The State of Zero Trust
Vishak Raman, Vice President of Sales, India, SAARC, SEAHK & ANZ at Fortinet Distributed networks and a hybrid workforce are rapidly transforming today’s network environments. Workers divide their time between the office, home, and somewhere in between. Applications are split between on-premises, cloud, and Software-as-a- Service (SaaS) deployments. And data, once the sole province of the data center, is increasingly distributed across multiple locations. Over the past few years, ensuring that every user and device has secure, reliable access to the critical resources they need has been a top priority for IT teams. And access needs to be easy, no matter where the user is located or where applications and assets have been deployed The Fortinet 2023 State of Zero Trust Report looks at the progress IT teams have made in establishing a new sense of normalcy following the network upheaval initiated by the start of the global pandemic. With most employees suddenly working outside the network perimeter, IT teams scrambled to keep businesses operational. This effort often took the form of quick fixes and workarounds that exposed the weaknesses in their remote-worker strategy. It also highlighted the challenges of bringing their rapidly expanding network environments under a unified security umbrella. Outlier environments, like poorly secured home offices or misconfigured cloud solutions implemented by DevOps teams with little security experience, became new attack vectors for cybercriminals. It quickly became obvious that the implicit trust model in many organizations was a problem. However, too many IT teams tried to solve the issue in the traditional way by throwing technology at the problem. And it wasn’t long before they had a new problem of trying to get discrete point solutions to work together. These challenges are reflected in this report, which includes a number of key findings. Organizations of all sizes are actively implementing zero-trust strategies, but challenges remain: Companies have deployed considerably more solutions as part of their zero-trust strategies since 2021. Companies are looking to enable zero trust everywhere to minimize the impact of a breach. Although companies are moving forward, they still face challenges, including interoperability between solutions, consistent visibility, end-to-end policy enforcement, and application latency issues. Respondents also complained about the lack of reliable information to help them select and design a solution. Solutions must cover both on-premises and remote users with a consistent application access policy, and success has been mixed: Many solutions like zero-trust network access (ZTNA) and secure access service edge (SASE) are cloud-only. However, companies need to secure access to applications on-premises and outside of the network. Notably, nearly 40% of organizations still host more than half of their applications on-premises. The most significant challenge in any zero-trust strategy is the need for more integration between on-premises and cloud environments. Three-fourths of respondents have encountered issues with their hybrid workforce because of relying on cloud-only ZTNA. The top priorities for SASE solutions vary, but ‘security effectiveness’ is the most significant, with 58% placing it in their top three priorities. The consolidation of vendors and solution interoperability is crucial: Deploying solutions from multiple vendors has created many challenges for organizations, including introducing new security gaps and high operations costs. Larger companies are especially keen to consolidate solutions to simplify operations and reduce overhead. Zero-Trust Strategy Priorities The pandemic initiated a dramatic workforce transformation, with the vast majority of employees who traditionally worked on-premises suddenly working from home. This change triggered a corresponding dramatic upheaval in networks, essentially turning them inside out. Almost overnight, organizations needed to create secure network access to critical applications and resources through the perimeter, which often required upgrading remote access technologies such as edge security tools. At the same time, the limitations of traditional VPNs became apparent as hackers began accessing corporate resources by hijacking VPN tunnels through poorly protected home networks. Plans to move applications to the cloud were accelerated to offload pressure on the network perimeter and to improve the user experience. Of course, none of these changes were entirely unexpected. The move to a hybrid workforce had been in progress for some time, but the pandemic accelerated the change. Many organizations weren’t ready for the sudden transition to remote work, and they didn’t have the technologies in place that the circumstances demanded. Despite these issues, two-thirds of organizations have decided to maintain a hybrid workforce, with larger employers more likely to support remote workers than smaller ones. The challenge has been providing consistent access and exceptional user experience for workers who move between onpremises and remote work locations. It has been particularly difficult for the 72% of organizations that opted for a cloud-only ZTNA solution to provide secure access to critical applications. (Fig. 1) Early on, it became clear that the best approach for managing and securing a workforce with no permanent location was to initiate a zero-trust strategy, which eliminates implicit trust based on location and enforces the principle of least privilege. The reasons are broad for implementing zero trust, but 34% identified minimizing the impact of breaches and intrusions, and 29% cited enabling zero trust everywhere as their primary incentive. Interestingly, only 18% selected reducing capital expenditure. Although their top objective for choosing a zero-trust solution (ranked as either extremely or very important) was to ensure application-layer security (85%), compatibility with both on-premises and cloud settings (82%), and integration with the rest of their networking and security infrastructure (82%) were also very high. Organizations also report being better prepared to support and secure their hybrid workforce with a wide range of solutions already in place to support their zero-trust strategies. The solutions that have been implemented include secure web gateways (SWGs) at 75%, cloud access security brokers (CASB) at 72%, network access control (NAC) at 70%, ZTNA at 67%, next-generation firewalls (NGFWs) at 63%, and endpoint detection and response (EDR) with 62%. The one surprise was the relatively low implementation of multi-factor authentication (MFA) at only 52%, which is critical for preventing unauthorized access to applications and other resources. Those organizations that have not yet…