Behind The Buzzword: Four Ways to Assess Your Zero Trust Security Posture

With just about everything delivered from the cloud these days,
employees can now collaborate and access what they need from
anywhere and on any device. While this newfound flexibility has
changed the way we think about productivity, it has also created
new cybersecurity challenges for organizations.

Historically, enterprise data was stored inside data centers and
guarded by perimeter-based security tools. But with users using
endpoints and networks your IT teams don’t manage, this approach
has become antiquated.

To combat this new reality, organizations have turned to tactics
such as relying on device management and antivirus software, as
well as single sign-on and multi-factor authentication. Some
vendors have even begun to claim these measures as a form of
Zero Trust^[1], a popular idea where
organizations should not trust any entity and provide access to its
applications and data until its risk levels are verified.

In this blog, I will break down what is and what isn’t Zero
Trust.

Four key “just becauses” of Zero Trust ‍

While most of us understand Zero Trust conceptually, the path to
Zero Trust is a complex and constantly evolving journey. As I
discussed in a previous Zero Trust blog^[2], there is no silver
bullet to achieve Zero Trust, but there are ways for us to
visualize and apply it to day-to-day IT and security
operations.

To figure this out, I recently invited Andrew Olpins, a
solutions engineer at Lookout, onto our latest Endpoint Enigma podcast episode. We cut
through all the marketing noise and discussed whether there’s a
pragmatic way to get started with Zero Trust. Here are a few
takeaways from our conversation:‍^[3]

1 — Just because a device is managed
doesn’t mean it can be trusted‍

Often organizations default to managing devices to secure their
endpoints. The idea is that if you have control over your
employees’ endpoints, they are secure. But it’s not enough. While
device management tools can push updates to operating systems and
apps, they don’t grant any real-time visibility into the risk
levels of the endpoint. Zero Trust only works when you have a
continuous understanding of an endpoint so you can make decisions
about its access.‍

2 — Just because a device has
antivirus doesn’t mean it’s free of threats‍

Malware is just one of the many ways a threat actor can
compromise your organization. In fact, to skirt detection, attacks
often use more sophisticated tactics like creating backdoors into
infrastructure via internet-facing remote access systems such as
remote desktop protocol (RDP) or virtual private network (VPN).
They can also leverage vulnerabilities in operating systems or
applications to gain additional access to an
endpoint.‍

3 — Just because someone has the
correct ID and password doesn’t mean they’re the user in
question‍

Another way for an attacker to compromise an endpoint or an
account is by using social engineering tactics. There are now
countless channels to deliver phishing attacks to an endpoint, such
as SMS and third party messaging, email, social media platforms,
even dating and gaming apps. With users having easy access to
various enterprise apps such as Microsoft Office 365^[4], Slack^[5]
and SAP SuccessFactors^[6], any of these accounts
can be compromised.

This is where you need an integrated solution that can detect
the context around a user’s behavior. With integrated data loss prevention (DLP) and user and entity behavior analytics
(UEBA), security teams can understand the types of data a user
seeks to access and whether it aligns with what they need access to
and whether it’s normal behavior. Without these, you can’t tell
whether a user is who they say they are and enforce Zero
Trust.‍^[7][8]

4 — Just because we know them doesn’t
mean they aren’t a risk to your organization‍

Even when you have figured out that a device or endpoint is
legitimate, doesn’t mean they aren’t a threat to your organization.
Threats can come from internal users, whether intentional or
unintentional. I recently wrote about Pfizer intellectual property
being^[9] stolen by an employee
that went rogue. In addition to malicious insider threats, any of
us could easily share content to unauthorized users
accidentally.

Like what Sundaram Lakshmanan, Lookout CTO of SASE Products,
wrote in his 2022 Predictions blog^[10], cloud
interconnectivity has amplified user errors and compromised
accounts threats, because data can now move at lightning speed.
This is why DLP and UEBA are essential to a solution, just as it
can figure out whether an account is compromised, it can also stop
insider threats and data leakage by legitimate employees.

‍Get your fundamentals right: deploy an integrated Zero
Trust solution‍

The above “just becauses” are some of the most common
misconceptions about Zero Trust, a concept that should be at the
core of every organization’s security posture. By no means is my
list comprehensive, but it should get you in the right mindset when
it comes to vetting vendors that claim to offer a single tool that
can solve challenges related to a remote-first environment. In
reality, no one can solve every piece of the Zero Trust
journey.

Here at Lookout we have integrated endpoint security with Secure
Access Service Edge (SASE) technologies to ensure that your
sensitive data stays secure without hindering the productivity of
your work-from-anywhere users.

How do we do it? Take a look at this webinar where we break down
why Zero Trust isn’t just a
buzzword^[11], and how Lookout’s
solution ensures that you can deploy intelligent Zero Trust that
leverages telemetry from endpoints, users, apps, networks and
data.

Note — This article is written and contributed by Hank
Schless, Senior Manager of Security Solutions at Lookout.