What is Zero Trust Security?

Zero-trust security is a contextual IT security model governed by a single axiom: “Trust no one.” A zero trust model, or architecture, means that no user or device should have default access to an organization’s network, workspace, or other resources—even if they’re employed by the organization. Authorized users must pass security protocols before access is granted based on criteria like their identity, time of access, and device posture. Zero trust architecture can include access control, user identity verification, and secure workspaces to prevent malware, data exfiltration due to a VPN breach, and other attacks on sensitive data.

Why is zero trust security important?

Zero trust security is important because today’s IT departments have to protect a larger attack surface while delivering an engaging user experience. Now that employees rely on personal devices for remote access to workspaces, cloud apps, and corporate resources, the likelihood of a data loss is higher than ever.

What’s the difference between traditional information security and zero trust architecture?

Traditional approaches to information security involve corralling sensitive data into data centers protected by logins and firewalls. The assumption was that everyone inside the organization was vetted and trustworthy—as long as someone had a username and password, they could access everything on the organization’s network unchallenged. A zero trust architecture evolves this traditional cybersecurity approach by moving the onus of data protection from within the organization to each user, device, and application attempting network access. Implemented correctly, this approach to zero trust is a context-aware security architecture that can recognize patterns in user behavior and devices to adaptively grant or deny access based on factors like identity, time of day, and location.

How to get started implementing a zero trust architecture?

1. Audit the organization’s network for a clear picture of what infrastructure and endpoints are in place. This shows IT what their network security policy needs to address first. 2. Conduct a thorough threat assessment, and come up with some scenarios for what would happen if sensitive data was breached. Ask questions like “Who is most likely to access what data?” and “If the first level of security is penetrated, how easy will it be to penetrate subsequent ones?”. 2. Conduct a thorough threat assessment, and come up with some scenarios for what would happen if sensitive data was breached. Ask questions like “Who is most likely to access what data?” and “If the first level of security is penetrated, how easy will it be to penetrate subsequent ones?”. 3. Decide how to trust users, devices, and applications as separate but related entities. It’s important to grant access only to what is actually needed on a use-by-use basis. Multi-factor authentication is a good start, but it can also be helpful to adopt contextual access control tools to disable printing, copy-paste, and screenshotting in certain scenarios. You can also have all employees access their apps and data inside a secure workspace to deliver more comprehensive enterprise security. 4. Test your zero trust architecture to see how well it performs. Run scenarios where your IT team attempts to gain access to sensitive data via a lost device, unsecured wifi network, malicious URLs, or malware. This can show potential vulnerabilities in your network security in order to adapt the cybersecurity approach accordingly.

Is zero trust architecture a single product?

Zero trust security is not one product or a solution. Rather, it is an architecture or framework that IT can use to enable secure access for all applications, from any device, by continuously evaluating trust at every touchpoint.

Does zero trust mean I need to replace my entire IT infrastructure?

While implementing zero trust is not simple, it should not require you to rip-and-replace your on-premises or cloud infrastructure. The right zero trust vendor will work with you to secure your existing infrastructure, such as identity platforms, SIEM/SOC and web proxies, and SD-WAN solutions. For example, your zero trust vendor should be able to integrate with Microsoft Active Directory, Microsoft Azure AD, and Okta user directories as well as the contextual identity management policies that come with these platforms.

How do I find the right technology or services to implement a zero trust network?

Because of the comprehensive nature of a zero trust security model, IT can get stuck in an endless cycle of adding point products such as SSL VPN, endpoint management, and multi-factor authentication to address new security use cases. This can lead to more complexity and create a fractured experience for end users—all while leaving gaps in cybersecurity that attackers can exploit.

Why can’t VPNs support zero trust security?

The most fundamental difference between VPNs and zero trust security frameworks is that traditional VPNs trust blindly. With a VPN, once access is granted, a remote user gains total access to the network. To summarize the major vulnerabilities of VPNs, the following attributes stand out: 1. VPNs over-simplify authentication. 2. VPNs don’t scale. 3. VPNs aren’t optimized for employee experience.

Back to Glossary

What is adaptive access control?

Adaptive access control is the process of using IT policies that allow administrators to control user access to applications, files, and network features based on multiple real-time factors. It is more flexible and secure than a legacy "moat" approach.

Explore additional adaptive access control topics:

Why does adaptive access control matter?
Why do companies need adaptive access control?
What are the key components of adaptive access control?
Static vs. adaptive access control: What's the difference?
How do companies combine access control with user experience?
Citrix solutions for adaptive access control

Why does adaptive access control matter?

Companies dealing with unprecedented IT expansion and evolution should ask themselves a few questions about their security and access control policies.

Are they using strategies that will truly protect against the types of threats they'll face today? Have they adequately prepared for the rise of remote work and bring your own device (BYOD) policies? Will their chosen security approaches allow employees to work efficiently rather than interrupting workflows?

To answer "yes" to those questions, IT departments will have to go beyond legacy methods that were designed with in-office employees and corporate-owned hardware in mind. Those traditional security approaches were rigid and focused on binary options—some actions were allowed and others were blocked, with very little nuance. A better approach was needed.

Adaptive access control allows IT departments to set granular security policies that affect every application, API, software tool, and network resource their employees use. When implemented effectively, such an approach combines strong, flexible cybersecurity with a simple end user experience, keeping businesses safe and efficient as conditions change around them.

Why do companies need adaptive access control?

While technology evolution has never been static, the past few years have been especially eventful. Many companies that previously experimented with remote or hybrid workforce models suddenly found themselves using these strategies 100% of the time during COVID-19. Cloud service adoption rates spiked and BYOD technology became essential to continued operations.

As the pace of digital transformation accelerates, IT teams need to make sure these changes don't outpace their ability to keep networks and user accounts secure. Cybercriminals constantly look for vulnerabilities in corporate systems, and periods of rapid change are likely times for them to strike.

This is where concepts such as adaptive access control can truly prove their worth, providing organizations with flexible ways to protect systems. Traditional approaches to security—building proverbial moats around important network resources using firewalls and VPNs—simply doesn't work when employees are relying on personal devices and networks to access software remotely.

IT admins need access control policies that acknowledge the numerous ways users log in and use company resources. Adaptive access control technology uses modern analytics, machine learning, and automation to grant an appropriate level of access for each user session.

What are the key components of adaptive access control?

An adaptive access control policy should incorporate several modern security approaches, creating the ideal combination of user flexibility and wide-ranging security. A solution that is too rigid tends to fail on both counts, restricting users' actions while still failing to keep them safe from novel threat types such as zero-day attacks. Going beyond a limited security solution means embracing:

Zero trust network access (ZTNA): Using a zero trust approach to security means never assuming a user session is safe simply because an individual has entered correct credentials. Constant monitoring and analysis provide an extra layer of protection.
Adaptive authentication: Supporting ZTNA means scanning a user's relative threat level both before and after granting access. Factors such as geolocation, device posture, and user risk score are subject to continuous reassessment, with access permissions being automatically adjusted accordingly.
Single sign-on (SSO): Since adaptive access control systems with ZTNA and adaptive authentication don't base security levels on the simple question of whether a user has entered credentials, they're a perfect match for SSO. This means a user enters a single set of authentication credentials for all applications, making for convenient workflows.

Adaptive access control can apply to a variety of applications today. Whether an organization hosts applications in its own datacenter or uses cloud apps with a SaaS model, IT departments can introduce this advanced and context-driven form of access control.

It's up to the IT department to decide what level of access is appropriate. When a user's risk score increases, potentially due to their location or the kind of device they're using, the features available to them may be affected. Rather than selecting whether a user has access to an app or not, the IT department can switch off capabilities such as the ability to take a screenshot or to use a device's USB drive. These precautions exist to prevent the potential loss of sensitive data while not interrupting the user experience. The result is higher productivity for legitimate users and defenses against hackers.

Static vs. adaptive access control: What's the difference?

The problems with legacy access control methods come down to one central idea: they were designed for a version of IT that no longer exists at many organizations. Expanding beyond the perimeter of the traditional enterprise datacenter means widening a business's potential attack surface, and static access control policies are not flexible enough to make this transition.

Network Legacy security: policies based on trust

For many years, the concept of corporate application security was relatively simple. Using these methods today may leave organizations vulnerable, limit their efficiency, or do both. These static access control policies are based on whitelisting. Certain URLs and user profiles receive access to a list of specific applications.

When users need remote access, they take advantage of solutions such as a virtual private network (VPN). This prevents them from employing their own BYOD devices and network connections, while also granting too much trust to users who have the right credentials.

Once an account or device has been whitelisted, the system may not detect malicious activity from that device. In an era of indirect attack types such as spear phishing, this represents a dangerous security loophole. Add this risk profile to the inconvenience of disallowing BYO devices, and it's clear that traditional security has become outdated.

Adaptive access control: zero trust and constant adaptation

The modern networking environments companies use today have evolved beyond the point where a perimeter-based approach featuring a static access control model can protect them. Not only do remote and hybrid workforces include employees working from a wide variety of devices from their own locations, but the applications they access have also become more complex as well.

IT departments today are tasked with protecting apps hosted in private clouds, public clouds, and on-premises datacenters. With an adaptive access control method employing ZTNA principles, it's possible to oversee all these systems from a single, cloud-based security suite.

The monitoring and access control technologies deployed across these sprawling networks allow IT departments to carefully guard against advanced threats without the painstaking process of setting up dozens of security tools. The managed security stack demands less manual input from IT professionals, while still delivering a level of protection that would be impossible with more rigid tools.

How do companies combine access control with user experience?

When selecting a security approach, the first consideration is keeping apps, users, and information safe from threats. That isn't the only factor IT departments should use to choose how they protect their technology, however. They should also consider the impact on the user experience.

Productivity depends on users being able to access all the digital tools and resources associated with their roles. Adaptive access control allows IT departments to set access profiles that will give employees these capabilities automatically, ensuring they don't have to keep interrupting workflows to verify their identities or log into extra applications. With access management and permissions handled automatically, these steps go into the background.

In cases where there is an elevated security risk level, or when an employee is trying to use a feature beyond their usual needs, the IT department can manually verify the user’s identity. At other times, the adaptive authentication and access control systems are unobtrusive and essentially invisible.

The other major benefit to user experience lies in the adaptive access control systems’ ability to enable employees to log in from a wide variety of locations and BYOD endpoints. While more restrictive static access control policies may have excluded such devices from accessing corporate resources, preventing remote employees from getting work done in their preferred ways, modern access control securely delivers apps and data to any device.

Citrix solutions for adaptive access control

The ideal access control provider for a modern company will have a few specific features, setting itself apart from the generations of legacy technology that came before. This platform will be:

Adaptive to multiple factors, from user risk profile to device status and location, providing better security than traditional perimeter methods and enabling remote work on BYOD devices.
User-friendly and unobtrusive, delivering appropriate access while never impeding the user experience and supporting features such as SSO.
Based in the cloud, so it is always up to date and can affect all applications, no matter where they are hosted, while also demanding minimal manual input from IT teams.

Businesses get such a system when they select Citrix Secure Private Access as their ZTNA security and access control solution. Having this technology in place is an essential step in expanding into a new era of remote work and cloud-enabled expansion.

Additional resources

What is adaptive security?

What is identity and access management?

What is cloud security?