Who can we trust in the age of Zero Trust?

Author: Aytun Çelebi

Zero Trust is a new cyber security trend that differs from the classical security approach and provides more effective protection.

What is Zero Trust, when did it emerge?

The Zero Trust approach, which requires a radical change in the traditional understanding of trust, influences the cyber security field. Before Zero Trust, when a user logged into a system, the system would trust him and grant the necessary access privileges. However, Zero Trust is based on the principle that this system’s trust is actually a weakness.

Although the term “Zero Trust” was first coined in a Ph.D. thesis in 1994, it was first considered as a cybersecurity model in 2010. The Zero Trust Network (or Zero Trust Architecture) model, proposed 11 years ago by John Kindervag, principal analyst at Forrester Research, is now considered one of the most powerful protection standards by experts against data leaks, vulnerabilities, and cyber threats of any kind.

Research and data also support these views on ‘Zero Trust’:

• By 2022, 80 percent of new digital business applications opened to business partners will be accessible with zero trust network access (ZTNA). (Gartner)
• By 2023, 60 percent of organizations will stop using VPNs for remote access within the framework of Zero Trust policies. (Gartner)
• 40% of cyber breaches are caused by users accessing resources they do not have permission to access. (IDC)
• In 2025, 85% of successful cyberattacks against corporate user endpoints will be caused by settings and user errors rather than advanced malware.

If we can’t trust anyone, who can we trust?

There are usually two main pillars when establishing the Zero Trust approach: The first is to identify sensitive data and systems, turn their flow into a map. The second is to determine who accesses systems and data, when, where, why, and how.

The Zero Trust approach is based on the fact that organizations do not trust their customers and employees, as well as internal and external applications. It brings a single rule to the processes: When a human, system, or application wants to access data, inspect it. Thus, efforts to provide cyber security are also evolving from regular monitoring to a data-driven approach. Systems only trust other systems, people, and applications that can authenticate themselves.

How can organizations adopt a Zero Trust approach?

Fortinet establishes Zero Trust with a simple and automated approach, enhancing application and network access security whether users are in or out of the office with its ZTNA solution. The infrastructure and data-driven approach may require different steps for each organization’s transition to Zero Trust. This is where the experience and capabilities of Netaş experts come into play. It is possible to achieve effortless, automatic, and much safer digital environments by integrating the Fortinet ZTNA solution into the systems in line with the organization’s needs.

Features of Fortinet ZTNA

Fortinet ZTNA stands out with its IoT endpoint and device protection features. The information of all devices in the network, which profile they are in can be seen, and risks can be prevented by scanning for vulnerabilities with the integrated endpoint visibility feature.

The dynamic control feature can perform micro-segmentation of the devices in the network. It is also possible to perform intent-based segmentation by looking at the devices’ actions, creating rules accordingly, and ensuring that they are automatically applied.

Fortinet ZTNA’s identity and access management feature is powered by secure authentication technology to enforce an effective security policy across the entire network. While Fortinet Security Fabric authentication simplifies the user experience with a single sign-on, it also adds an extra layer of security to the system with multi-factor authentication. It also ensures that data is safe with certificate and guest management features.

Organizations with a hybrid workforce can also utilize Fortinet ZTNA’s security features. It can authenticate people and applications using remote VPN access with a session-based access feature. This feature is used for internal and external users, providing effective protection across the entire network.