Who Can You (Zero) Trust?

You can outsource technology, operations and security services. Accountability for business risk is rather harder to delegate.

EDITORIAL WORKING VERSION — Adapted from the author's supplied draft. Technical and historical references, wording and final conclusion remain subject to author approval before publication.

As the outsourcing of information technology, its management, security technology and security operations has gathered momentum, the governance of business risk has become complex, diverse, frustrating and, in highly regulated industries, expensive.

Even relatively small businesses have adopted a cloud-first approach. Yet there remains a clear disconnect between what people think they are paying for and what is actually delivered — especially when it comes to breach prevention, incident response and recovery.

Buying security is not the same as being secure

Consider the business that adopts Microsoft 365 without sufficient planning or risk assessment, only to discover after a business email compromise that its identity controls, mail protections, alerting and audit capabilities were never properly configured. A service can be operational on day one without the organisation having established that it is appropriately secured.

Or consider a cloud storage deployment with overly permissive access policies. Encryption alone cannot rescue data from a policy that permits the wrong people or systems to access it. The problem is not necessarily the technology. It is the assumption that purchasing and deploying it amounts to controlling the risk.

The disconnect between the illusion of security and reality is nowhere more starkly illustrated than by ransomware. “What do you mean our antivirus systems didn't detect or prevent this?” The apparently obvious answer is to board the shiny new technology train: what we need, we are told, is XDR or MDR. Famous last words.

Enter Zero Trust

Against this background of cybercrime, business email compromise and nation-state activity, a new saviour arises: Zero Trust.

The thinking has roots in deperimeterisation, developed by the Jericho Forum, and in the Zero Trust model subsequently articulated by John Kindervag. At its heart is a sensible proposition: trust should not be conferred merely because a person, device or system happens to be on the supposedly safe side of a network boundary.

A casual search for the “pillars of Zero Trust” will reveal three, four, five, six or seven pillars, depending on whom you ask. NIST Special Publication 800-207 sets out seven tenets, covering resources, secure communications, per-session access, dynamic policy, asset posture, authentication and authorisation, and continuous collection of security-relevant information.

Tenets, pillars and principles can all be interpreted and repackaged — particularly by the vendors of security software.

Zero Trust is a dream come true for marketing departments: a simple phrase, implying a panacea for all ills, seemingly delivered by licensing an end-to-end security stack. Marketed to enterprise leaders and eventually to smaller businesses, it sounds almost too good to be true.

And it is.

Risk does not leave with the contract

You can outsource technology, technology management and incident processes. Whether you have reduced business risk, or can identify and respond to compromise in time, remains a question you must be able to answer yourself.

Service levels and shared-responsibility models matter. But accountability for the business's decisions and risks does not simply transfer to the supplier. When the balloon goes up, directors will still have difficult questions to answer.

A credible Zero Trust programme depends on a functioning foundation: identity management, asset inventory, data classification, cryptographic and certificate management, and the interoperability of the systems involved. It also demands considerable changes to operations. And with change comes risk.

So don't trust Zero Trust — at least not your implementation of it — without continuously examining, testing and challenging the evidence that it works.

Final closing paragraph to be agreed with the author.