{"id":91677,"date":"2020-08-06T09:00:39","date_gmt":"2020-08-06T16:00:39","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=91677"},"modified":"2023-05-15T23:13:18","modified_gmt":"2023-05-16T06:13:18","slug":"zero-trust-security-option-business-imperative-overnight","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/08\/06\/zero-trust-security-option-business-imperative-overnight\/","title":{"rendered":"Zero Trust: From security option to business imperative overnight"},"content":{"rendered":"
Not long ago when I spoke with customers about Zero Trust, our conversations focused on\u00a0discussing\u00a0the\u00a0principles, defining scope, or\u00a0sharing our own IT organization\u2019s journey. Zero Trust was something interesting to learn about, and most organizations were very much in the exploratory phase. As COVID-19 forced organizations across the world to send their\u00a0workforce\u00a0home,\u00a0organizations rapidly focused on Zero Trust approaches to alleviate challenges of enabling and securing remote work. Using Zero Trust to secure users, data, and devices (wherever they may be) has changed from optional to a business imperative overnight.<\/p>\n
Companies found that traditional security models required bringing users and data to \u2018safe\u2019 network places, which doesn\u2019t scale and doesn\u2019t provide the needed visibility. Employees are getting their work done any way they can\u2013 using personal devices, sharing data through new services, and collaborating outside the confines of traditional protections of the corporate network. Earlier adopters of Zero Trust approaches were able to adapt quickly, but many others instantly faced an expanded attack surface area and new security challenges they were not fully prepared for.<\/p>\n
At Microsoft,\u00a0we have\u00a0been helping customers navigate these challenges by sharing our learnings and building controls, tools, and practices to enable daily application of Zero Trust principles.\u00a0We have been focusing on providing organization quick wins that close critical gaps today and laying a strong foundation of Zero Trust expertise and technology to build on in the future.<\/p>\n
Today and in my presentation at Blackhat 2020<\/a>,\u00a0I\u2019d like to share some\u00a0insights\u00a0we\u2019ve learned through this journey to help you with yours:<\/p>\n Many customers I meet with share that trying to figure out where to start their Zero Trust journey is a major challenge. I always recommend starting with multi-factor authentication (MFA). Verifying a user\u2019s identity with strong authentication before granting them access to corporate resources is the most effective step to quickly improve security. Our studies have shown that accounts secured with MFA are 99.9% less likely to be compromised. Strong authentication strengthens your overall security posture and minimizes risk, it lays a strong foundation to build on\u2014such as securely connecting employees to apps with single sign-on (SSO) experiences, controlling access to resources with adaptive access policies, and more.<\/p>\n In a Zero Trust security model, we want to have visibility into any and all endpoints accessing\u00a0the corporate\u00a0network so we can only allow healthy and compliant devices to access corporate resources.\u00a0Device security posture and compliance should be used in your access policies to\u00a0restrict access from vulnerable and compromised devices.\u00a0This not only helps\u00a0strengthen security and minimize risk,\u00a0but also enables you to\u00a0improve your employees\u2019 productivity by supporting more device types and experiences.\u00a0In a recent Microsoft study, more\u00a0than\u00a050% of organizations\u00a0reported seeing a greater variety of endpoint platforms because of\u00a0supporting remote\u00a0work.<\/p>\n With employees\u00a0increasingly\u00a0accessing corporate data\u00a0on new devices\u00a0and\u00a0collaborating in new ways, most\u00a0security teams are seeing that their application and data security\u00a0tools\u00a0aren\u2019t giving them the visibility and control they need. This de facto expansion of the enterprise attack surface makes it critical to discover the cloud apps in use,\u00a0assess them for risk, and\u00a0apply policy controls to ensure that data isn\u2019t leaking through these applications.\u00a0Finally, make sure the sensitive data in these apps is protected\u00a0wherever it travels or lives\u00a0by automatically classifying, labeling,\u00a0and applying\u00a0protection to files.<\/p>\n CISOs reported in a recent Microsoft study that Threat Protection is now a higher priority for them. With an increasing attack surface area and velocity, integrated threat protection solutions can now share signals across detection, prevention, investigation, and response. While most organizations already use threat protection tools, most don\u2019t share signals or support end-to-end workflows. Because most attacks involve multiple users, endpoints, app, data, and networks, it\u2019s imperative for tools to work together to deliver streamlined experience and end-to-end automation. Look for opportunities to integrate your threat protection solutions to remove manual tasks, process friction, and the morale issues they generate.<\/p>\n Security leaders are often challenged to balance security and a more streamlined\u00a0end-user experience.\u00a0Fortunately, Zero Trust enables both at the same time because security is built around the users and business assets, rather than the other way around.\u00a0Instead of users signing in multiple times, dealing with VPN bandwidth constraints, and working only from corporate devices,\u00a0Zero Trust enables users to access their content and apps from virtually any device and location securely.<\/p>\n To listen to my presentation on Zero Trust at Blackhat register here<\/a>. Check out the Microsoft Zero Trust Maturity Model vision paper<\/a> (click to download) detailing the core principles of Zero Trust, and our maturity model, which breaks down the top-level requirements across each of the six foundational elements.<\/p>\n We\u2019re also publishing deployment guides for each of the foundational elements.\u00a0 Read the latest guides for Identities<\/a>,\u00a0Devices<\/a>, and\u00a0Networking<\/a>.\u00a0Look out for additional guides in the\u00a0Microsoft Security blog<\/a>.<\/p>\n Also, bookmark the\u202fSecurity blog<\/a>\u202fto keep up with our expert coverage on security matters. And follow us at\u202f@MSFTSecurity<\/a>\u202f<\/u>for the latest news and updates on cybersecurity.<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" As COVID-19 forced organizations across the world to send their workforce home, organizations rapidly focused on Zero Trust approaches to alleviate challenges of enabling and securing remote work.<\/p>\n","protected":false},"author":96,"featured_media":91680,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3662],"topic":[3684,3689],"products":[],"threat-intelligence":[],"tags":[3822],"coauthors":[2174],"class_list":["post-91677","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-news","topic-security-operations","topic-zero-trust","tag-microsoft-security-insights"],"yoast_head":"\n1. Start with strong authentication<\/h2>\n
2. Endpoint visibility is critical and getting more challenging<\/h2>\n
3. Apps and data are primary attack surfaces<\/h2>\n
4. Integrated solutions are more critical than ever<\/h2>\n
5. Zero Trust improves end-user experience<\/h2>\n
Learn more about\u00a0Zero Trust and Microsoft Security<\/a>.<\/h2>\n