Zero trust is IT security's best hope for effective defense

Last updated:November 2019

Editor's note

Sometimes the best IT security "tool" is a change in attitude.

Today, the zero-trust philosophy of IT security is recognized as the best defense for systems and data. But many organizations have yet to implement it. There's no time to waste, though, as attacks are only getting more sophisticated and damaging. If you've decided that a zero-trust security model is the one your organization needs to follow, the next step is to determine how.

This guide provides both overarching advice and specific guidance on how to deal with particular issues, including cloud and legacy tools, app development and more. Learn the ideas and approaches that underpin zero trust, and also get solid ideas on where to begin to make it a reality. There's no time to waste making it the central tenet of your organization's security program.

1What is zero trust?

The basic idea behind the zero-trust model is that potential "users" -- be they humans, devices or even packets -- are inspected and authenticated before being given access to IT systems and data. Zero trust essentially replaces the idea of "trust, but verify" with that of "verify then trust." And nothing's permanent in the zero-trust approach either: Trust can be expanded or withdrawn.

Read on for a detailed explanation of what it means to use a zero-trust security model.

2How to implement zero trust

In this segment, learn what products and approaches can help you make zero trust a reality, from network tools to virtualization-specific products to stand-alone zero-trust software. Also, discover what NIST advises about the implementation of zero trust, and get expert advice on how to deal with such things are legacy security tools and cloud environments.

3What zero-trust issues to expect

Even with the best guidance, issues will inevitably arise when adopting any new approach. But you can be better prepared by reviewing the expert advice contained in this segment.

Learn how to approach zero-trust security, and make sure you're up on the most likely risks involved in deployment. Zero trust is an essential part of any security program now but getting well prepared will make implementation easier.