Zero Trust Security for the Workforce
The modern workforce is more mobile than ever before. Users and devices can connect from anywhere — so companies must protect them everywhere. A zero trust security model establishes trust in users and devices through authentication and continuous monitoring of each access attempt, with custom security policies that protect every application.
What is a Zero Trust Approach?
Traditional security approaches assume that anything (devices, users, infrastructure, etc.) inside the corporate network can be trusted. The reality is that this assumption no longer holds true.
Now more than ever, employees and users have more control over the applications they use. Data and applications are no longer behind the firewall, and users can connect directly to work applications over the internet using personal owned devices.
Zero trust addresses this deperimeterisation by:
Ensuring users and their devices are trustworthy at every access request, no matter where it comes from
Securing access across applications and networks
Extending trust to support a modern enterprise across the distributed network
A core tenet of zero trust is that security is not a one-size-fits-all proposition, even within the same organisation. Zero trust applies anywhere an access decision is made. When approaching security design using the zero trust model, it’s easiest to break adoption down into three pillars:
Workforce
Ensure only the right users and secure devices can access applications.
Workload
Secure all connections within your apps, across multi-cloud.
Workplace
Secure all user and device connections across your network, including IoT.
The massive demand to support remote work and adopt cloud environments amplifies the need for security in the workforce, so that’s where many organisations begin their adoption of a zero trust security.
How Zero Trust Works in the Workforce
Zero trust can be summed up as “never trust; always verify.” This security approach treats every access attempt as if it originates from an untrusted network — so access won’t be allowed until trust is demonstrated. Once users and devices have been deemed trustworthy, zero trust ensures that they have access only to the resources they absolutely need, to prevent any unauthorised lateral movement through an environment.
Adoption of zero trust can help address common security challenges in the workforce, such as phishing, malware, credential theft, remote access, and device security (BYOD).
This is done by securing the three primary factors that make up the workforce: users, their devices, and the applications they access.
Users
Users are the people, such as employees, contractors, partners and vendors, that need access to work applications and systems.
Zero trust requires that a user be given access only to the applications they truly need to do their job — and no more. It also requires that user identities be verified using a method like strong multi-factor authentication, to establish that they are who they say they are at every single access attempt.
Devices
Devices are the things that are used to gain access to resources. These could be corporate-managed or personal devices (desktops/laptops, tablets, mobile phones).
Under zero trust, devices are checked at every access request to ensure that they meet security parameters and aren’t introducing risk. Devices should also be monitored over time, to detect potential threats or anomalous behaviour.
Applications
Applications are the tools businesses use to operate. They can be located anywhere — from the cloud, to being hosted in-house or on physical systems.
Application access should be governed by adaptive access policies, created based on the sensitivity of the data in the application. This granularity ensures that access is provided only to users or groups of users who need it, from locations and devices that are trusted.
The Case for Zero Trust in the Workforce
The Challenge: Security Overload for End-Users
As apps, data and identities move to the cloud, the IT model extends past the traditional corporate perimeter. Organisations need to comprehensively secure this new model, without compromising on agility or usability.
The Challenge: Workforce Decentralisation
Deperimeterisation means that users may not be protected by traditional security measures, and may be more susceptible to phishing, malware and other threats.
The Challenge: Environmental Complexity
Environments are now a hybrid mix of legacy on-premises services and multi-cloud infrastructure and software as a service (SaaS) apps.
Attackers that make it past one verification point (such as a firewall or a user login) can exploit inherent trust and move laterally within a network, application or environment to target sensitive data.
How Zero Trust Helps
Streamline User Experiences
Adding security doesn’t need to add friction to a user's experience. By implementing solutions that verify users and devices at the point of access you can provide a balance between security and productivity.
Adaptive policies and device monitoring practices inherent to zero trust help you catch and mitigate security risks before they become problematic.
Protect a Diverse Workforce
Zero trust requires that companies have visibility into users and their devices as they access applications. Enforce user, device or application-specific policies to meet your organisation's security requirements for access. Flag risky users’ devices, then block or notify users to update any out-of-date software on their own devices before granting access to applications.
Secure Remote Work
By applying the same trust-based reasoning to every access point, users get a consistent and productive security experience regardless of location, device or whether their applications are on-premises or in the cloud.
Make it harder for attackers to access and move laterally within your environment by segmenting resources, using strong authentication factors, adding encryption, and marking known and trusted devices.
The Solution: A Journey to Zero Trust
There are five phases for implementing Zero Trust for the Workforce, which comprises an organisation’s users and their devices, and how they access applications. The approach is iterative.
Begin with a specific set of people, expand coverage for their applications, and expand coverage for their devices. Once we are always verifying trust within this well-defined scope, apply a set of reasonable policies to enforce trust and protect the organisation. Finally, integrate this scope with the broader organisation’s IT and security functions and shift to continuous improvement.
Establish User Trust
Ensure only authorised users are accessing your resources. This can be done a number of ways — multi-factor authentication (MFA) is the most prevalent method, but passwordless authentication is also becoming an attractive option.
RELATED DUO FEATURES
Duo MFA
Enforce secure identity verification methods, like Duo Push, U2F tokens and password-free open standards, such as Webauthn.
Duo MFA is available in all Duo editions.
User Access Policies
Get granular with your security requirements, with options to set policies for specific user groups either globally or by application.
User access policies are available in all Duo editions, with advanced options in Duo Advantage and Duo Premier.
Duo’s Cloud-Based SSO
Enable SSO for any SAML2-enabled app, to consolidate users’ login workflows under a single set of credentials, protected by strong MFA.
Duo SSO is available in all Duo editions.
Device and Activity Visibility
Which endpoint or device is being used with every access request? What is its current security state, and from where is the request originating? Tracking device activity is key in detecting account takeover attempts and other risks.
RELATED DUO FEATURES
Duo’s Device Visibility
See every endpoint that’s logging in to your apps, so that you can spot risky devices before they compromise your resources.
Device Visibility is available in all Duo editions.
Duo’s Device Health
Monitor laptop and desktop devices to ensure they have the right security protocols in place.
Device Health is available in Duo Advantage and Duo Premier.
User Self-Remediation
Allow users to easily correct security issues on their devices without help desk involvement.
User Self-Remediation is available in all Duo editions.
Device Trust
Define the characteristics of a “trusted” device within your organisation. Identify known devices, both corporate-managed and personal, that meet those criteria, so that unexpected devices can be easily flagged.
RELATED DUO FEATURES
Device Access Policies
Manage access permissions based on operating system, encryption status, software version and more.
Device Access Policies are available in all Duo editions, with advanced options in Duo Advantage and Duo Premier.
Duo’s Trusted Endpoints
Identify corporate-owned vs. personal laptops, desktops, and mobile devices, to reduce friction in user workflows.
Duo’s Trusted Endpoints is available in Duo Premier edition.
Adaptive Policies
Set requirements for access based on the sensitivity and security state of your resources. These policies can range from allowing only corporate-managed devices to requiring certain versions of software, encryption or step-up authentication based on user behavior.
RELATED DUO FEATURES
Application Access Policies
Enforce security policies for any and every application, block Tor and anonymous networks, detect anomalous access, and more.
Application Access Policies are available in all Duo editions, with advanced options in Duo Advantage and Duo Premier.
Zero Trust for the Workforce
You’ve achieved zero trust for the workforce! All applications and systems within scope are protected; monitoring and response to threat scenarios are ongoing. Now, it’s time to optimise user workflows and management of your zero trust ecosystem.
RELATED DUO FEATURES
Modern Remote Access with the Duo Network Gateway
Provide clientless remote access to any application, including internal servers via SSH. Employees will experience a streamlined, friction-free login flow, whether they’re on the corporate network or not.
The Duo Network Gateway is available in Duo Premier edition.
Logging and Reporting
Set up reports to consistently monitor activity specific to your organisation. Export logs for compliance purposes, see the impact of your security policies, identify whether a third-party agent is enabled on a user’s device and more.
Logging and reporting features are available in all Duo editions, with advanced options available in Duo Advantage and Duo Premier.
Start your free trial of Duo today