Organisations know zero trust is important, so why does adoption remain slow?

As we continue to see targeted phishing and ransomware attacks become more commonplace in both the public and private sectors, it’s increasingly clear that organisations cannot afford to continue operating on a ‘wait and see’ basis for their cybersecurity. It’s critical for the continuity of business and operations that effective solutions are implemented proactively – limiting an organisation’s exposure to cyberattacks and shoring up their defences. For an organisation looking to do this today, a zero trust implementation is an essential part of any comprehensive cybersecurity solution.  

Zero trust as a concept distinguishes itself from traditional approaches to defending networks and IT infrastructure; previously, these were protected by building as strong as possible a defence between the systems under the organisation’s control and those that are external – everything inside would be treated as safe, and everything outside as potentially malicious. This approach provides good initial protection against outside attacks, but is less useful for detecting and blocking attacks that come from inside the network, and cannot protect users and systems that exist on the outside, like remote workers, cloud-based services, and edge devices. 

What zero trust does differently, then, is to remove the single network-wide implicit trust found inside traditional network architectures. Instead, it assumes a constant state of breach, requiring that every request made on the network is verified as though it originates from an external source, regardless of the physical or network location. Even after granting access, zero trust enforces the principles of micro-segmentation and least-privileged access to ensure that each verified request can still only access the information and systems it requires, and limits lateral movement throughout a network. 

As anyone paying attention to such stories will be aware, the potential damages that come from a successful ransomware attack can be devastating – both in terms of financial losses, and continuation of business. There have been countless news stories of high-profile targets brought to a standstill due to such attacks, both in the private and public sector; Hackney Council is still attempting to recover from ransomware that infiltrated their systems over two years ago.² More recently, Royal Mail was unable to handle any international shipping for weeks after an attack breached their systems, and the attackers continue to threaten the leak of company data collected in the attack.³

With all this in mind, it’s notable that adoption of zero trust solutions doesn’t appear to be progressing proportionate to its importance. According to Dell’s 2022 Global Data Protection Index, of the 1000 IT decision makers surveyed, just 12% indicated that their organisation had “fully implemented a zero trust security architecture and its ongoing maintenance”.⁴ This is despite 72% of the same respondents indicating that – at the very least – they have an understanding of zero trust, and are committed to implementing it.