Migrating to a zero trust security model can involve significant costs, both in terms of time and resources.
Here are five strategies organizations can use today to reduce those costs without compromising the migration:
- Prioritizing
- Adopting a Phased Approach
- Leveraging Existing Technology
- Using Open-Source Solutions
- Implementing Automation
Read on to discover concrete examples of tools and technologies you can start using today.
1. Prioritize
Conduct a cybersecurity risk assessment to identify the most critical assets and data that need protection. This will help you prioritize your efforts and allocate resources where they are needed most.
In most assessments Zephon conducts for clients, we strongly recommend an organization-wide data discovery and classification exercise. Critical assets, and the data flowing through them, are usually easy to identify. But data also ends up scattered in the most unexpected and insecure locations. This leaves organizations vulnerable to data breaches in spite of having all the right security controls around their critical assets.
Once you have your crown jewels (systems and data) identified, focus on those first, and migrate them to a zero trust security model. This takes us to the next strategy.
2. Adopt a Phased Approach
Rather than trying to implement zero trust security across your entire organization at once, consider adopting a phased approach. Start with a pilot program or a small group of users and gradually expand from there. Focus on the critical assets and data first.
For all the migrations to a more mature zero trust security level that we have implemented, the primary factor in our success has been utilizing a phased approach.
Do not try to boil the ocean.
3. Leverage Existing Technology
Before investing in new tools and technologies, review your existing infrastructure and see if there are any solutions that can be repurposed or upgraded to support zero trust security.
Here’s an example: a tool we developed to automate the ingestion of AWS IAM security policy data into RSA Archer by converting it to CSV: https://github.com/zephontech/utils-python/blob/master/AWSIAM_RolesToPolicyCSV.py
4. Use Open-Source Solutions
Consider open-source solutions (OSS) for components such as identity and access management (IAM) or network segmentation. These can often provide robust functionality at a lower cost than proprietary solutions.
Here are a few examples of mature and frequently updated OSS that organizations can use in their zero trust journey:
IAM:
- Keycloak
- SuperTokens
- Ory
- Gluu
- FreeIPA
- Shibboleth
- SimpleSAMLphp
- Open Policy Agent
Micro Segmentation:
- Project Calico
- Cilium
- Istio
- Project Antrea
- Traefik
Network / Security Monitoring:
- Wazuh
- Zabbix
Application Security:
- Apache Knox
Endpoint Security:
- Osquery
- Wazuh
We have used many of these tools in client work. If you have questions about them, or about using open source for Zero Trust, feel free to reach out.
5. Implement Automation
Automation can help reduce the workload associated with zero trust security, particularly when it comes to managing access and authentication. Look for tools and platforms that support automation, such as continuous access evaluation (CAE, supported in Microsoft Entra ID) or policy-driven orchestration.
Policy-driven orchestration is a newer but very powerful approach. It allows organizations to define, manage, and enforce security policies consistently across an organization's IT infrastructure. Various tools implement security as code, mainly for cloud environments. Some examples of Policy Orchestration tools are:
- IBM Security Policy Manager
- AlgoSec
- Tufin
- FireMon
- Forescout
The policy orchestration tool that you implement should be integrated with your IAM and SIEM tools to enable you to automate the remediation of any deviations from security policy.
Security Orchestration, Automation, and Response (SOAR), now supported by most major SIEM tools, allows organizations to not only identify malicious and unauthorized behavior, but automate the remediation process too. Here’s an example Zephon implemented for a client: Security automation and reverting unauthorized changes.
Conclusion
Zero Trust matters too much to postpone because of cost. Any organization can use these five strategies to mature its security posture gradually, at a pace its budget can sustain.
Every organization is different and has different needs. The journey to Zero Trust may seem like an uphill climb, but it is doable. The right strategy turns it into a series of manageable steps.
If Zero Trust is a priority for your organization and you have questions, reach out at contact@zephon.tech. We can help you take the first step.