Simplify zero-trust implementation for IoT security

Implementation problems abound

While most Fortinet survey respondents indicated they understand zero-trust concepts, more than 80% felt implementing a zero-trust strategy across an extended network wasn't going to be easy. Sixty percent reported it would be moderately or very difficult and another 21% said it would be extremely difficult.

Many admins indicated they cannot consistently authenticate users or devices and struggle to monitor use after authentication. Because authentication is considered fundamental to a zero-trust strategy, it seems that many organizations either misunderstand zero trust or have incomplete deployments.

Survey respondents almost unanimously agree that it is vital for zero-trust security workflows to be integrated with their infrastructure, work across cloud and on-premises infrastructure and be secure at the application layer. The biggest challenge organizations mention in building a zero-trust strategy is the lack of qualified vendors with a complete offering.

Key areas for an effective zero-trust strategy

Zero trust seems easier said than done -- but it doesn't have to be that way. Admins can focus on three key areas to make implementation much more successful. This entails narrowing down the people and devices that are on the network, as well as what becomes of managed devices once they exit the network.

Every organization has a range of users, so the answer to the question of who is on the network will vary. There are the regular employees who need to access the network, but there are others who need to access applications and data located either on premises or in the cloud. This group includes supply chain partners, contractors and possibly customers.

For a ZTA strategy to be effective, admins that implement it must determine who every user is and what role they play within the organization. The zero-trust model is a policy that only grants a user access to the resources that are necessary for their role or job.

Next, admins should address what is on the network. The huge uptick in the number of applications and devices organizations use today means an expanded network perimeter. This requires managing the explosion of devices, including servers, printers and IoT devices -- such as HVAC controllers or security badge readers -- and end-user phones and laptops.

While all devices must have access controls consistently enforced, IoT devices are particularly challenging because they don't have access controls on the device. They are typically low-power, small form factor devices without memory or CPU to support security processes. And they frequently don't interface with endpoint security tools. This means the network is the main security layer.

Because people use BYOD devices for business and personal needs, the final key is for admins to gain clarity about what happens when devices leave the network. Users may have logged out of the company network but then use their device for emails, social media and internet browsing on home and public networks. Once the devices rejoin the company network, users could inadvertently expose their devices and company resources to threats they may have picked up, including viruses and malware.

Endpoint security must be part of any ZTA offering. It should have the capability for off-network hygiene control, which covers policies for patching, web filtering and vulnerability scanning as well as flexible VPN connectivity.

Although most organizations are on board with the zero-trust model, IT teams can still struggle with implementation. Admins that track an organization's users, audit network-connected devices and use endpoint security software will find it much easier to manage zero-trust adoption.

Peter Newton is senior director of products and solutions, IoT and OT at Fortinet. He has more than 20 years of experience in the enterprise networking and security industry and serves as Fortinet's products and solutions lead for IoT and operational technology solutions, including ICS and SCADA.