra solution, which manages identity and network access, to help manage and govern agents, secure access to AI resources for the workforce, and strengthen security via multi-layer access controls.

Chik added that the wider Microsoft Entra Suite is getting new AI powered features.

"First, we’re expanding Microsoft Entra Internet Access to secure access to and usage of generative AI (GenAI) at the network level," she said.

"Our Secure Web Gateway (SWG) is now a Secure Web and AI Gateway. It allows you to secure, govern, and monitor access to any AI or agent from any provider, running on any platform."

What to expect with Entra Agent ID

Entra Agent ID allows companies to use the same tools for workforce identification as it does for AI agents, Chik said. That includes maintaining an inventory of an agent fleet, regulating access to resources and data, and governing them via corporate policies.

"Lifecycle management and IT-defined guardrails, for both agents and the people who create and manage them, keep your agent fleet under control," she added.

The Public Preview of Entra Agent ID also now features AI-powered tools including prompt injection protection, network file filtering, and blocking unsanctioned access to Model Context Protocols (MCP), which allow AI agents access.

Plus, Entra Agent ID now detects shadow AI, helping security teams spot unsanctioned AI tools and letting them monitor usage trends and block risky apps.

"With these controls, you can accelerate GenAI adoption while maintaining compliance and reducing risk, so employees can experiment with new AI tools safely," Chik added.

Beyond those tools, the public preview also includes user-centric access reviews, risk-based approval in entitlement management, threat intelligence and URL filtering, and guest access.

Safer access for AI agents

Microsoft Entra Agent ID can also manage access to Microsoft Agent 365, the dashboard for AI agents unveiled at Microsoft's Ignite conference.

"It takes the same infrastructure that you trust to manage and secure your people and extends it to agents, equipping frontier organizations with leading Microsoft security, productivity, and collaboration solutions," Chik added.

The launch marks the latest in a string of product announcements at the tech giant’s annual conference in San Francisco, which naturally has had a sharp focus on agentic AI.

Microsoft introduced its own MCP Server for enterprise at the event. Entra can be used to manage access, with Agent ID handling authentication and least-privilege access controls.

MORE FROM ITPRO

• Microsoft: get used to working with AI-powered "digital colleagues"
• Microsoft expects 1.3 billion AI agents to be in operation by 2028 – here’s how it plans to get them working together
• Microsoft quietly launched an AI agent that can detect and reverse engineer malware

Properly implemented zero trust security could head off nearly a third of cyber attacks globally, saving up to $465 billion in financial losses every year.

An analysis of hundreds of thousands of cyber incidents by cloud security firm Zscaler found that the overall figure was higher in Europe, where 41% of events were assessed as being potentially preventable through zero trust architecture, compared with just 31% in North America.

It's companies with over US $1 billion in revenue that have the most to gain from deploying zero trust. In 2023, the researchers said, zero trust could have averted as many as six in ten of all incidents involving companies with revenue over $100 billion.

The industries with the most to gain, meanwhile, were construction, wholesale trade, information, and manufacturing. Finance and insurance, mining oil and gas, and utilities were assessed as likely to see the smallest benefit from zero trust, although even here, it could have averted at least one in five incidents.

"This report underscores the importance of recognizing zero trust as a fundamental cybersecurity control that fortifies cyber hygiene," said Stephen Singh, global vice president for M&A/divestiture and cyber risk at Zscaler.

"With the external attack surface identified as a key predictor of potential breaches, adopting zero trust and phasing out outdated, high-risk technologies such as firewalls and VPNs shows a dramatic reduction in risk exposure."

It's the rising tide of ransomware – up 126% over the year – that's making zero trust more vital. And while attacks by some of the larger ransomware gangs are becoming increasingly sophisticated, Zscaler said many of these could have been mitigated by the use of zero trust.

Implementing zero trust can also make for cheaper insurance, with some cyber insurance underwriters taking it into account when calculating business risk.

"We now have independent validation that zero trust offers significant benefits for cyber security practitioners responsible for mitigating business risk - companies that prioritize zero trust investments gain a significant edge as cyber defenders," said Darin Hurd, CISO at Guaranteed Rates.

And, said Tim Riley, SVP of product at cyber insurer Resilience, "Through our ongoing engagement with clients to quantify and mitigate cyber risk, Resilience can affirm that adopting a zero trust architecture strengthens an organization's ability to withstand and recover from cyber incidents."

Organizations do seem to be catching on to the benefits. A recent report from AlgoSec, for example, found that more than half of organizations are now fully or partially implementing zero trust, although one in five said they were still in the learning phase.

And, the researchers found, some were struggling, finding it difficult to translate zero trust principles into actionable policies, especially when it came to complex multi-cloud and hybrid environments.

But, said Scott Stransky, managing director and head of the Marsh McLennan Cyber Risk Intelligence Center, and leader of the Zscaler study, "The large cost associated with the lack of zero trust reveals its true value to companies and the cyber world."

AI agents need to be treated like any other employee, at least when it comes to security, and that means they can't be trusted by default and need their own secure identification.

With zero trust in mind, Microsoft will be extending its security and identity tools — Entra, Purview, and Defender — to cover AI agents developed using its own tools, as well as a few key partners.

"These announcements underscore our commitment to providing comprehensive security and governance for AI, with technology built on the security lessons of the past and in line with our Secure Future Initiative principles," noted Vasu Jakkal, Corporate Vice President at Microsoft Security, in a blog post.

The zero trust announcement comes alongside wider AI news from Microsoft's Build conference, held in Seattle this week, including the general availability of Azure AI Foundry Agent Service to help companies deploy agentic AI using pre-built or custom agents.

Alongside the zero trust announcements, Microsoft also revealed evaluation and monitoring tools built into Azure AI Foundry to help detect and block prompt injections as well as task adherence to keep agents in line.

Agentic AI is the latest big tech trend, with industry leaders previously suggesting this marks the latest step in the natural evolutionary path of generative AI. But concerns over security have come to the fore as the industry pivots to the technology.

Earlier this year, ITPro was told that while AI agents could mark a step change in cybersecurity, the technology also has the potential to leave enterprises vulnerable to a range of new threats.

Microsoft has made its intentions clear in the agentic AI space, having already unveiled agents for its Security Copilot service. These new security features look to further bolster protection for enterprises dabbling in the technology.

Microsoft Entra Agent ID

Microsoft has unveiled a system for managing and security agentic AI called Microsoft Entra Agent ID, which manages AI agents to ensure they don't have access to data, apps, or other infrastructure without first being validated via the zero trust policy.

"Now, AI agents created within Microsoft Copilot Studio and Azure AI Foundry are automatically assigned identities in a Microsoft Entra directory — analogous to etching a unique VIN into every new car and registering it before it leaves the factory — centralizing agent and user management in one solution," said Jakkal.

The system will work with ServiceNow and Workday, integrating into their agent platforms and providing automated provisioning of identities, Jakkal added.

Purview and Defender

Alongside Entra Agent ID, Microsoft is also extending its Purview data security and compliance controls to AI agents built within Azure AI Foundry and Copilot Studio, as well as custom-built AI apps via a new software development kit (SDK).

"Developers can leverage these controls to help reduce the risk of their AI applications oversharing or leaking data, and to support compliance efforts, while security teams gain visibility into AI risks and mitigations," Jakkal said. "This integration improves AI data security and streamlines compliance management for development and security teams."

Similarly, the tech giant is adding security tools from Defender directly into Azure AI Foundry.

Jakkal noted that this integration “reduces the tooling gap” between security and development teams, meaning the latter can “proactively mitigate AI application risks” and potential vulnerabilities.

MORE FROM ITPRO

• OpenAI just launched 'Codex', a new AI agent for software engineering
• Microsoft expects 1.3 billion AI agents to be in operation by 2028 – here’s how it plans to get them working together
• GitHub just unveiled a new AI coding agent for Copilot – and it’s available now

Network visibility challenges and rising cyber threats are prompting a step change in security strategies, according to new research, with firms ramping up zero trust capabilities.

Findings from AlgoSec’s 2025 State of Network Security report show seven-in-ten security teams report visibility issues, which is delaying threat detection and response.

Respondents to a survey by the firm warned that a lack of insight into application connectivity and poor alignment of security policies on these fronts now represent ‘significant’ risks for enterprises.

Notably, a key factor behind these challenges lies in the increased adoption of multi-cloud architectures, the report noted. Running parallel to multi-cloud adoption strategies, many firms are now accelerating the adoption of zero trust tools and practices.

"As businesses expand their digital footprints across hybrid and multi-cloud environments, securing network infrastructure has become a top challenge," said Eran Shiff, VP of product at AlgoSec.

"We are seeing a major shift toward automation, orchestration and risk mitigation as key security priorities. Adoption of SD-WAN and SASE continues to rise, while awareness of AI-driven security and zero-trust principles is stronger than ever."

Firewalls were another major worry cited by security professionals, according to AlgoSec’s report. Multi-vendor strategies are making firewall deployment more challenging thanks to the need for robust orchestration tools to prevent misconfigurations, maintain compliance, and reduce operational overhead.

Zero trust challenges

More than half (56%) of organizations are now fully or partially implementing zero trust, although one-in-five said they were still in the learning phase, AlgoSec found.

Security teams did highlight significant challenges in their zero trust journey, however. The study noted that teams often struggle to translate zero trust principles into actionable policies, particularly in complex multi-cloud and hybrid environments.

"This underscores the need for better education, clearer frameworks, and improved tooling to help businesses move beyond basic zero trust principles toward more robust, policy-driven implementations," the researchers said.

SASE adoption is also growing, with six-in-ten respondents saying they use it for deployment, up from 54% last year.

Similarly, AlgoSec highlighted a widespread move to AI security tools, which organizations said were improving real-time threat detection. Once again, implementation practices are still a key challenge alongside data privacy concerns.

Automation is now critical, the report found, with application connectivity automation ranked as the top priority for minimizing risk and downtime.

"Looking ahead, businesses that embrace proactive automation, centralized security policy enforcement, and risk-based decision-making will be best positioned to navigate the next phase of network security evolution," the report concludes.

"As organizations continue to adopt hybrid architectures, AI-driven security solutions, and zero-trust principles, the ability to adapt, automate, and secure at scale will be critical in ensuring a resilient and future-ready network security strategy."

MORE FROM ITPRO

• Implementing zero trust with the Internet of Things (IoT)
• Why businesses should embrace the zero trust networking trend
• Zero trust is about more than security – it's the foundation for digital transformation

With the number of IoT devices expected to skyrocket in the next four years, researchers have called on more robust cybersecurity protections to counter a wave of rising threats.

In a new study by Juniper Research, the number of devices is set to hit 28 billion globally by 2028. However, amidst this sharp growth, the increasing complexity of IoT networks means there's a greater need for effective frameworks that underpin security solutions.

A key factor in this call to action is the fact that industry has a fragmented approach to IoT security, researchers said.

"The IoT cybersecurity market is expected to reach $51 billion by 2028; partly driven by adoption from SMEs," said research author Michelle Joynson.

"To capitalize, vendors must simplify their solutions in a time when IoT architectures are becoming increasingly complex, and a greater number of connectivity technologies are used."

IDC advises enterprise IoT users to protect themselves against high-risk events such as data breaches, financial losses, and regulatory non-compliance by implementing zero trust architecture (ZTA) frameworks as a priority.

"ZTA frameworks operate on the principle that no device on a network is to be inherently trusted; requiring constant authentication," said IDC.

"These frameworks also offer greater visibility of IoT device activity through continuous authentication; enabling earlier threat detection and mitigation."

As for vendors, the scale of expected IoT growth and rapid pace of digitalization by SMBs means these frameworks will need to be deployed across IoT networks of various sizes.

As the number of networks grows, vendors should be leveraging the scalability of their ZTA frameworks to make sure that cybersecurity solutions can keep pace.

IoT remains a security blind spot for enterprises

IoT has become something of a wild west in terms of security, with connected devices representing the biggest targets in the UK last year.

Research from Beaming, for example, found there were at least 161 attacks on IoT devices per day, with threat actors increasingly targeting applications such as building control systems, network-enabled printers, remote monitoring tools, and industrial control systems.

According to the UK's National Cyber Security Centre (NCSC), many devices aren't secure by design or by default, aren't given regular firmware updates, or have weak authentication measures with limited logging, making it hard to detect suspicious activity.

Similarly, many may not be configured securely, lack proper network segmentation, or use unsupported or end-of-life (EOL) hardware.

Last year, analysis from WithSecure identified a steep rise in security incidents caused by the mass exploitation of IoT and edge devices, including MOVEit, CitrixBleed, Cisco XE, Fortinet’s FortiOS, Ivanti ConnectSecure, Palo Alto’s PAN-OS, Juniper’s Junos, and ConnectWise ScreenConnect.

Earlier this month, the Five Eyes cybersecurity agencies released guidance on how to secure edge devices, including IoT devices, recommending that they include and enable standard logging and forensic features that are robust and secure by default.

MORE FROM ITPRO

• New industry-backed IoT standards aim to bolster security
• Implementing zero trust with the Internet of Things
• What the Internet of Things (IoT) means for data security

Cognizant has announced an expansion of its existing partnership with Zscaler in a move designed to help customers simplify their security with AI-enabled zero trust cloud security solutions.

The freshly extended collaboration will see the pair offer AI-powered coordinated solutions and services to reduce organizations’ overall security complexity while maximizing security posture.

In an announcement, Cognizant CEO Ravi Kumar S said the move comes in response to the continued industry-wide challenges of increasing operational costs, skill shortages, and an evolving cyber threat landscape.

“Generative AI adds new dimensions to the scale and complexity of securing modern applications used by a technology-native workforce eager to unlock the value of unclassified, unvetted data,” he explained.

“Together, Cognizant and Zscaler are committed to providing cutting-edge, AI-enabled and cost-effective solutions that help clients stay ahead of the threat curve.”

The pair said the partnership will enable customers to streamline policy enforcement, bolster threat protection, and proactively isolate threats through an AI-powered cyber risk quantification offering backed by several key capabilities.

Organizations can leverage secure access service edge (SASE) to accelerate zero trust security and enable users, manage security at access points, improve the user experience, as well as optimize security costs.

The offering is also supported by secure branch capabilities through Zscaler’s Smart & Safe Store / Branch zero trust architecture for data management and storage.

This will be complement by secure hybrid cloud designed to amplify visibility, reduce threat posture, and simplify security policy management for hybrid cloud infrastructure, the pair said.

As a Zscaler customer, Cognizant said it will be empowered to accelerate business growth and help customers benefit from enhanced security capabilities. The firm also reiterated its commitment to investing in and further expanding its cyber security practice.

“We are excited to not only welcome Cognizant as a new Zscaler customer but also deepen our collaboration to help enterprises accelerate their Zero Trust security initiatives,” commented Jay Chaudhry, Zscaler’s CEO, chairman and founder.

“Legacy perimeter-based security solutions are not designed to deliver true zero trust, which can allow bad actors to infiltrate corporate networks and move laterally undetected while compromising sensitive data.

“Together, we aim to dramatically reduce business risk for our joint customers and provide comprehensive security solutions that address the needs of the highly mobile workforce and cloud-first enterprises as they continue their business transformation.”

The secure access service edge (SASE) model has come a long way since it was first coined five years ago – and offers a variety of capabilities to help organizations cope with securing networks as cyber security threats evolve. Such an architecture is a radical departure from the cumbersome and complex systems of old — and presents a radical simplicity for businesses hoping to combine networking and security as a service pillars into a cloud-deliverable service at the network edge. 

The need for SASE has largely been driven in recent years by changing working patterns, and the knock-on effect for organizations around the world. The surge in cloud computing following COVID-19 also lent itself well to the need to embrace SASE solutions, especially with an organization's network perimeter expanding into unknown territory. As Forrester analyst senior analyst Tope Olufon puts it when speaking to ITPro: “An increasingly distributed workforce and an increased adoption of cloud computing means the concept of a perimeter has become increasingly fuzzy.”

Of the many components of SASE, one of the most crucial is zero trust network access (ZTNA) – which, when integrated into SASE, allows zero trust by design across the breadth of the organization. Arguably, without such a component, the purpose of SASE is defeated. With the threat landscape constantly offering more challenges that businesses must overcome, embedding zero trust at the heart of any SASE initiative – and vice versa – could be the difference be  the difference between withstanding the onslaught and succumbing to it. 

The evolution of SASE

The concept of SASE originates from a Gartner report authored by analyst Frank Marsala, in which he argued that the enterprise perimeter could no longer be considered a physical location. Instead, Marsala said, it's a set of dynamic edge capabilities delivered from the cloud, as and when needed, as services. At the time, no single vendor offered the entire portfolio, but this has arguably changed five years on.

"SASE is a security model that provides secure access to applications and data in an organization," Raj Rajarajan, professor of security engineering at City St George's University of London, tells ITPro. "SASE incorporates many things such as firewall, network traffic monitoring, data loss prevention, cloud security broker, and many other services including providing access to assets. Hence it's an integrated security solution for cloud-based applications that is scalable and interoperable."

Now, the full SASE portfolio includes the secure web gateway (SWG), firewall as a service (FWaaS), cloud-access security broker (CASB), software-defined wide-area network (SD-WAN), and ZTNA, according to Palo Alto Networks.

With digital transformation increasing – as well as remote and hybrid working – more organizations have adopted SASE to develop an integrated security framework, says Rajarajan. This ensures any on-premises systems are integrated securely with remote systems and in the cloud. SASE also helps to avoid fragmentation of infrastructure.

"There is a lot of integration of SASE and zero trust today to address the next-generation security challenges from zero trust systems," he adds. "Many organizations find using SASE will provide a bird's eye view of the organizational assets, their interdependency, and hence can address any of the cascaded impacts in the unlikely event of a cyber-attack."

The rise of zero trust

Although zero trust may seem like a recent concept, the ideas behind it stretch back 30 years to a foundational computer science study in 1994. Using these ideas, it was then coined as a term in 2010 by then-senior Forrester analyst John Kindervag as a means to describe an antidote to the "broken" trust model in cyber security. However, it took at least another decade before his ideas would translate to rapid adoption among organizations across various industries. 

"Although zero trust has been around since 2010, the increasing remote working and the penetration of IoT devices in the enterprises have made it more attractive as a solution to address any of the access control challenges," says Rajarajan. 

"It does not trust any system and the users are continuously authenticated for privileged access to systems. That’s why it's called zero trust. It does not trust any edge device or systems or the cloud and the systems and users are continuously authenticated based on digital identity credentials, multi-factor authentication (MFA), or end-point security."

The rise of the cloud and SASE, in particular, has further demanded the integration of zero trust ideas into the foundation of a business' network-based security. "In the current landscape of remote work, implicit trust has lost its former prominence, making way for the ascendancy of zero-trust security principles," wrote customer identity and access management (CIAM) expert, Caroline Johnson in a Medium post. "Guided by tenets like “always-verify” and “least privilege,” zero trust redefines network security by providing comprehensive visibility across the entire network, whether situated in the cloud or conventional data centers."

Better integrating ZTNA into SASE 

Enterprises need to adopt zero trust privileged access management (PAM) within a comprehensive SASE framework to allow organizations to tailor the capabilities of a SASE model to the needs of privileged users, according to a blog post published by the Cloud Security Alliance. Zero trust PAM applies the principles of zero trust to managing and monitoring privileged access within an organization. Combining this with SASE means the network is secured for all users and the overall security posture is strengthened – reducing the risks linked with any insider threats or unauthorized access. 

SASE can also be integrated in a much more effective way if it adopts the principles of zero trust. Cloudflare, for example, highlights that SASE models that lean heavily on zero trust can safeguard an organization far better than if they didn't. When establishing access policies, zero trust-embedded SASE takes more than an entity's identity into account – also factoring in geolocation, device posture, enterprise security standards, and a continuous evaluation of risk.

"Zero trust can be useful in providing access control for authenticating any of the systems or cloud environments," explains Rajarajan, adding that zero trust is often a key sub-component of SASE solutions. "It's good to continuously authenticate the users and the edge devices as there are times at which you may have contractors working and they may no longer be eligible to access some of the corporate network assets. 

"If you incorporate the zero trust security framework it's unlikely they can get access to all systems without providing the credentials. In addition, zero trust is based on identity and hence it's easy to increase the security levels using MFA combining device hardware features together with user identity features. This can stop any unauthorized access as device fingerprints are unique and many users may not have the knowledge to get access to this data."

Zero trust is becoming synonymous with secure cloud transformation, and for good reason. IT leaders are increasingly finding that legacy security infrastructure cannot keep pace with the nature of modern business. There are new threats, new ways of working, and greater demand for simplified user experiences all pointing to the need for a dramatic rethink around the concept of trust. The sheer scale of the cyber security challenge means businesses can no longer afford to give end users the benefit of the doubt – trust needs to be earned.

Although legacy security infrastructure, such as VPNs and firewalls, do a good job of verifying identity initially, users are then trusted implicitly. Unfortunately, many businesses are all too familiar with the damage that implicitly trusting devices based on IP addresses or login credentials can create, rendering most security controls obsolete. This is something threat actors are becoming all too aware of.

Businesses are increasingly recognizing zero trust network access (ZTNA) as one of the most effective ways to achieve this rethink of trust. Zero trust effectively removes the element of trust across a network environment, with every connection request being considered a threat unless the user can prove they are trustworthy. Access is handled by granting resource permissions based on that verified identity, allowing the businesses to uphold the principle of least privilege without having to trust the user is who they say they are. This approach to security would otherwise be impractical with legacy technology, without imposing repeated identity checks on the end user and substantially degrading the user experience in the process. It’s no wonder then that the vast majority (90%) of IT leaders say they have either implemented or plan to implement zero trust network access within the next 12 months.

However, although awareness of the technology is high, the complexity associated with cloud transformation means many businesses are failing to fully realize the potential of ZTNA. 

Viewing security through a different lens

The fact remains that most businesses view ZTNA through the same lens as they do with most cyber security controls – that being to improve detection techniques and better protect sensitive data. This effectively silos zero trust to the IT and security departments, severely restricting its potential to transform operations more broadly.

According to Zscaler’s State of Zero Trust Transformation 2023 report, the vast majority of businesses cited improving threat detection (63%) and securing third-party remote access (44%) as the reason for implementing ZTNA. Just 27% of businesses said they were implementing the technology to improve connectivity across their workforce, and only 24% said it was to reduce complexity and costs.

Data like this exposes the challenge that IT leaders face. Cyber security is no longer just about defending data against hackers but is now ingrained in the fabric of every business function. When fully utilized, approaches like zero trust provide a way for businesses to simplify their entire technology stack in a way that makes overall objectives more achievable. Security should, and absolutely can play a major role in reducing expenditure and creating efficiencies.

Immediate cost savings

Zero trust is a modern approach to cyber security and as such it significantly reduces a business’ attack surface and the associated risk of a cyber attack. This naturally reduces the risk of subsequent financial penalties or costs associated with recovery efforts.

However, there are far more tangible benefits to zero trust that will produce savings almost immediately – provided approaches are allowed to spread across the entire organization.

ZTNA is one of the most effective approaches for enabling an agile workforce. By reducing reliance on legacy security technologies at the perimeter, which typically place greater restrictions on devices and remote access, employees are given greater freedom to work from where they want to, and how they want to. This gives organizations the opportunity to exploit the cost savings and business agility that hybrid or remote workforces create, while also removing the security concerns that typically undermine such approaches.

Making your business more efficient

Another, less apparent, benefit of embracing zero trust as an organization rather than as a siloed IT project is the visibility that it creates.

For example, organizations that have successfully woven zero trust throughout their business can see an inventory of their entire application estate, providing a far clearer picture of where risk can be further addressed, or where processes can be optimized. This isn’t simply refined to security-related data, as rich contextual data can provide businesses ways to spot processing inefficiencies in legacy technology, or areas that could be ripe for innovation or automation.

Prioritize user experience

Perhaps the most noticeable benefit that a holistic zero trust approach creates is a streamlined user experience.

Business security has always represented a compromise between the need to keep data secure while also allowing users to engage with that data in a way that does not hamper their ability to work productively. The best security systems also tend to be the most difficult to interact with; multiple identity checks, exceptionally robust password rules, and time-limited access can all be incredibly frustrating for the end user.

Simply put, ZTNA allows businesses to prioritize user experience for the first time. It enables users to interact with protected systems without having to provide gargantuan passwords or verify their identity each time they return to the data. This is true regardless of how the user interacts with the resources they need. For example, providers such as Zscaler offer integrated solutions that fit every employee type, whether they are office-based or remote, offering the same seamless sign-in experience across a variety of platforms and devices

The seamless experience made possible with ZTNA ultimately reduces security fatigue, giving employees more time and flexibility to access the data they need without fuss. Security checks feel less intrusive, less frequent, and no longer a barrier to getting work done.

Zero trust requires holistic thinking

Unfortunately, many businesses find it difficult to fully realize some of these benefits. By siloing this work to the IT department, the message is unable to permeate the board room.

It’s incumbent on IT leaders, particularly CIOs, to help show the full potential of zero trust in an organizational context; that the true goal of zero trust is simply to eliminate infrastructure complexity, wherever that may be. Based on Zscaler’s recent data, it is clear resistance to a holistic approach is common. However, whether it is reducing costs, shrinking admin work, or realigning hardware to better fit organizational objectives, every corner of an organization has the potential to thrive under a zero trust approach – not simply adapt to it.

Zero trust has become one of the most discussed cybersecurity strategies of recent years, reshaping how organisations of all sizes think about securing their networks and data. Zero trust network access (ZTNA) is one of the key technologies that brings this philosophy to life.

By applying granular, identity-driven controls to how users and devices connect with applications, ZTNA helps limit the reach of attackers, reduce the risks of credential compromise, and support increasingly distributed workforces.

Rather than relying on traditional perimeter defenses that implicitly trust anything inside the corporate firewall, ZTNA takes a zero trust approach that treats every user, device, and connection as potentially hostile until proven otherwise.

Unlike virtual private networks (VPNs) – which typically grant broad network access once authenticated – ZTNA only permits access to specific resources, and makes these decisions based on continuous checks of who the user is, their device, and the context of their request.

To help you make sense of ZTNA, we’ll look at what it is in more depth and explore why it’s proving so useful for modern organisations. We’ll also consider the limitations you need to be aware of, and how to go about selecting and implementing the right tools.

What is ZTNA and why is it useful?

In simple terms, zero trust network access (ZTNA) is a security framework built on the principle that no user or device should be trusted by default, whether inside or outside the corporate network.

Unlike older models that assume anything behind the firewall is safe, ZTNA insists on verifying each access attempt, enforcing strict identity and context checks before permitting entry to specific applications or services.

Central to most ZTNA platforms is the concept of a software-defined perimeter (SDP).

Traditional networks often expose broad sections of infrastructure to anyone inside. An SDP, by contrast, makes applications effectively invisible to unauthorised users. These resources only become visible once a user has authenticated and is explicitly approved for access.

Traditional networks often expose broad sections of infrastructure to anyone inside. An SDP, by contrast, makes applications effectively invisible to unauthorized users. These resources only become visible once a user has authenticated and is explicitly approved for access.

This is possible because an SDP separates the control plane from the data plane. The control plane handles user authentication, authorization, and policy enforcement, while the data plane manages the actual traffic between a user’s device and the application.

ZTNA usually integrates tightly with identity providers (IdPs) and relies on single sign-on (SSO) systems. Once a user authenticates via SSO – often through SAML or OAuth – their identity is continuously checked against policy rules.

Unlike VPNs, which grant wide-reaching network access after initial authentication, ZTNA establishes encrypted “micro-tunnels” on a per-application basis. Users connect only to the specific services they’re authorized for, meaning that even if credentials are compromised, attackers can’t easily roam across the network.

ZTNA also supports continuous trust assessment. Where VPNs typically verify users once at the start of a session, ZTNA platforms can keep evaluating trust signals in real time.

For most organizations, the appeal is clear: ZTNA cuts down the attack surface by hiding applications from unauthorised view and limits lateral movement by restricting each user to just what they need.

What are the limitations of ZTNA?

While ZTNA brings clear security advantages, it isn’t a complete solution on its own. In 2025, with so many potential threats for organisations of all sides, sadly nothing is perfect.

Most ZTNA tools primarily protect access at the application layer, so organizations still need to secure other areas such as endpoint devices, DNS queries, and email systems. Without layered defences, malware or phishing attacks can still slip through.

ZTNA also relies heavily on your identity infrastructure. If your identity provider or SSO platform experiences downtime, a misconfiguration, or some other issue, it can prevent users from accessing critical applications entirely.

Similarly, if credentials are compromised at the IdP level, attackers might still navigate through multiple applications despite ZTNA policies, underscoring the need for strong multi-factor authentication.

Another challenge is supporting legacy systems or protocols that aren’t web-based. Many older apps may not integrate neatly with ZTNA or modern identity frameworks, requiring additional gateways or reengineering to fit, much to the chagrin of your IT department.

ZTNA can also create user friction if posture checks or multi-factor requirements are too aggressive or poorly tuned. If legitimate users are frequently blocked or delayed, it can undermine productivity and fuel resistance to security initiatives.

How can I choose the best ZTNA tools?

Selecting the right ZTNA platform starts with ensuring it fits your organization’s identity strategy.

Look for solutions that integrate tightly with your existing identity providers and SSO platforms, whether that’s via SAML, OAuth, or OpenID Connect. Strong identity support underpins granular policies and smooth user experiences.

It’s also important to check how well the tool separates the control and data planes, a core principle of software-defined perimeter designs, to ensure that policy decisions and user authentication happen independently from the actual traffic flow.

Continuous risk assessment is another key factor. Leading ZTNA tools evaluate device health, location, and behavioural patterns in real time, adjusting access if something changes. This adaptive approach is far safer than static, one-time checks.

Finally, look for rich analytics and reporting. Detailed logs and dashboards make it easier to demonstrate compliance and spot unusual patterns. A mature ZTNA platform should do more than block access; it should give you visibility to continuously improve your security.

How can your organization implement ZTNA? 

As with most IT work, rolling out ZTNA starts with careful planning. Map out which apps and user groups need protection, identifying who accesses what – and under which conditions – so you can build precise policies without blocking essential work.

Next, a strong identity foundation is essential. Since ZTNA relies on robust authentication, your identity provider and SSO platforms must be resilient and correctly configured. Combining these with multi-factor authentication (MFA) reduces the risks of credential theft.

Introducing ZTNA in phases also often works well, and piloting with higher-risk groups – like contractors or third-party partners – gives IT teams the chance to adjust posture checks, policies, and exception handling before scaling across the business.

Additionally, integrating endpoint compliance checks further strengthens security by ensuring only secure, patched devices can connect, preventing older or unmanaged machines becoming an easy entry point.

Clear communication with employees helps build trust and smooth adoption.

Explaining how continuous checks and MFA protect both users and data – while SSO simplifies day-to-day access – can ease concerns and keep productivity high. With the right planning and support, organizations can transition to ZTNA confidently, gaining tighter control over access without adding unnecessary friction.

When it comes to cyber security, building a wall around your business is no longer the best way to stay secure. With ever more devices accessing corporate data and a blurring of borders in what constitutes a network perimeter thanks to cloud computing, the potential access points for a malicious actor to enter and move around the corporate network have grown.

This is why the zero trust approach to security has become increasingly popular within the enterprise space. It’s a change of mindset as much as a technological one, where you assume that all application access is potentially dangerous to your business.  

In essence, you are asking more questions of those who access your data and where they are accessing it from. Why do they want to access particular applications and how are they connecting to them? Is this normal behavior for them, or someone in a similar role? They may be an employee, but that doesn’t mean they should have unfettered access to all the company’s data and applications just because they managed to log into the corporate network correctly. 

Hence the principles of zero trust focus on devices, networks, and, yes, users. The human element can be intentional – in the form of a classic insider threat, such as a disgruntled employee – or accidental, through human error.

Misconfigured servers, crackable passwords, and unencrypted files; the ways in which business data can be leaked and breached are often internal errors. Simple mistakes can lead to major security incidents and possibly even financial penalties.

Much of this can be greatly reduced by implementing the more pragmatic approach of constantly monitoring systems and the people and devices who use them. 

Leave the castle and moat behind

In traditional network security, it was outsiders who were treated with suspicion leaving insiders with virtually free access following an initial successful login. This is known as the ‘castle and moat’ model of network security; the castle is the network and the moat is the network’s perimeter which outsiders were not able to get across. 

The problem now is that most companies keep their data in multiple locations, like cloud services, third-party servers, or on-premises data centers. This means a business is potentially vulnerable to attacks and data breaches from different locations. As such, the once reliable castle and moat model can’t hold up to this new reality.

Another area that has stretched the boundaries of the network is hybrid working. Not only do many organizations now have a more dispersed workforce, but they also have new members of staff onboarding remotely, executives and knowledge workers connecting from other countries, and third-party services potentially storing and transferring business data between geographical regions. Our attack surfaces have never been larger and it’s a clear contributor to the increasing reports of cyber attacks and data breaches that plague all types of business. 

Never trust, always verify

Zero trust is a cyber security philosophy that has grown up in the face of these issues. It is a strategic approach to the implementation and design of IT systems based on the concept of ‘never trust, always verify’. In practice, it means that users and devices should not be trusted by default, regardless of whether they are connected to the organization's network or have already been verified previously. The reason for this is to make sure the person is who they say they are but also to verify the device they are using – the latter is key to maintaining security as the device is checked for compliance or whether it has any unauthorized software that could compromise the network. 

This type of architecture works by establishing strong identity verification, validating the compliance of a device before granting access, and also ensuring least privilege access to only resources that have been explicitly authorized. If for example, you have an employee working from a public Wi-Fi, or a place they don’t usually work from, they may be subject to more verification than usual, or cut off from more sensitive parts of the network. 

It’s as much a cultural change as it is any technology adoption and one that needs to be maintained long beyond implementation to keep up with changes in an organization’s IT estate or business strategy. New procedures will need to be developed to keep track of changing systems and workflows, stress testing new hardware and software, regular training for members of staff. Having plans and procedures in place to monitor and maintain zero trust, across the organization, can even offer a better understanding of its operation and highlight opportunities for improvement and growth. 

Zero Trust architectures work by using a few basic principles, such as least-privilege access. This is where the bare minimum of access is granted to users, taking away the assumption of trust, even on your own staff, which could be abused by a malicious actor, whether internal or external. It also includes multi-factor authentication (MFA) where users are required to provide more than one form of identification to access their work devices and corporate accounts, providing additional evidence that they are who they claim to be. 

How this is implemented will differ for each company as their size, operation, and budget will dictate which services they can use. For example, each device will need to be traced and managed with remote access software so that the right person gets the right access privileges. This can be a challenge for a small company that has data residing in multiple places and personnel spread across different locations. 

All of these variables, the significant shift in how cyber security is thought of and implemented, and the need for constant monitoring and adaptation can make getting started with zero trust a daunting task. No matter how far an organization is on its zero trust journey, BT security advisory services can help plan and tailor their approach in line with their business needs. 

This includes advisory services for cloud infrastructure, advice on shoring up security across the network, and best practices for protecting both users and data. BT also offers 24-hour online support with experienced technicians and an extensive portfolio of IT services. What’s more, its Managed Cloud Security service offers a single, central portal to manage policies, find access reports, and monitor the entire network.

BT also maintains its relationship with customers as part of its ongoing security journey and gives them access to leading cloud-based security providers, such as Zscaler and Cisco. This opens up a wealth of industry experience and even more services to help businesses stay on top of their security needs. 

Zero trust has transcended from being a mere industry buzzword to becoming a key facet in organizational approaches to digital transformation, according to Nathan Howe, VP of emerging technologies at Zscaler. 

Research from Zscaler shows that “most IT leaders already have a zero trust security strategy in place, or in planning”, yet fewer than one-quarter (22%) are confident of using it to its full potential. 

This, the organization warns, shows that businesses need to “widen their lens” to unlock the full benefits of zero trust. 

This security model now has far reaching applications, enabling firms to empower distributed workforces, tighten security, and provide vital insights into organizational efficiency

Unlocking the full potential of zero trust

Fundamentally, zero trust represents a paradigm shift away from virtual private network (VPN) and firewall-laden security practices, Howe says, which traditionally sees devices within an organization's network as being trustworthy. We’ve seen glaring issues in the long established ‘castle and moat’ approach in recent years, especially during the shift to remote and hybrid work practices with distributed workforces using devices in a range of locations. 

Meanwhile, the concept of zero trust centers firmly around the idea that no user can be trusted. Under this model, every user and device requires verification to access networks. 

Visibility, in this context, is key for an organization implementing zero trust, enabling them to have full control over who accesses networks, and on which device they do so. 

This model has been growing in popularity in recent years, with Gartner research showing it’s “top of mind for most organizations” and viewed as a key strategy to reduce cyber risk. By 2026, 10% of large enterprises will have what the consultancy describes as a “mature and measurable” zero trust program in place, up from less than 1% today. But enterprises, all too often, don’t fully understand the wide-reaching benefits, Howe says. 

“I think if a company can get to the point of understanding what zero trust is, then there are huge advantages,” he tells ITPro. “The advantage becomes extremely apparent in terms of no longer needing to think about what we can do in a networked world. I can do it anywhere.

“Zero trust is to not be anchored in any one place, it’s about enabling [IT] functions anywhere.” 

Visibility across the enterprise is key 

If implemented correctly, Howe says zero trust offers marked benefits to organizational visibility, and not just in a security context. 

With many companies operating hybrid work practices, there’s scope for IT teams to maintain a solid grasp of network activity while delivering broader operational flexibility.

The model also offers a “competitive advantage in the hiring cycle” for firms embracing zero trust due to the ability to maintain flexible, distributed workforces.

“There is the flexibility to be anywhere, and knowing that the work you do will be protected, secure, and ensure that you’re doing the right thing,” he says. “Because the information and insights zero trust provides is so granular, we’re able to apply controls and ensure that staff aren’t downloading bad things or files because you’ve got controls in place.” 

Howe notes the network visibility afforded to organizations through zero trust allows them to “start making decisions about how to engage with employees based on where they are”. 

In a hybrid work environment, for home-based staff, IT teams can monitor traffic and gain vital insights on risk tolerance. They know remote workers are secure, and can carry out their duties without added risks. For those in the office, the insights gained through working trends can deliver broader benefits in terms of basic office utilities, working practices, and even insights that deliver energy efficiency improvements. 

“You can start taking this information and granularity and apply it to the locations where you have offices. You can see how many people are on that site at any time accessing Salesforce, for example,” he explains.

“That insight gives you the ability to start making other business-related decisions, such as when you turn the power on or off, and other auxiliary aspects of the business because you see when people are there, you know they’re working. That granularity in zero trust has huge knock on effects, that we're only just scratching the surface on as an industry.”

At present, Howe says scores of businesses are “starting to think” about how zero trust can be applied more broadly and enable them to “be smarter” about how they distribute their workforces, glean insights into working patterns and productivity, and design office spaces. 

Exploiting emerging opportunities

Generative AI has, for the best part of a year now, been the talk of the town across the global technology landscape. Looking ahead, Howe says the emergence of generative AI tools should be a cause for excitement in the zero trust space. This topic was a hotly-discussed topic at the firm’s Zenith Live conference in Berlin in late June, with the technology’s applications being touted as a potential game changer for zero trust. 

The sheer volume of data that passes through Zscaler’s security cloud every day – roughly 300 billion requests – means generative AI tools could play a key role in gleaning value from large quantities of data. In the long term, while this applied to security practices, there could be scope for closer integration of automated tools to further support digital transformation.

“I think we're at the tipping point where it's about to get really exciting with what we can do beyond just a normal enrichment platform,” Howe says. “Like, how can we help find more additional threats, have more refined authorizations, those sorts of things."

Taking a zero-trust approach to security is pretty much the standard by which organizations are measured these days. It means no user can be on the network without being authenticated and continuously validated. 

We think of users as people. But users can also be things. And these internet-facing things – Internet of Things (IoT) devices – can be as much of a cyber security issue as people. Actually, they can be more of a security issue. 

The dangers of enterprise IoT

Organizations rely on IoT devices to help them keep operational on a day-to-day basis. There are plenty of devices that keep a business running including security cameras, printers, smart TVs, conference room equipment, kitchen equipment, and environmental sensors. These might include thermostats, smoke detectors, and ventilation systems alongside smart locks and room entry management systems. 

All of these use software to complete tasks and share data with other devices, inside or outside the network. Their communication is typically automated, machine to machine, and doesn’t involve a human. It may never be monitored in any way that’s meaningful in a security-conscious sense.

Normally, we’d consider many of these devices as the domain of the facilities team rather than the IT team, and outside the scope of the enterprise network that needs protecting. It’s one of the many considerations when it comes to assessing IoT security risks.

“Consider older facilities,” says Abel Archundia, managing director, of global advisory and life sciences at ISTARI. “They may create or manage sensitive data yet likely have air conditioning units or cameras installed years ago in the same network. And most of these systems have no protocol to upgrade operating systems in IoT devices. The worst thing is that they’re not very complex or hard to crack.”

Each of the devices attached to an organization’s network presents a danger, John Linford, Security & OTTF Forum Director at the Open Group explains.

“Devices inevitably have vulnerabilities through their connection to a network,” he tells ITPro. “With the growing use of IoT devices, a business’s attack surface expands as attacks can originate from the channels that connect IoT devices.”

Poor security from the outset

It’s a key problem that poor security is a feature of many of these IoT devices right from the outset – and they don’t have to be particularly old to feature poor security. Right out of the box, they can come with default passwords that aren’t changed on installation, and can have a poor level of commitment to firmware updating and patching. They either lack a regular schedule, a commitment to patch whenever a fault is found or have a short period of support before dropping out of the support regime completely.

“[An IoT device can] lack support for modern, secure controls like two-factor authentication (2FA), and logging and monitoring of device access and network traffic,” Matt Lewis, commercial research director at NCC Group, tells ITPro. 

“They often lack an interface – such as a screen to provide notifications about possible new software updates. And they are regularly overlooked as they appear as black boxes performing a function and are presumed to be fine if operational.

“For many IoT devices, updating their firmware can require physical access, which can be difficult for say IP cameras mounted high on fences or gates.”

Why you can’t trust any IoT device

There’s a strongly held view that it simply isn’t possible to trust any IoT device, even if it’s equipped with automatic security updating. “As a former CIO, my guidance is that preparation is the best defense,” Archundia tells ITPro. 

IoT devices are often just too much of a risk; they’re too much of a soft entry point into the organization to overlook them. It’s best to assume each device is a hole in an enterprise’s defenses. Perhaps each device won’t be a hole at all times, but some may be for at least some of the times. So long as the hole isn’t plugged, it can be found and exploited. 

That’s actually fine in a zero trust environment, because it assumes every single act, by a human or a device, could be malicious. The system, therefore, monitors and checks everything on the basis that a successful attack is always a possibility.

Linford adds it’s possible to limit the scope of an attack administered through IoT in a zero trust environment. “Because zero trust focuses on continuously verifying and placing security as close to each asset as possible, a cyber attack need not have far-reaching consequences in the organization,” he says. “By relying on techniques such as secured zones, the organization can effectively limit the blast radius of an attack, ensuring that a successful attack will have limited benefits for the threat agent.”

Still, the devices themselves merit plenty of attention on an individual basis. Lewis advocates a robust asset management process in which organizations take steps to track every single asset as much as possible. “[This includes] subscribing to notifications from all of their tech vendors about any new software updates, and ensuring a documented process is followed to install any updates or security fixes in a timely manner. This should all be done as a periodic routine, rather than say a once a year activity”.

Cloudflare has unveiled its new Cloudflare One for AI suite of zero trust security controls, designed to help businesses leverage the latest generative AI tools without endangering intellectual property or customer data.

The provider said the additions aim to provide organizations with a “simple, fast, and secure way” to use the latest generative AI technologies without compromising security or performance. 

The offering serves up features that provide visibility and measurement of AI tool usage, as well as data loss prevention and integration management. 

Among these, Cloudflare Gateway is designed to help companies observe how many employees are experimenting with AI services and delivers context for budget planning and enterprise licensing. 

Service tokens provide administrators with a clear log of API requests and control over the specific services that can access AI training data. 

That includes the ability to revoke tokens with a single click when building ChatGPT plugins for both internal and external use.

Cloudflare Tunnel also offers an encrypted, outbound-only connection to Cloudflare’s network, while the suite’s data loss prevention (DLP) service provides a safeguard to close the human gap in how employees may share data, the firm says.

Additionally, the cloud access security broker (CASB) service adds visibility and control over SaaS apps and will soon be able to scan the AI tools that teams use to detect misconfiguration and misuse.

In an announcement, Matthew Prince, co-founder and CEO at Cloudflare, said that AI, despite its promise, can create “significant risks for businesses” without the proper guardrails in place.

"It is far too easy, by default, to upload sensitive internal or customer data to AI tools,” he said. “Once the data is used for training AI, it is virtually impossible to get it out.

"If you were going to let a class of university students rummage around in your internal data, you'd of course put clear rules in place on what data they can access and how it can be used in their education.”

The safety of generative AI has been called into question repeatedly since it took off in late 2022.

Several major companies have already banned the use of popular AI chat apps due to sensitive data leaks, with Italy even issuing a temporary ban on generative AI tools for having inadequate user data protections.

According to a survey conducted by professional services network KPMG, the majority of US executives are currently “years away” from implementing AI, with cyber security (81%) and data privacy (78%) the biggest concerns. 

However, as generative AI evolves and new tools and plugins are developed, Cloudflare said its approach to security will enable organizations to embrace the technology without creating bottlenecks, as well as ensure compliance with the latest regulations.

“Cloudflare's zero trust products are the first to provide the guard rails for AI tools, so businesses can take advantage of the opportunity AI unlocks while ensuring only the data you want to expose gets shared," Prince added.

Zero trust strategies are one in which nothing and nobody can use an organization’s digital resources without being verified. This isn’t just about verification upon entry into the system, but also when individuals are moving around within the system.

Such a strict regime is required because a cyber criminal or an automated agent might breach a system and move about freely within it if, once inside, there were no verification checks. Zero trust has, therefore, become a gold standard for cyber security in today’s enterprise landscape. 

Implementing zero trust requires a root and branch examination of the entire technology estate. The organization needs to identify its vulnerabilities, both technological and human, and figure out how to best plug the holes. This should be done in the context of minimal disruption to everyday workload, and an understanding that zero trust is not a one-time fix but an evolving idea. 

Implementing such a regime, however, isn’t without its potential pitfalls and pain points. It’s a time-consuming and complex process that requires input from many roles across the organization, as well as external expertise. 

1. Failing to look beyond the corporate network

When hybrid working is the norm, people will be using all manner of locations to work including their homes and public networks. Everything is part of the attack surface and the organization should trust nothing. Every endpoint is a potential vulnerability. 

This also, by the way, includes devices that might sit outside the network such as printers, security cameras, and other Internet of Things (IoT) devices.

A thorough audit of devices will be required before work begins, with a strategy in place to protect each device and to ensure that each device is updated as regularly as needed. 

2. Implementing zero trust too quickly

Implementing a Zero Trust approach might require significant changes to technologies and also to how people go about their daily business. Go too fast and it’s easy for mistakes to happen. Single devices or applications might slip through the net of compliance assurance at the time of implementation or later. Security hygiene – ensuring that all hardware and software is up to date and patched – is a central aspect of zero trust.

Ensuring every piece of hardware and software is known and its security can be optimized at all times takes time. It is important to allocate enough time to managing everything from the outset, and to develop processes for ensuring existing and new acquisitions are accommodated going forward. 

3. Ignoring the principles of least privileged access

Least privileged access refers to the policy of ensuring users only have the bare minimum permission level to do what they need to do. It’s designed to keep access to resources tightly controlled and prevent the kind of sprawling access through systems that can be most helpful to bad actors. 

However, it can be difficult to implement, particularly in the case of multi-cloud environments in which data and apps are hosted with different providers, each with different policies and security protocols. In the end, budget, available time, and sheer workload can mean in-house teams assign wider privileges than necessary.

Using a class of software called entitlement management, or cloud infrastructure entitlement management, access to a multitude of software, systems, devices, and cloud platforms can be managed centrally. 

4. Failing to focus on users

An organization’s employees are not the only stakeholders it’ll have to work with. There may also be contractors, suppliers, purchasers, delivery partners, and others. Presenting users with new protocols, hoops to jump through, and processes – without understanding whether these are seen as barriers – can cause resentment and foster non-compliance strategies. Users who work around security protocols are users who create risk. 

High-quality user education on how to achieve compliance with security protocols is only part of the solution. People must also understand why certain behaviors are required, and be comfortable with any required actions or approaches. Creating a ‘culture of security’ across the organization takes time, effort, and leadership – from chief officers, senior managers, and line managers. 

5. Assuming zero trust is bought into by default

Every organization is different. Its technology setup will be unique. How people use technology will vary too. Where its people work will vary too, including in-office, remote or hybrid, one city, with national offices, or multinational. The variables are many and complex. While certain principles and approaches apply to zero trust, their implementation in any one organization will be unique. Simply going to a vendor and expecting them to do everything without any input is a fallacy.  

Organizations need to commit their own staff resource to work alongside vendors and understand that the implementation of zero trust will take time. This is and will continue to be an ongoing process.

With cyber attacks showing no signs of slowing down, and with organizations of all sizes and in all markets potentially vulnerable, securing data and networks is paramount. It’s no longer adequate to take a piecemeal approach to this challenge. A zero trust approach can help an organization implement a risk-based strategy toward data security. It isn’t without pitfalls, and organizations should be alive to these, and willing to commit the time and energy required to work them through. 

GoTo Resolve is a cloud-hosted remote support solution with security at the top of its agenda. Designed to ensure that access to unattended computers is locked down tight, it requires technicians or agents to enter a personal signature key before a session is permitted.

Key creation is a one-time affair that happens the first time a technician accesses their personal Resolve web portal and attempts to download the unattended apps. Create a key that is at least eight characters long and don't forget it; GoTo makes it clear that for extra security, it doesn't store keys in the cloud and is unable to recover them.

Resolve handles unattended access for Windows devices differently to most other remote support solutions. Instead of installing a custom app on the remote device, it loads a background service linked to the technician's key. We had no problems installing the unattended macOS app on our MacBooks, and Resolve also offers an app for Android mobiles.

Once we'd installed the Windows service and macOS app on our endpoints, they appeared in the portal's Devices view ready for instant access. Clicking on one takes you to an informative status screen with details of the CPU and memory as well as OS and BIOS versions, but the standout feature for us is the real-time graph below showing CPU, memory and network interface utilisation.

Buttons at the top provide links to a terminal session, file manager or remote control and, in all cases, you're required to enter your personal signature key to access them. Once remote control has started, the session is accessed from the portal's Support tab, which presents the device's screen in a central window with an interaction panel to the right for chat, file browsing and making notes.

An upper toolbar offers quick access to various functions such as clipboard syncing, sending files, screen sharing and rebooting the device where the service will reconnect when the system is back up. A useful feature is that sessions to multiple systems can be opened simultaneously, and you can swap between them from the sidebar.

Resolve isn't just about unattended access; it also provides plenty of on-demand remote support features. Technicians access every feature from their personal web portal and can start instant remote support or basic screen-viewing sessions with consummate ease.

This loads an in-portal page with a nine-digit access code, along with options to copy the web link and send the invitation via SMS or email. Users are presented with personal details of the technician for added reassurance and asked to permit the request, after which the Resolve runtime app is loaded, the session starts and the technician sees the same screen and toolbar as used for unattended access.

Camera sharing costs £23 per month for each agent and is just as easy to use. The same remote support process is used to create a session, but this time the user goes to a different web link to enter their code and the technician then receives a camera view in their support portal with facilities to freeze and annotate the view and have a chat.

Mobile support is also optional, with a monthly fee of £15 per agent. We tested this on an iPad using the Resolve technician app to provide remote support and the client app for screen broadcasting to technicians.

GoTo Resolve is a well-rounded remote support solution that's ideally suited to SMBs that want the tightest access security. There's a lot more on the horizon, too, as GoTo is planning to make Resolve even more versatile by adding endpoint antivirus software, patch management and alerting.

Cloudflare has announced the development of the Cloudflare Zero Trust SIM, which has been designed to secure every packet of data that leaves a mobile device.

The first of its kind, the SIM will allow organisations to connect employee devices quickly and securely to Cloudflare’s Global Network, directly integrate devices with the firm’s Zero Trust platform, as well as protect their network and employees.

Cloudflare is also launching Zero Trust for Mobile Operators, a new wireless carrier program that will let carriers offer their subscribers comprehensive mobile security tools by tapping into its Zero Trust platform.

In an announcement, Cloudflare co-founder and CEO Matthew Prince said securing mobile devices at scale is currently one of the biggest issues for CISOs.

“Effectively securing mobile devices is hard, and we have been working on this problem since we launched our WARP mobile app in 2019, now we plan on going even further,” he said. “With Cloudflare Zero Trust SIM we will offer the only complete solution to secure all of a device’s traffic, helping our customers plug this hole in their Zero Trust security posture.”

Cloudflare says its Zero Trust SIM will integrate seamlessly with its entire Zero Trust stack, which will allow security policies to be enforced for all traffic leaving the device. That’s on top of its embedded SIM (eSIM) first approach, which allows SIMs to be automatically deployed to both iOS and Android and then locked to a specific device – ultimately mitigating the risk of SIM-swapping attacks.

Businesses will also be able to deploy the company’s Zero Trust SIM at scale in just minutes, as well as leverage integration with its WARP mobile agent.

Additionally, Cloudflare says it is developing new tools based on the new SIM, which will extend its connectivity and Zero Trust security perks to the Internet of Things.

“By combining Cloudflare’s award-winning security tools with the largest mobile networks in the world, businesses can be confident that their devices and data are secure without worrying about performance being impacted,” Cloudflare said.

The demise of the office was a popular talking point during the pandemic, and although it never quite came to pass, the central workplace we left in early 2020 isn’t the same today. For starters, not everybody came back. Remote work turned into a permanent deal for many, and this has forced companies to rethink the way their employees collaborate.

Within this cultural shift, however, a subset of workers are often forgotten – the IT team that maintains the technology which allows for hybrid offices. These professionals keep your device clean and connected no matter where you are, and they do so with remote access software from providers like Keeper Security.

Before the pandemic introduced more of us to remote working, virtual private networks (VPNs) were the go-to solution for remote workers. VPNs were fine when only a very small number of people worked remotely, but when the entire world shifted to distributed work, the limits of VPNs quickly became apparent. In addition to being expensive, sluggish, difficult to scale and complicated to use, the majority of VPNs don’t support modern zero-trust network access (ZTNA), which is key for securing today’s distributed data environments and workforces.

As an alternative, remote desktop gateway software provides organisations with fast, scalable and zero-trust remote access to IT infrastructure, with features such as least-privilege access, role-based access control (RBAC) and multi-factor authentication (MFA).

Use cases for remote desktop gateways

Remote desktop gateways work by capturing control of a remote device’s screen, mouse and keyboard controls and transmitting them to another computer, where a user can view and use the remote machine as if they were sitting right in front of it.

The most common use cases for remote desktop gateways involve IT and DevOps teams, who must remotely connect to IT infrastructure to perform upgrades, maintenance and troubleshooting. For example, help desk personnel can remotely connect to employees’ machines to find and fix software or operating system problems, security teams can use remote desktop access to investigate potential security incidents and DevOps teams can perform infrastructure monitoring and maintenance.

Non-technical employees can use remote desktop gateway software to transfer files from one computer to another, such as for sales demonstrations, or to print out documents stored on the remote machine. Remote desktop access enables employees to work from anywhere – home, a coffee shop, even abroad – and still access a central work computer to use the work-related programs and files that are stored on it.

Remote workers can also be taught to use their machines in new ways, or have new software demonstrated by a more experienced colleague via remote access. If the main office is looking to keep the organisation compliant with GDPR, for instance, the person in charge of data protection can reach out to all colleagues and remotely demonstrate what constitutes company policy.

The value of zero-trust remote access

Having a workforce spread across a region or an entire country (or internationally) presents a number of security challenges. Compromised credentials were a common attack vector for ransomware attacks prior to the pandemic, and the shift to remote work exacerbated the issue. Remote desktop protocols (RDP) are a major vector for ransomware attacks, as they frequently lack multi-factor authentication.

Without modern zero-trust network access, all cyber criminals need to access the wider network – or remotely tap into an individual device – is a working set of login credentials. Threat actors can crack passwords using a number of different tactics, such as brute-force attacks or password spraying. Your business is literally one compromised password away from a ransomware attack or data breach.

Keeper Security’s Keeper Connection Manager is an agentless, remote desktop gateway that can be installed in any on-premises or cloud environment to provide DevOps and IT teams with effortless, zero-trust access to RDP, SSH, databases and Kubernetes endpoints through a web browser. All users and devices are strongly authenticated before they are permitted to access organisational resources. Once properly authenticated, end users interact with remote desktops via a secure session from their web browser – there are no special plugins or client software to install and maintain.

Keeper Connection Manager enables administrators to provide access through RDP, SSH, VNC, MySQL and other common protocols without having to share credentials with end users. Unlike VPNs, which give every user full, unfettered access to all systems, Keeper Connection Manager’s fine-grained controls enable administrators to provide access to select systems – or just one machine. Access can be revoked at any time, and a robust audit trail identifies when and how the system was used.

Furthermore, all activity in the system is tracked and monitored with complete event logging, reporting and alerts. The zero-trust security model prevents lateral movement through an organisation’s systems unless permitted by the platform’s control and enforcement policies.

The hybrid work model is here to stay – and zero-trust network access is key to supporting and empowering a dispersed workforce. Keeper Connection Manager enables organisations to adopt zero-trust remote access for their distributed workforces, with granular visibility and control across all designated endpoints.

Try Keeper for free today or book a personalised demo to learn more about the best way to protect your organisation from cyber attacks

Deloitte has launched Zero Trust Access to help enterprises better secure communications between users, devices, and business applications ‌from any location.

The managed service features a cloud-native approach and builds on device-level secure microcontainer technology. The solution is inherently scalable, resilient, agile, and secure, according to Deloitte.

Notably, Zero Trust Access helps businesses administer least privilege through dynamic access control to enterprise assets. With its ephemeral connectivity, conditional access and continuous authorization, the solution presents as a better alternative to high-expenditure remote access solutions.

“The Zero Trust concept commits to removing implicit trust within an information technology (IT) ecosystem and replacing it with a risk-based approach to accessing organizational resources across identities, workloads, data, networks and devices. This trend is gaining momentum, given legacy approaches to security architecture are no longer suitable to secure the ubiquitous nature of the modern enterprise,” explained Deloitte.

"As perimeter-based approaches are no longer suitable to secure the modern enterprise, many organizations are working to enhance protection for their IT ecosystems via zero trust," said Andrew Rafla, Deloitte Risk & Financial Advisory's zero trust offering leader and principal, Deloitte & Touche LLP.

"Zero Trust Access was built as a turnkey managed service helping ourselves and our clients accelerate adoption of this transformative security framework. Our goal was to create a cost-effective solution that can be delivered standalone or complementary to a broader ecosystem and ultimately help decrease the burden on IT and security teams who likely need to manage multiple heterogeneous solutions to achieve similar outcomes," added Rafla.

Think back to February and the weekend of the Super Bowl. I didn’t watch it as I have better things to do in the early hours of the morning, like playing Cyberpunk 2077 because I can’t sleep. Also, I prefer proper rugby without crash helmets and 1980s shoulder pads. I didn’t escape the fallout of the thing, though, and I’m not talking about Eminem taking the knee: I’m talking about the adverts.

Don’t worry, this isn’t another of my rants about trackers, cookie options or advert delivery and blocking options. Instead, it’s about a certain level of cyber security-related hysteria. That hysteria – spread by way of tweets and blogs and emails – centred around Coinbase. Not for the usual “cryptocurrency is all an illusion” reasons, either, but rather down to a 60-second advert featuring a QR code bouncing around the telly-box, or more likely your computer screen, by way of a half-time advertising slot that’s reported to have cost in the region of $13 million.

Coinbase, no doubt, considers that money well spent; it reckons it recorded some 20 million hits on the landing page from scanning that QR code during the single minute of broadcast, crashing the relevant Coinbase servers in the process. Engagement also went through the roof, with Coinbase claiming a six-fold improvement over previous benchmarks.

The hysteria I’m talking about is the divided opinion on the not so small matter of QR code security, or insecurity, depending on which side of the debate you sit. Me, I’m firmly straddling this controversial fence. QR codes are neither an invitation to compromise your device and data nor a perfectly safe method of reaching the information you seek. Can QR codes be used for malicious purposes? Sure, but so can web links (so best not click on any ever again) or email (never open a message folks) and apps (dammit, time to flush your finest smartphone down the bog).

There’s no 100% secure method of jumping to linked information. Sorry if that just burst your InfoSec bubble, but it’s the truth. Unless you know the destination URL already, know that it’s trustworthy (and even that trust can be misplaced) and type it into your locked down as tight as a duck’s derriere browser by hand, consider every link to be potentially dangerous.

That doesn’t mean you should click on nothing, scan nothing, trust nothing. It does mean you should be aware of the risk, should be able to threat-model accordingly and understand the mitigations that can be applied.

You can’t apply a zero-trust policy to real life

Consider a scenario in which you substitute me for a QR code. I could turn up on your doorstep, unannounced, wearing a hi-vis with an ID badge and claim to need access to investigate a gas leak. You determine whether to let me in, or scan the QR code, based on your trust in me being who I appear to be. This isn’t the same as saying that all QR codes are perfectly safe to use, or that all people knocking at your door mean no harm, but rather illustrating that it’s simply not feasible to apply a zero-trust policy to real life. Saying “never scan a QR code” is about as sensible as declaring international travel is to be avoided as there’s a chance you could fall off the edge of our flat Earth.

Cyber security and privacy should never come wrapped in absolutes. If they do then you’re probably doing the whole threat modelling thing wrong. Some honest advice is coming up, so look away now if you dislike your world view being challenged: a watering hole attack (aiming at users of a particular site or service) employing a zero-day exploit is very unlikely to target you. Zero-days are expensive and are used sparingly. It’s not that such things do not happen, of course, but rather they can be filed in the uncommon folder rather than every occurrence.

Your chances, your company’s chances, of being targeted using a zero-day attack will also depend highly on the industry you're in and the profitability (be that financial or political) of a successful compromise. As Michael Coates, a former Twitter chief information security officer (CISO) and security head at Mozilla, once tweeted: “If an org has a choice of where to spend time, spend it on the timely application of patches across the entire fleet. It’s not the 0days that get orgs, it’s the 100days.” In other words, you’re far more likely to get hit by a known exploit that compromises your networks by using a vulnerability in the patch cycle time between release and application.

Again, this absolutely does not mean that I’m saying QR codes are perfectly safe. I’m saying, apply the same defensive logic to them as you would clicking on a link in your email, a direct message or SMS. Certainly, be aware that they can be abused. Scanning, for example, a QR code on a parking metre could be problematic if that code has been tampered with or, indeed, shouldn’t be there at all.

How to eliminate the phishing risk

Cyber crime has come a long way since the ‘AOHell’ cracking exploit kit of 1996. Phishing is not only still with us but still plays a central role in cyber crime, alongside the ransomware threat to targeted spear phishing. To the even more highly targeted, whale phishing of business email compromise (BEC) and nation state spying campaigns are persistent threats.

The National Cyber Security Centre (NCSC) has a very good guide for organisations when it comes to defending against deceptive phishing campaigns. It’s an excellent starting point on your journey towards the best possible phishing mitigation you can expect.

Helping users to identify and report suspected phishing emails is one area that’s often either over-emphasised to the detriment of technical tools or under-emphasised, which is actually just as bad all round. There needs to be a balance between tool implementation and awareness training if such a multi-level strategy is going to be effective in practice. Using Domain-based Message Authentication (DMARC) is a solid way to verify that an email is actually from the purported sender, by way of example, but not every organisation will use it so an awareness of the dangers (and other mitigations) of spoofing is still a requirement.

The NCSC also has a somewhat dated, but still relevant, information resource when it comes to anti-spoofing while Microsoft 365 users can do worse than head over to that company’s official support and documentation for using DMARC to validate email. One last general resource comes by way of an Electronic Frontier Foundation (EFF) project called Surveillance Self-Defense, which provides a good overview of the tools and techniques to combat phishing attacks.

I heartily concur with the software and operating system patching advice, and two-factor authentication (2FA) key usage is equally great advice as well. Less for preventing phishing itself, more helping to mitigate the outcome of a successful initial phish.

A security researcher who goes by the Twitter handle of mr.d0x created a phishing workaround for multi-factor authentication while undertaking a penetration test for a client. I mention this purely to emphasise that while 2FA is a great additional layer, it isn’t a foolproof one. The mr.d0x exploit is essentially a man-in-the-middle (MitM) compromise, where the attacker controls the site where the authentication code is being entered. This uses a VNC server hack called noVNC that will automatically launch the victim’s web browser and connect to the threat actor’s VNC server with a browser running in full-screen kiosk mode, so they just see the login web page as expected. The point being that the login takes place on the threat actor server, as will one-time passcodes.

Roger Grimes, author of a book called Hacking Multifactor Authentication, and a data-driven defence evangelist with KnowBe4, warns “MFA using voice calls, SMS messages, one-time codes the user types in, and pushed-based approvals is highly phishable. Hundreds to thousands to millions of people protected by these types of MFA have been successfully phished and hacked. It’s like giving them a self-driving car and not mentioning that they still have to pay attention and drive when the autonomous system fails.”

There’s one more resource I have to mention, and for good reason as a communicator myself. Namely, this Medium posting by Bob Lord. A former CISO at Yahoo and the Democratic National Committee in the US, Lord has published an excellent round-up of how business security advice should be given. It’s well worth a read in full.

Cloudflare has revealed details of its new One Partner Program, which it says presents a new way for the channel to integrate and extend its Cloudflare One platform.

The initiative builds on the solution’s comprehensive zero trust, network as a service, and cloud email security services, providing architecture designed to help customers to stay secure and efficient.

Cloudflare said the new programme bundles together the tools and services that partners need to ensure swift deployment, fast performance, as well as robust security across endpoints, networks, and email.

“In order to keep today’s business environment protected and productive, organisations need a unified solution to secure their distributed workforces and at the same time accelerate employee systems,” explained Matthew Prince, co-founder and CEO of Cloudflare. “But another key piece is broad adoption, and that’s why we’ve been working to seamlessly layer this into organisations without interruptions.

“Critical architectures like Zero Trust shouldn’t be complex, yet we hear every day from businesses that don’t know where to start. That’s why we have modernised how partners can fully implement and deliver what organisations of all sizes need most today.”

One of the most interconnected networks on the market, Cloudflare One spans 270 cities in over 100 countries. Over the last twelve months, the number of customers using the platform has grown by 100%, while daily average traffic has increased sixfold.

The platform boasts a number of integrated products such as ZTNA, Secure Web Gateway, CASB, DLP, Browser Isolation, IoT Security, and now Cloud Email Security.

With its new partner programme, Cloudflare says partners will now be able to better guide customers, deliver comprehensive solutions, protect users from phishing attacks, as well as secure every connection with zero trust controls.

“With this new Cloudflare One Partner Program for Zero Trust, Cloudflare has launched a first-of-its-kind set of integrated product suites and partner services packages that will give our Trusted Advisors a compelling set of solutions to take to market,” commented Shane McNamara, EVP of Engineering and Operations at AVANT Communications.

The news comes just days after a Cloudflare outage resulted in a number of major websites being knocked offline for around two hours, including those operated by Shopify, NordVPN, and gaming platform Steam.

As remote workforces accelerate cloud migration, network security requirements need to shift.

This study by Forrester shares the latest security requirements and highlights how the networking and security worlds need to merge, with IT teams tasked with identifying a Zero Trust solution that will unify them.

Download now for a better understanding of the emerging Zero Trust solutions to better support business-wide networking.

Provided by

HPE partnered with the Ponemon Institute to globally survey 4,150 IT and IT security practitioners on their biggest security challenges and how to keep up with an evolving threat landscape.

Findings showed that most organisations were planning to implement, or had implemented, zero trust security infrastructure, with under half implementing an SD-WAN solution and SASE security architecture.

Download this report to better understand the practices of those businesses with highly effective security infrastructures and implementation.

Provided by

Hybrid working is here to stay. The new flexible practices that have been adopted in the wake of the pandemic offer many benefits to workers and employers alike, promising a new work-life balance and a realignment to an outcomes-based model where results are prioritised over where and how the work gets done.

Okta’s The New Workplace Report found that 42% of workers want a mix of home- and office-based working, while 17% want to work from home permanently. 60% of workers also said that they would like to work in an asynchronous environment, where they are able to determine their preferred schedule too. The benefits of flexible working are clear to workers, and employers who want to remain competitive have to take these pressures into account, putting paid to any idea that we might all return to 9-to-5 office work.

But hybrid working brings challenges as well as benefits, and one of the most prominent is the impact that it has on security. Dispersed workforces have put new pressures on IT teams and security professionals, who can no longer exercise the same levels of rigid control and oversight they may have been used to when everyone worked from the office.

Fortunately, new zero-trust principles and identity and access management (IAM) technologies, offered by security specialists like Okta, are powering the shift to a new control plane that can protect your critical systems no matter where or how employees are accessing them.

Beyond the perimeter

Traditional office-based working models favoured a network-centric approach to security. With the majority of employees working on premises, the focus was on protecting the perimeter to prevent access to your network by cyber criminals. On-premises endpoints could conceivably be tracked and monitored, and if there were any issues or configuration problems, IT teams and other workers would likely be based in the same building, enabling easy communication and access to devices.

Hybrid working has changed all that. When the first lockdowns hit, suddenly entire workplaces were emptied, with employees having to access systems remotely through their own personal networks, whose security (or lack thereof) falls outside the control of IT teams. Bring-your-own-device (BYOD) practices, whether official or unsanctioned, meant that some devices were likely to be unsecured, too, and made it much more difficult to keep track of endpoints. With the cementing of hybrid working, these challenges will persist indefinitely.

With the perimeter fraying so drastically, it becomes much easier for cyber criminals to find ways to access business networks. Cyber attacks have boomed since the beginning of the pandemic, and the adage ‘it’s not a matter of if, but when’ applies more firmly than ever. For all these reasons, we are seeing a shift in focus from preventing cyber criminals from accessing networks to limiting what they are able to do once they get inside.

When it comes to accessing mission-critical apps and services, credential theft has become a focus of cyber criminals. The 2021 Verizon Data Breach Investigations Report found that stolen credentials were involved in 61% of breaches, with credentials compromised through various methods including brute force and also phishing attacks, the latter of which have continued to boom in recent years. The report found that 85% of social engineering breaches compromise at least some credentials as part of the attack. In systems with potentially hundreds or thousands of unsecured logins with access to critical data and applications, these are ripe for abuse by cyber criminals.

In this new environment, where endpoints are more difficult to secure, we need to shift away from a network-centric approach to security to a place where identity is the new control plane and criminals are prevented from leveraging credentials and trusted paths within our networks. But how can this be managed?

Identity-based solutions

Zero trust is a framework by which access to systems and resources is carefully monitored and controlled. Gartner defines zero-trust security as “never trust, always verify” – in other words, no one has blanket, permanent access that can be taken advantage of if their login credentials are compromised. Users are given the right access for the right length of time, so that IT teams can identify who is accessing what, and can be sure that bad actors are not able to lurk anonymously and indefinitely in these systems to steal data or in any other way compromise them.

As the importance of identity as a new control plane becomes clearer, solutions are emerging to help organisations enshrine zero trust in their operations. For instance, Okta’s IAM solution offers a centralised control plane where identity is a key component – while also focusing on keeping friction to a minimum. This is key – identity solutions that snarl up your day-to-day processes can end up replacing one issue with another. These will not be welcomed by your workforce, no matter how much they improve overall security, and can lead some workers to adopt counterproductive workarounds.

Okta’s IAM keeps the burden on IT teams to a minimum by centralising operations and oversight, and automating processes. It allows permissions to be granted for a set amount of time, tackling the risk of unsecured logins that could potentially end up granting unfettered access to cyber criminals. For users, it provides single sign-on and adaptive multi-factor authentication that makes the processing of requesting permissions and logging in as simple and secure as possible.

Remote working has put serious pressure on our endpoint security measures. With zero-trust solutions, organisations are able to empower their employees to work anytime, anywhere and from any device while remaining confident that access to critical systems is fully controlled and monitored.

Okta supports thousands of organisations to reduce IT admin, work faster and keep employees secure. Learn how leading companies have transitioned to a new workplace with Okta

In the early days of computer networking, cyber security was predominantly focused on the perimeter because it was thought you needed to keep the bad guys out. Within the perimeters was thought to be safe and trusted, while outside the enterprise firewalls danger lurked.

However, this assumes that hackers haven’t already got into the network and started doing damage. Cyber criminals can get a grip within a businesses' infrastructure by exploiting a vulnerable system, stolen credentials, or by exploiting poorly configured wireless connections. To counteract this scenario, many modern enterprises are adopting a zero trust model.

What is a zero trust model?

Zero trust is a relatively new and evolving approach to network design. It means “never trust, always verify”. By default, devices on a network are not trusted, even when connected to a corporate network and even if previously verified.

This model protects the environment by using methods and processes such as network segmentation, strong authentication, preventing lateral network movement, and simplifying “least access” policies.

So how does an organisation go about building, running, and using a zero trust model in the infrastructure?

Network segmentation

The foundation of a zero trust architecture is network segmentation. Systems and devices must be segregated according to the types of data they process and the access they permit. This can then limit the reach of a hacker once they get into the network.

To segment a network, organisations should create a comprehensive roadmap based on business and security aims. They should then map application dependencies so that organisations know how apps communicate to endpoints within the infrastructure. Finally, a network should not be over-segmented as this can lead to over complexity and may prevent employees from doing their jobs properly if they can’t access the systems they need to.

Identity and access management improvement

A strong identity and access management infrastructure is another precondition of a zero-trust model. Multi-factor authentication offers additional reassurance of identity and defends against credential stealing. Implementing role-based access control permits applications to limit access in a way that implements the principle of least privilege.

Deploying least privilege at the firewall

Least privilege not only applies to users, but it also applies to networks. After network segmentation, access between networks should be locked down to only allow traffic between them according to business needs.

Using a next-generation firewall (NGFW) can help organisations to implement what Gartner defines as a “deep-packet inspection firewall that moves beyond port/protocol inspection and blocking to add application-level inspection, intrusion prevention, and bringing intelligence from outside the firewall.”

Monitoring using AI and machine learning

Machine learning can be used by organisations to speed up the work of detecting and mitigating threats. Usually, security analysts would use security information and event management (SIEM) solutions to gain a comprehensive understanding of security events collected from systems, devices, and applications across an organisation’s network and clouds. Machine learning and artificial intelligence (AI) can help to surface threat indicators that would otherwise be lost in reams of data.

This gives security teams a better way of recognising what activity is taking place and if it is normal activity that machine learning has been trained to identify. If this activity falls outside normal usage patterns, AI can flag this up as suspicious and help enterprises improve their defences from both internal and external threats and deploy a more full-bodied zero trust security model.

Ongoing management and issues

A zero trust model should be thought of as part of an organisation’s overall digital transformation strategy. It should be by design and not simply retrofitted. This means implementing technology to achieve zero trust as more systems move to the cloud and legacy systems are replaced.

Moving to zero trust should involve an ongoing conversation between security and the rest of the organisation to prioritise what moves to a zero-trust model and what can wait.

When up and running, managing zero trust should involve security teams developing and maintaining zero trust models, while network teams manage networks. The security team should also carry out regular audits to ensure that the network adheres to the policies and protocols of zero trust. Critical workloads will need more analysis of users and devices compared to other, less important, workloads.

Did you know that Forrester research reports that only four in 10 of developers understand why a zero trust framework is important?

Only 41% understand the impact zero trust has on the organisation. To address this, understanding how improving the relationship between security and development teams can ensure that ownership, responsibilities, and priorities around zero trust are crystal clear.

This study provides the insight and actions needed to understand and act. Use this insight to lead your DevSecOps teams to success with a zero trust game plan.

Provided by

Employees have gotten used to the flexibility of the fully remote workplace, and even if they’re happy to return to the office or a hybrid model, your business needs to maintain that flexibility for all its workers.

Whether it’s working from home or another out-of-office location, using personal devices, or something else, this level of flexibility requires an identity and access management (IAM) solution to keep your people secure and productive.

Watch this on-demand webinar to hear from security and IAM experts about:

• Priorities for security professionals as we settle into permanent hybrid work models
• How CISOs perceive the importance of implementing zero trust
• The components of a well-structured IAM platform

Provided by

Cloud and mobile have dissolved the network perimeter, and remote workers have also escaped the perimeter - so how do you keep your applications secure?

Moving from a perimeter-centric to a zero trust model is key to staying secure in our modern world of work.

In this on-demand presentation, Sami Laine, principal security architect at Okta, discusses:

• Frameworks for a zero trust model
• What contextual access is and how it works
• The zero trust IAM maturity curve
• Three fundamental zero trust properties

Provided by

How do you protect your organisation when some or all of its employees work outside of the network perimeter?

Identity ensures the right person has the right access, no matter where they are and what devices they’re working on.

Watch this on-demand webinar to find out:

• How identity-first security increases productivity through frictionless experiences
• Stages 0-3 of the zero trust maturity model
• How companies worldwide are prioritising components of a zero trust model in the next 12-18 months

Provided by

How do you secure your workforce when the traditional security perimeter of the office is gone? Identity is the new perimeter, and zero trust is the way to protect it.

In this episode of the Digital Identity Webcast series, security experts discuss:

• How modern identity helps you manage separate identification policies across on-premises and cloud
• The business goals of zero trust
• Where many organisations are on their zero trust journey

The companies that are thriving today are those that are leveraging cloud - and safely accessing their cloud applications with a modern IAM solution. Get started today.

Provided by

IBM has unveiled a set of secure access service edge (SASE) solutions to help customers secure complex distributed work environments.

SASE is a concept first articulated by Gartner in a 2019 white paper. It combines security and SD-WAN in a cloud-based approach designed to embed security directly into the network. This enables companies to apply security policies in the cloud that govern users no matter where they are.

Because the network and security are software-defined, administrators can manage them programmatically, making it easier to update these policies across the organization.

IBM Security Services for SASE is an end-to-end offering covering strategic consulting, design and integration, and application onboarding. It also encompasses a set of managed security services in the cloud to protect user sessions and data, such as secure web gateways, cloud-based firewalls, cloud access security broker services and data loss prevention.

Zero-trust security is another big component of SASE. This part of the solution removes implicit trust for people that access the network and verifies their identity when accessing resources inside the company's infrastructure. Zscaler, with which IBM partnered in May, will provide the zero-trust functionality for IBM's SASE portfolio.

IBM sees potential for its SASE services in areas such as hybrid workforce access, contractor and third-party access, and edge computing scenarios. It can also help to secure businesses undergoing mergers and acquisitions, the company said.

IBM commissioned a study from Forrester to support its SASE roll-out, and it found 60% of companies lacked a clear security strategy spanning their entire cloud deployment.

Most companies (70%) found it challenging to implement centralized security controls across multi-cloud environments, while almost two-thirds found it difficult to secure their remote and in-office employees across multiple devices and locations.

McAfee has launched MVISION Private Access to safeguard private applications deployed across hybrid IT environments.

“As private applications increasingly move to the cloud, organizations are rapidly adopting Zero Trust Network Access due to its security and flexibility advantages compared to VPN,” explained Christopher Rodriguez, research director at IDC Network Security.

“However, organizations need to recognize that private applications are just as likely to pose a data theft risk as SaaS apps, and that this risk needs to be mitigated.”

Upending the zero trust network access (ZTNA) arena, McAfee’s MVISION Private Access offers “granular zero trust" access to private applications hosted in private, public, or hybrid cloud environments.

By leveraging McAfee’s Endpoint Security for threat detection and remediation, the platform performs continuous risk assessment by monitoring device posture. Furthermore, MVISION Private Access is integrated with MVISION Unified Cloud Edge (UCE), enabling unified visibility and control across clouds, private applications, web, and endpoints.

MVISION Private Access’s other interesting features include remote browser isolation (RBI), granular controls for unmanaged devices, endpoint security and posture assessment, direct-to-app access, and more.

Lastly, MVISION Private Access includes built-in identity and access management (IAM) and multi-factor authentication (MFA) solutions, enabling strong authentication and context-based access control.

“ZTNA is built for cloud-first deployments, simplifying technology stacks, reducing cost and complexity, and improving productivity. However, existing ZTNA solutions lack the data-centric security controls associated with cloud and web security needed to secure today’s increasing remote connections,” said Shishir Singh, chief product officer at McAfee Enterprise.

Singh added, “MVISION Private Access unlocks secure, seamless and ultra-fast access to private applications for remote workforces and eliminates the additional hardware costs, time-consuming setup process and complicated architecture associated with traditional VPNs.”

Kemp has launched a low-friction Zero Trust Access Gateway (ZTAG) architecture to help organizations implement zero trust policies across their application ecosystems.

“The increase in work-from-home, hybrid cloud, BYOD, and IoT blurs the border between what is on premises and what is beyond the perimeter. This raises new challenges around maintaining compliance and a consistent security posture without detriment to the easy access to services for users,” said Kemp.

Kemp’s zero trust architecture enables secure remote access to load-balanced web applications through a suite of policy-based access control services, including active traffic steering, intelligent content-based routing, and contextual identity validation.

ZTAG also allows for Identity Provider (iDP) integration, so businesses can validate clients’ credentials before granting access to sensitive applications.

Kemp LoadMaster actively directs traffic based on the geographical location of customers and security zone levels of backend services, adding an extra layer of security. Several factors influence service access, including security group membership, source network, and information embedded in HTTP communication.

An embedded web application firewall (WAF) and intrusion prevention system (IPS) on Kemp identifies violations in authenticated client traffic and prevents exploits from taking place.

Organizations can also apply granular restrictions to application and user access depending on clients’ security zones and identities. For instance, a client in security zone A can only read, while those in security zone B may be trusted to execute read and write operations.

Kemp’s other interesting features include multi-factor authentication (MFA), automated configuration and deployment via REST-based policy builder, application reverse proxying, and multi-network service publishing.

"Zero trust is the future of application access and continues to gain traction for customers," said Jason Dover, VP of product strategy at Kemp.

"Kemp is leveraging the privileged position of the load balancer combined with our extensible automation framework to help customers simplify the introduction of a zero trust model into their application ecosystem."

The IT industry has long had a problem with buzzwords, with marketing teams latching onto the latest trends and using them to push their products as ‘the next big thing’. It’s even more pronounced in cyber security, where buzzwords can be backed up with a dose of fear, uncertainty, and doubt over new threats.

As a result, it can be difficult for buyers to parse the genuinely valuable solutions from those that simply have the latest buzzwords thrown into their sales pitches. This makes it more challenging for partners to decide which solutions to bring into their portfolio and can also make it more difficult for them to cut through the noise and sell successfully.

Zero Trust is one such trend, providing increased assurance that only trusted identities are able to access critical networks, systems and data. It’s become particularly beneficial as organisations must now deal with a largely remote workforce that falls outside the scope of normal processes.

However, there are a few barriers to implementing this model that may have some organisations holding back. Nevertheless, there's a real opportunity for channel firms in adding Zero Trust to their portfolio. While Zero Trust is time and resource-intensive, the value that it adds can make taking the plunge more worthwhile. Based on our experience with our growing channel community, here are four real-world outcomes partners can achieve if they invest in Zero Trust.

Establishing strategic value

Partners should be striving to create strong, long-term strategic relationships with their clients rather than simply selling products on a transactional basis. Establishing a role as a trusted adviser can vastly improve customer retention and the lifetime value of a customer.

Zero Trust is ideally suited for forging or strengthening this relationship. Partners have an opportunity to play a major role in the delivery of the Zero Trust model, which will impact the wider security strategy, providing further opportunity to establish their credibility as a trusted adviser and deliver more value.

Increasing the share of income

Zero Trust is not a specific, singular product, but a framework incorporating technology across five main areas: people, data, devices, networks, and workloads. All of these areas are supported by a process of continual improvement that delivers visibility and automation.

This means that helping to deliver a Zero Trust model creates a huge opportunity to influence and support the wider security strategy of the organisation. Partners with the right services and solutions can significantly increase their share of wallet by providing all the products and services the customer needs to continue on their Zero Trust journey.

Establishing 'ZTaaS'

Zero Trust is not a “one and done” type of solution that can be delivered and signed off but is a project of continual improvement. Because it spans multiple pillars of technology, channel partners can establish an MSP agreement that delivers service engagements across their portfolio.

A Zero Trust as a service (ZTaaS) package will both provide the partner with multiple, repeatable streams of revenue, and ensure that the customer has access to best of breed, marketing leading solutions.

Safeguarding gross product margins

Achieving and maintaining high gross product margins is always a challenge when rivals are offering competing bids offering like-for-like comparison or undercutting on price.

The powerful differentiator created by becoming an established, strategic adviser ensures that channel partners are shielded against competing bids that are sold on price alone. The more involved a partner is in the Zero Trust project, the more strategic and financial sense it will make for the customer to expand the existing relationship rather than explore competing bids.

Seizing the opportunity

Zero Trust has a huge potential global market, with the majority of security teams planning to adopt the model in future, and many already implementing a framework. Business needs have, of course, changed drastically in recent months due to COVID-19, and the model’s ability to manage user authentication has become more important for dealing with remote workforces.

Organisations need strategic partners that can genuinely deliver the technology, services and expertise needed to implement a successful Zero Trust model, rather than those that are simply throwing the latest buzzwords into their sales pitches. Partners equipped to meet these needs have a powerful opportunity to create and maintain highly valued and long-lasting strategic relationships.

Scott Walker is senior director for channel and alliances for EMEA at Illumio

Microsoft has launched new functionality across its Azure Active Directory (AD) authentication portal and Microsoft 365 to advance its zero trust security strategy and protect its customers against insider threats.

‘Zero trust’ is a security strategy based on the need for businesses to adapt to increasingly sophisticated threats, and is based on the assumption that nothing within the corporate network can be trusted.

Microsoft is among a handful of tech companies to adopt these policies in a meaningful way over the past few years, with features revealed at its Ignite 2021 conference in Azure AD and Microsoft 365 bolstering the firm’s zero trust capabilities.

Passwordless authentication is now generally available in AD across all cloud and hybrid environments, with users able to use biometrics, Windows Hello for Business, the Microsoft Authenticator app or FIDO2 security key to log-in.

The policy engine Azure AD Conditional Access now uses authentication context to enforce more granular policies based on user interactions within an app, also taking into account the sensitivity of data they’re trying to access.

Verifiable credentials, which lets organisations confirm pieces of information on their employees such as education or professional certificates, is also entering public preview within the next few weeks. This verifies claims made without collecting any personal data. The government of Flanders and the NHS are already piloting this service.

“As defenders ourselves, we are passionate proponents of a Zero Trust mindset, encompassing all types of threats - both outside in and inside out,” said Microsoft’s corporate VP for security, compliance and identity, Vasu Jakkal.

“We believe the right approach is to address security, compliance, identity, and device management as an interdependent whole, and to extend protection to all data, devices, identities, platforms, and clouds – whether those things are from Microsoft, or not.”

Changes in Microsoft 365 are largely based on trying to eliminate the insider threat, both malicious and unwitting, with the firm investing in creating inside-out protection by extending its capabilities to third parties.

Improvements in compliance include co-authoring documents protected with Microsoft Information Protection, which allows multiple users to work simultaneously on documents while benefitting from the extensive protection for documents and emails across Microsoft 365 apps.

Microsoft 365’s Insider Risk Management Analytics will allow customers to identify potential insider risk activity within an organisation, which will then inform policy configurations. Tools include daily scans of tenant audit logs, including historical activities, with machine learning used to identify any risky activity.

Azure Pureview, Microsoft’s unified government platform for on-premises, multi-cloud and software as a service (Saas) data, can also be used to scan and classify data residing in AWS S3 buckets, SAP EEC, SAP S4/HANA and Oracle Database.

“Adopting a Zero Trust strategy is a journey,” Jakkal continued. “Every single step you take will make you more secure. In today’s world, with disappearing corporate network perimeters, identity is your first line of defence.

“While your Zero Trust journey will be unique, if you are wondering where to start, our recommendation is to start with a strong cloud identity foundation. The most fundamental steps like strong authentication, protecting user credentials, and protecting devices are the most essential.”

Microsoft is also launching what it calls an “assume breach” toolset, which comprises tools and features that can help customers adopt the assume breach mentality without being hampered by the complexity that it can often entail. This is a critical component of the overall zero trust umbrella.

Among the improvements, Microsoft Defender for Endpoint and Defender for Office 365 customers can now probe threats directly from the Microsoft 365 Defender portal, which provides alerts and in-depth investigation pages. A Threat Analytics section also provides a set of reports from Microsoft security researchers that help customers understand, prevent and mitigate active threats.

The cyber security landscape has been completely transformed over the last 12 months, with the majority of organisations seeing a rise in threats since the beginning of last year. The era of remote working has only exacerbated this problem due to workers accessing networks at any time, from anywhere, with their personal or work devices, through their home or public Wi-Fi connections. Coupled with employee disengagement, this makes an organisation far more vulnerable to attack.

For channel partners set on providing a positive customer experience, it’s essential this raised threat level is acknowledged, at the very least. They should be prepared to support customers in tackling their security challenges, acting as key advisors in the mission to address client pain points by offering bespoke services.

A good place to start for many channel partners working to support CIO/CISOs and their teams is encouraging a zero trust model. This is an important aspect in the era of digital transformation and remote working, and channel partners can be well-placed leverage their knowledge of it so it can become a beneficial framework for customers.

A new way of thinking

To create security resilience in times of uncertainty, companies must move away from the idea that any asset or user within the network perimeter can be trusted. It’s necessary for channel partners to help customers understand that zero trust is neither a technology nor a setup, but instead an attitude.

It’s a concept that requires every user, including internal members of an organisation, to be regularly authenticated. Because it’s impossible to monitor what you can’t see, moreover, companies need help to obtain a clear view of everything that’s happening on their network.

Zero trust typically involves negative connotations stemming from the idea that ‘no one is trusted’. Fortunately, opinions on zero trust have started to shift, especially because it allows IT and security leaders much more control at a time where networks are only getting more dispersed and complex. Rather than the inherent trust previously offered to those inside the network, a lack of visibility, increase in endpoints and dramatic shift to the usage of personal devices means it’s less practical to trust those within the network.

While it may come as a culture shock to some, this philosophy will expand in 2021 and become the ideal security architecture as hybrid working takes precedence. With more and more businesses adopting zero trust, it’s becoming one of the most sought-after methods to combat the expanding threatscape - and rightly so.

The cyber crime fightback

For channel partners to stay relevant, they must share their technical knowledge with clients and become an active part of their zero trust journeys. Shifting to this model is no easy feat but it’s imperative to ensure fool-proof protection at a time when IT environments are complicated by a fluid workforce and fiercer cyber attacks than ever. There are three steps that can truly benefit channel partners, allowing them to help their customers succeed in this challenging landscape:

Communicate: Zero trust is not a new idea, yet it’s one that can often be misunderstood. With proper communication, channel partners can explain the processes, correct company culture and recommend best network visibility tools that all contribute towards creating the ideal environment. They will begin to gain the customer’s trust and step into the role of a supportive ally in the face of escalating cyber attacks.

Understand: Following a challenging financial year for many, channel partners need to understand their customers won’t have huge budgets which can be used to invest in new technologies. Rather, partners must tailor their proposals to what is realistic for the organisation by implementing technologies that will help optimise their existing investments.

Demonstrate: While security will be a big concern for many companies, it won’t be their sole focus. It’s important that channel firms demonstrate how a zero trust mindset may help their customers in more ways than one. This architecture can help to boost employee productivity, as well as allow the wider business to better cope with the current climate. With potentially sensitive data flowing between corporate networks and personal devices, a framework that increases security, reducing the threat of breaches from internal and external sources, without impacting productivity is a no-brainer. As long as channel partners demonstrate the benefits of zero trust, it’ll be difficult for clients to ignore its potential.

Cyber security worries are plaguing many businesses. While employee engagement weakens as further lockdown restrictions are put in place, this remote and distributed landscape looks set to sta. However, embarking on a zero trust journey is an effective means to fight back against cyber crime, with many more IT leaders adopting the philosophy. If channel partners want to help their customers emerge victorious this year, they should embrace the zero trust mindset and become the support system for every business looking to invest in cybersecurity.

Adrian Rowley is senior director sales engineering EMEA with Gigamon

The pandemic upended a lot of things in the business world, but one thing it accelerated was remote access. More staff than ever before worked from home and systems and platforms like Zoom got the kind of attention and publicity money can't buy.

Organizations both large and small scrambled to migrate applications and data to the cloud, embracing the hybrid cloud model so we could access work from our home devices. The remote worker age finally arrived en masse.

However, some platforms simply hadn't been built for the new threat landscape and were left scrambling to patch vulnerabilities even as users and data generation skyrocketed. Since then, cyber attacks have risen sharply. During the first quarter of 2024, a report by security provider Check Point Research recorded a 28% surge in the number of cyber attacks compared to the previous quarter.

It's not just an issue of inadequately secured software; it's clear that that user education often falls short. A report published by WEC in 2022 found that 95% of cyber security incidents were the result of 'human error', with weak passwords, sharing work devices with family and friends, smartphones that aren't locked by default, and other unsafe behaviors still rife.

So along with giving workers the flexibility they now demanded, organizations needed to work harder than ever to fortify their domains and networks, and the devices that access them, against breaches. This had led to a rise in the so-called Zero Trust model, a paradigm change that might finally secure the remote work age.

How Zero Trust works

The old methodology – castle and moat security – assumed that all devices and applications inside the network perimeter were trusted in perpetuity as long as they'd been onboarded according to security protocols. But security analysts and providers were saying as long ago as 2022 such an approach had no place in a remote work, cloud-enabled world.

Zero Trust means exactly what it says – every request from an application, device, human operator, or process is treated with suspicion and blocked until it can be proven to be trustworthy. It's also built on the awareness that the point of infiltration is only the doorway, not the target. That means it has multiple verification methods like two-factor authentication (2FA) or micro-segmentation for users or processes even after they've logged in.

This also prevents attackers from carrying out lateral attacks, spreading throughout a victim’s network, after gaining initial access.

Zero Trust is catching on fast as a security model. The market is expected to be worth over $82.45 billion (£63 billion) by 2030, according to Grand View Research data, with small and medium-sized enterprises (SMEs) projected to drive the most growth in this area.

What strategies does a Zero Trust network model use?

One of Zero Trust's selling points is that it can be built into existing architectures by deploying systems and safeguards such as:

Least Privilege

The principle of Least Privilege states that users, systems, and processes should be granted access only to those resources necessary to to perform their job function. Any time a user requests access to an application, process, data store, or domain, the request is judged against what is necessary for their role. Least privilege goes hand in hand with Zero Trust, building on that idea that access is blocked by default and only granted if a clear and valid reason is given.

Identity and access management (IAM)

IAM automates the processes of authenticating users and managing the appropriate levels of access for each user. IAM systems will provision users with access based on their role and de-provision employees who leave the company. This is often the workhorse behind a Zero Trust system, and the mechanism by which Least Privilege is enforced.

Multi-factor authentication (MFA)

Also very common in the consumer world, especially when logging in to sensitive accounts like finance, government, or health records, 2FA or MFA is simply making the user confirm an access request through an unrelated network vector like getting a code via SMS or email. This simply increases the robustness of an organization's authentication process, and makes it more likely that the person requesting access is who they say they are.

Endpoint security

Even before we started working from home, bring your own device (BYOD) was a popular methodology. The endpoints that workers use to access company information – whether their own or company-supplied – need to be properly secured with endpoint security software. This is usually achieved with endpoint detection and response (EDR) software, which is capable of monitoring devices, flagging any vulnerabilities, and automatically responding to threats.

Segmentation

Although common in other security models, segmentation plays a pivotal role in supporting the other strategies listed above and mitigating the impact of any breach. This method divides workloads into separate zones and secures them individually, creating more barriers that attackers would have to bypass. This is critical for ensuring that, should a breach occur, an attacker is unable to easily move between systems or user accounts.

How do you enact Zero Trust in an organization?

There is no one-size fits all process for implementing Zero Trust, although most resources will suggest following a broad approach of:

1. Define your attack surface

2. Implement security controls

3. Architect your Zero Trust network

4. Create policies that enforce Zero Trust

5. Monitor and audit

Start by identifying your most sensitive information and silo it somewhere separate from everything else – automated discovery tools can help you decide which data flows are absolutely essential. 

Next, create a map of the surrounding traffic so you know how it will be accessed, used and shared.

You can then architect your network and data structures into micro-segments that each need their own Zero Trust security verification to allow process and requests through.

Once your controls are in place, you need to support these with clear security policies. These are critical for ensuring employees follow correct procedures and that Zero Trust is enforced consistently across the enterprise.

Finally, the process of monitoring can begin, allowing you to assess how effective the approach has been implemented, and whether system performance or workflows have been adversely effected. Changes may need to be implemented following an audit.

If that all sounds complicated and unwieldy for users, the beauty is much of the verification can be automated, all working in the background and notifying human operators only when a request access isn't verified.

The challenges of implementing Zero Trust

Like all new technology approaches, Zero Trust can be complex and will seldom be cheap – although it will be far more cost effective than the average cost of a data breach, which IBM put at $4.45 million last year. That's before considering the intangible, and possibly far more expensive, blow to the trustworthiness of your brand.

It's possible to install Zero Trust in current generation architectures, but the IT team might have to purpose build segments into the network to establish access points. Do your sums and you might find it more cost effective to engage a security vendor and migrate to a new architecture with Zero Trust already built in.

You should also plan for a period of time post-implementation to allow for staff training, and potentially some customer education. While nobody wants their security landscape to be onerous and irritating, you have to get people used to new user management, even if it's convincing them that two-factor authentication is necessary.

Staff are now enjoying a mix of working from the office and home and many companies feel confident that they finally have their security architecture sorted out. The thought of adopting a whole new cyber security philosophy that will only cost more money may seem daunting, but since the costs of cyber crime are expected to rise to $10.5 trillion next year, can you afford not to?

Zero trust is a security model built around the idea that nothing inside or outside of an organisation can be trusted. Read this whitepaper to consider how this model will impact your workforce and what benefits you can reap from implementing such a strategy.

Organisations should embrace the philosophy and principles of zero-trust security to keep up to date with modern demands and security threats, AWS’ chief information security officer (CISO) Steve Schmidt has urged.

Adopting the core tenets of a zero-trust philosophy, including accessibility and usability, and ensuring you’re focusing on the core fundamentals of security, will ensure businesses can eliminate needless risks in their IT estates.

Doing so, however, isn’t as straightforward as businesses may hope, according to Schmidt. This is because the term ‘zero-trust’ can mean different things in different contexts, with this ambiguity the product of a diversity of use cases to which it applies.

“Zero-trust is, to me, a set of mechanisms that focus on providing security controls around digital access and assets while not solely depending on traditional network controls or network perimeters,” he explained, speaking at AWS re:Invent 2020.

“In other words, we aren’t going to trust a user based only on their location within a traditional network. Instead, we want to augment network-centric models with additional techniques, which we would describe as identity-centric controls.”

An example of one such use case that he provided was human-to-application security, which is particularly relevant given the surge in people working from home in 2020. Traditionally, applications sat behind a virtual private network (VPN) front door, but these aren’t compatible with the diversity of devices that workers use to access work-related services. Applying zero-trust principles generates the objective to make the locks on applications effective enough that you can eliminate a VPN-based front door altogether.

Zero-trust principles have become far more popular across the industry of late, with a number of companies quick to adopt and promote this philosophy either as part of their own strategies or in their products.

BlackBerry, for example, announced Persona Desktop in October, a security platform that uses artificial intelligence (AI) and machine learning to detect user and entity behaviour abnormalities. Persona Desktop works at the endpoint, and eliminates the need to share data back to the cloud before the system acts, and also aims to protect against stolen credentials, insider threats, and physical compromise.

Google, too, launched a zero-trust remote access service known as BeyondCorp Remote Access earlier this year that’s designed to give remote teams access to their internal applications without the need for a VPN.

As part of Schmidt’s outline of AWS’ security strategy, he also proposed a set of questions that businesses and IT administrators should ask about their organisation’s security configuration. Elements such as where the perimeter is, and how large it is, as well as how easy it might be to monitor and audit, should be considered.

Schmidt also, by way of example, suggested that while VPNs are fine to use for network isolation, it would be best to make the implementation dynamic and hidden from the user experience. This might lead to users not even noticing that network boundaries are being created and torn down as required.

BlackBerry has announced BlackBerry Persona Desktop, an all-new security solution that uses advanced artificial intelligence (AI) and machine learning to detect user and entity behavior abnormalities.

Once the new BlackBerry Persona Desktop notices an irregularity in behavior, it protects the endpoint, network and data.

BlackBerry Persona Desktop works at the endpoint, eliminating the need to share data back to the cloud before acting. This allows it to work in real-time with minimal delay to prevent hacks and data breaches.

On top of working faster, BlackBerry Persona Desktop also protects against even the most challenging security challenges, including:

• Stolen credentials: Persona Desktop protects in the event of stolen credentials by learning how a user works and their interaction with a device. If Persona Desktop senses abnormal interaction, it sends an alert through the cloud and takes other threat-mitigation actions, like asking for second-factor authentication.
• Insider threats: If a rogue employee attempts to breach your system, the Persona Desktop can detect the abnormal behavior and flag the risk. It’ll then alert the administrator, who determines what action Persona Desktop takes to mitigate the threat.
• Physical compromise: If someone physically compromises or steals a device, BlackBerry Persona Desktop uses biometric capabilities, including keystrokes and mouse movement, to sense a different user and alert an administrator or lock the user out.

BlackBerry Personal is available with the BlackBerry Cyber Suite, which is a unique combination of endpoint protection (EPP), mobile threat defense (MTD), endpoint detection and response (EDR), and user and entity behavior analytics (UEBA) products together in one package.

The sudden surge in remote work and direct-to-cloud consumption of SaaS applications are putting pressure on the role of the physical security perimeter to business applications. Users need access to on-premises applications from multiple locations, and IT and cyber security teams have an imperative to provide secure access to these critical resources across a hybrid cloud environment.

With this challenge comes the need to reevaluate existing approaches to and controls of the perimeter. Organisations are moving away from the traditional method of using Virtual Private Networks (VPNs) because the way VPNs require a connection between the corporate network and the individual’s device allows for threats to be introduced through unmanaged devices.

This whitepaper champions zero-trust as the perfect approach for securing access while also providing operational efficiency. It can secure both cloud and on-premises applications with its improved mobility, threat detection, and data-loss prevention. Download this whitepaper for a framework to successfully implement a zero-trust strategy.

In an explosion of enterprise cloud adoption, many companies are leveraging cloud technologies to optimise business processes and deliver products and services more quickly at a lower cost.

However, with this shift comes a decreased security perimeter for users and internal services within the corporate network. Potential data breaches, and the cost of downtime and loss of reputation that would follow, are something that IT leaders need to consider.

This whitepaper provides an argument for the use of cloud-delivered services that can scale to meet user demand and are hosted by a cloud security provider. Download now to find out more about zero trust network access services.