{"id":11858,"date":"2021-12-21T09:54:00","date_gmt":"2021-12-21T07:54:00","guid":{"rendered":"https:\/\/www.thegreenbow.com\/?post_type=resource&p=11858"},"modified":"2023-06-08T12:19:58","modified_gmt":"2023-06-08T10:19:58","slug":"four-preconceived-ideas-about-zero-trust","status":"publish","type":"resource","link":"https:\/\/www.thegreenbow.com\/en\/ressource\/blog-en\/four-preconceived-ideas-about-zero-trust\/","title":{"rendered":"Four preconceived ideas about zero trust"},"content":{"rendered":"\n
\n

Author : Nicolas Tondre, Product Marketing Manager<\/strong><\/strong><\/p>\n\n\n\n

Zero trust is a term that Forrester popularized in 2010, and Gartner cemented its use a few years later. It builds on the concept of de\u2011perimiterization, which dates back to the early 2000s. While the term is essentially a buzzword and has disheartened more than one IT Security Officer, zero trust nevertheless covers a set of useful principles and practices.<\/p>\n\n\n\n

Overall, the concept is worthy of attention, particularly considering that the National Institute of Standards and Technology (NIST) ended up imposing it on the United States federal government. It can be considered as a set of rules and practices aimed at improving the security of a company’s or organization’s information systems (IS). It consists in implementing multiple and complementary security components (MFA, SSO, IAM, VPN, least privilege, network segmentation, SIEM, etc.) to reduce the risk of intrusion and data leakage.<\/p>\n\n\n\n

However, it is still enshrouded in a number of persistent misconceptions and hampered by inaccuracies. This article aims to demystify four preconceived ideas about zero trust:<\/p>\n\n\n\n

What should we do? As Einstein said \u201cConcern for man and his fate must always form the chief interest of all technical endeavors.\u201d, so, work agile which means that cybersecurity questions should be taken in account from your project day one until the end. Turn cyber-security topics into daily ones, make it the new normal to avoid having people taking it \u201clightly\u201d. It is important for people to understand that cyber-security isn\u2019t an option, when a hospital isn\u2019t working for 3 days (Dax Hospital in France), the consequences of people not getting care or surgery are real.<\/p>\n\n\n\n

    \n
  1. Zero trust replaces the use of corporate VPNs<\/li>\n\n\n\n
  2. Zero trust only applies to the cloud<\/li>\n\n\n\n
  3. Zero trust frees us from recommended cyber hygiene rules<\/li>\n\n\n\n
  4. Corporate VPNs do not offer any zero trust features<\/li>\n<\/ol>\n\n\n\n

    <\/p>\n\n\n\n

    1. Zero trust replaces the use of corporate VPNs<\/strong><\/strong><\/h2>\n\n\n\n

    Some vendors of security solutions pit zero trust against VPNs in their marketing presentations. However, zero trust solutions support end-to-end encryption of communications, guaranteed data integrity, as well as server-side user authentication and vice versa\u2014the exact same services a VPN provides.<\/p>\n\n\n\n

    It then becomes quite obvious that all zero trust solutions include VPN tunnels, but they do so within an architecture in which VPNs are only one of many security components, with which they integrate natively.<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    \"thegreenbow-cas-usage-diffusion-restreinte\"
    Sensitive data management for industrial plants<\/figcaption><\/figure>
    \n

    There are also many situations in which zero trust is not the appropriate solution for the network architecture that has been implemented. <\/p>\n\n\n\n

    For example, when it comes to controlling a nuclear power plant, no solution is more comprehensive and simple than using a VPN access from a secure workstation that is restricted to a limited number of people.<\/p>\n<\/div><\/div>\n\n\n\n

    <\/p>\n\n\n\n

    Likewise, accessing sensitive data or restricted data from critical market operators<\/a> and government bodies warrants the use of a VPN on a dedicated workstation.<\/p>\n\n\n\n

    2. Zero trust only applies to the cloud<\/strong><\/strong><\/h2>\n\n\n\n

    The preconceived notion that zero trust only applies to the cloud is equally hard to budge.<\/p>\n\n\n\n

    When accessing cloud services, such as Microsoft 365, Google Workspace, or Salesforce, it is the browser that provides authentication, encryption, and data integrity through TLS tunnels. In this context, the software provider  or operator of the cloud service becomes responsible for securing communications. This also means that the software provider or cloud service operator has control over your data, which raises concerns with regard to independence, trust, and sovereignty\u2014but that is another debate. Software vendors and cloud service operators often provide mechanisms to delegate authentication (SSOs), so as to reduce the number of accounts and passwords they need to manage.<\/p>\n\n\n\n

    However, it is with on-premises networks that zero trust makes the most sense, as it aims to give employees access to no more information than they are entitled to in the local information system, a public cloud, or a private cloud, regardless of whether they access it from a remote location or on premises.<\/p>\n\n\n\n

    3. Zero trust frees us from recommended cyber hygiene rules<\/strong><\/h2>\n\n\n\n

    Zero trust is in fact a set of cyber hygiene and common sense rules that everyone should follow to ensure network and data security.<\/p>\n\n\n\n

    These rules can, for example, be found on the ANSSI\u2019s website<\/a> (in French). Among other things, they consist in the following:<\/p>\n\n\n\n