Conversations on the field: Dealing With The Challenges Of Zero Trust Security And How To Overcome Them.

When working with clients, we often see challenges in developing and implementing a Zero Trust Security Architecture and Strategy. Adopting this approach to deliver cybersecurity services brings significant benefits that we discussed in our last post, “Your Zero Trust Security Journey Has Already Started!.” However, as we have explained then, this is a long journey, and as such, it is full of unexpected turns, challenges, and even blockers that security leaders and practitioners should anticipate and be prepared for, especially during the implementation process

Challenges of Zero Trust and how to address them

1. Resource and budget constraints.

The Challenge. Many different parts are associated with implementing a Zero Trust Security Strategy and Architecture (Zero Trust). Thus, it can be a costly investment depending, regardless of the size of the organization. You must plan and budget for infrastructure upgrades, acquisitions, training, personnel, and new processes. Organizations with limited resources or budget constraints must allocate the necessary funds and staff to support the implementation process.

Tips to address it.

• Develop a detailed, multi-year roadmap outlining your Zero Trust implementation’s steps, milestones, and goals. Then, break down the roadmap by year and plan your budget accordingly.
• Once you have a roadmap and budget, you can gain executive leadership support by communicating the benefits, implementation, risks, and costs of adopting a ZTNA program. This is crucial to ensure you have the resources and support to implement the new security architecture successfully.

2. Complexity and scalability.

The Challenge: Because of the many parts of this program, it won’t be easy to manage and implement the strategy. Furthermore, complexity scales with the organization’s size; the more system, applications, and people, and the larger the infrastructure, the more difficult it will be to identify critical assets, define controls, and manage enforcement policies across the environment.

Furthermore, legacy systems often need more security controls and visibility for a comprehensive Zero Trust implementation. The challenge is that they lack native capabilities to deliver such security requirements.

Tip to address it.

• Assess your current infrastructure, systems, and applications to identify vulnerabilities, legacy systems, and potential areas of improvement. This assessment will help prioritize actions and determine the scope of the Zero Trust implementation. This is also part of the budgeting and road mapping process.
• Don’t try to implement Zero Trust across your entire organization simultaneously. Instead, follow our advice in building incremental programs by implementing Zero Trust in a small. When working with clients, we usually must work hard to convince them to identify a few use cases to test during a Proof of Value (POV) in a small, isolated environment, such as a development or test environment. This will allow you to test the new security architecture and identify any problems before implementing it in your production environment. By performing a POV, we have identified that clients are missing foundational pre-requisites for building a solid Zero Trust Network Architecture (ZTNA), for example, a true Identity Provider (IdP), and in some cases, we have advised the client to pivot and focus on building that piece before moving to the next step of the ZTNA implementation.
• Consider prioritizing the modernization of legacy systems. When systems cannot be upgraded or replaced, you need to develop a strategy for isolating them, which is part of Zero Trust Security anyway.

3. Organizational and cross-functional culture.

The Challenge: Implementing a Zero Trust model often requires a significant shift in organizational culture, and, depending on the organization’s size, adopting this new approach to security will impact several operational teams and stakeholders, especially in the Technology Department (but also in business units). Adoption of ZTNA involves a mindset change from trusting internal networks to verifying and validating (almost) every access request. Resistance to change, lack of awareness, or unwillingness to adopt new security practices can hinder progress.

Tip to address it.

• Establish a set of architectural principles that are clear and easy to understand by the team tasked with the design and implementation of the different platforms that make up the Zero Trust Architecture.
• Develop a (multi-phase) Organizational Change Management Plan (OCM) to address the “What’s In It For Me (WIIFM).” You will encounter resistance from key stakeholders. A great approach to learning about when implementing OCM is ADKAR.
• Communicate with employees about the benefits of Zero Trust and how it will affect their work (the WIIFM). This will help reduce resistance to change and ensure that employees are willing to comply with the new security policies. This process will take time and empathy and test your patience (and theirs).

4. Third-Party dependencies.

The Challenge: Digital transformation has brought with it the adoption of cloud services and hosted solutions.  Organizations that rely heavily on third-party vendors, Managed Service Providers (MSPs) or cloud service providers must account for these services when developing the Zero Trust Strategy and Architecture. Coordinating security controls and ensuring consistent enforcement across multiple external entities can be complex and require cooperation from various stakeholders.

Tip to address it.

• Include the stakeholders that are responsible for managing third-party relationships, contracts, procurement, and third-party risk. They will be critical for your success and communications with these stakeholders about your security requirements and expectations.
• Establish an inventory of these services, including product/service owners, service risk rating, and current architecture.
• Try to align your security controls with the provider’s controls.
• Establish a third-party audit program to assess the effectiveness of controls.

5. Compliance.

The Challenge: Improving regulatory compliance for the organization is a benefit of Zero Trust. However, depending on your industry, regulations and standards could add complexity to developing your requirements and implementing Zero Trust, ensuring that security measures meet regulatory expectations without impeding business operations.

Tip to address it.

• Keep your compliance, internal audit, and legal teams engaged in the process. They are a great partner and resource to your security program.
• Build a simple Compliance Matrix to map out Zero Trust capabilities and requirements to regulatory and compliance requirements.
• Monitor the ever-changing laws, rules, and regulations landscape.

6. Cybersecurity monitoring, detection, and response.

The Challenge: In our last post and podcast, we tell you that integrating many security platforms is key to achieving a robust Zero Trust Strategy and Architecture. It is also very challenging, and you will need robust monitoring tools and processes to detect anomalous behavior, track access requests, and manage incident response effectively.

Tip to address it.

• Ensure that existing and new systems can be integrated into your Zero Trust Platform of choice.
• Implement a monitoring tool (like a Detection and Response platform and/or a SIEM) that can ingest logs from various sources.
• Likewise, all systems you acquire or modernize must be able to ship logs to your monitoring tool.Build solid response processes that your team can follow.
• Build solid response processes that your team can follow.
• Test your controls and response process often through Breach and Attack Simulation and Purple Team Exercises.

Zero Trust is a valuable security architecture that can help organizations protect their data and systems from cyber-attacks despite these potential blockers. Organizations considering implementing zero trust should carefully assess the costs and benefits of change and develop a comprehensive plan for implementation. Finally, by accounting for these challenges and following these tips, we hope you can help overcome the blockers and successfully implement a Zero Trust security architecture in your organization.

Let’s embrace the power of Zero Trust and thrive in the digital age together!