Demystifying the concept of zero trust security

Cyber security is a risk management function and organisations need to make decisions on trade-offs or risk acceptance when they implement controls 

- VISHAL SALVI

The Cybersecurity hazard is at an all-time high due to several changes in the business environment. The proliferation of personal devices and the adoption of the hybrid work model and digital technologies are creating multiple vulnerable nodes that are exposed to security breaches.

Organisations and their CISOs are challenged by the evolving threat landscape. The need for strategic thinking and rehashing the fundamental security architecture construct is much higher than ever. In this context, the Zero Trust Security Architecture is one approach that’s increasingly getting a lot of traction. At a higher level, Zero Trust assumes that your business is continuously compromised, and the architecture aims to mitigate that.

SECURITY FROM A DIFFERENT PERSPECTIVE

Fundamentally, cyber security is a risk management function where we need to make decisions on tradeoffs or risk acceptance when we implement controls. It is difficult to imagine a world where we would only have absolute control. Another important factor to note is that trust is contextual. The security world has built various models and solutions for adaptive controls or transparent controls. These models are based on answering questions about who, where, why, when and what of a transaction before any verification, approval or denial is made.

Security architecture has always relied on trust models. There are many technical controls that we trust before we grant or deny access to resources. For all this to work properly, security teams must ensure the highest degree of integrity to handshakes or trust.