This is part one on our Insights series around Zero Trust security within Microsoft 365. This article is an introduction to the Zero Trust security methodology and how it fits in with the modern workplace.
The Modern Workplace
Before we get into the what and the why of Zero Trust, it’s good to understand why it’s needed. IT within business has been moving forward at an extremely fast pace, especially the cloud. The possibilities to enhance users’ experience in your business with innovative new ways of collaboration and new technologies to complement this is exciting!
The Modern Workplace is designed to enhance people and productivity. BYOD (Bring Your Own Device) has become a more popular model for businesses than ever before, and the cloud enables users to access data from anywhere in the world from any device.
However – companies are, rightfully, becoming increasingly conscious of security within the cloud and how to keep their environments and data secure. By adopting a Zero Trust security posture, you can be confident that your Microsoft 365 cloud environment exceeds the security your on-premises environment allows whilst also empowering users to be more productive than ever before.
Modern problems require modern solutions!
What is Zero Trust?
Zero Trust is a phrase that has been gaining traction around the IT industry lately – what does it mean?
Zero Trust is a security strategy, by which you start from a point of no inherent trust within your IT environment, and only start opening up access to data and resources from connections that you know are secure.
The main premise flips on its head the security that used to work in the old world.
In the old world, all your data and users were under one roof and it was a lot easier to keep your environment secure. You could block out potential attackers with the use of firewalls, but for the most part anything that was on your network was considered trusted.
In the Modern Workplace, where users work in more flexible ways than behind your firewall, these old methods do not work and so with Zero Trust, we start from a viewpoint that nothing is secure and from there, start opening your environment to connections that are completely trusted.
Although Zero Trust is a strategy and not a feature, Microsoft have this in mind and the technology and features available within Microsoft 365 make achieving this Zero Trust model extremely manageable.
The Principles of Zero Trust
There are three main principles that drive the Zero Trust model, these are:
- Verify Explicitly
- Use least privileged access
- Assume breach
Verify Explicitly
Authentication and authorisation should always be checked on all of the most up to date available data points, including user identity, location, device health, service or workload, data classification, and anomalies.
The below diagram shows a Zero Trust architecture in Microsoft 365 and the process that all connections must go through in order to determine whether they will be granted or denied access to the organisation’s data or resources.
Use least privileged access
Users should be limited with just-in-time and just-enough-access (JIT/JEA), risk-based adaptive policies, and data protection to help secure both data and productivity.
The technologies available within the Microsoft 365 suite makes this easier than ever before. With Information Protection and data classification for data protection and Privileged Identity Manager (PIM) for admin access restrictions.
Assume Breach
Minimise blast radius and segment access. Verify end-to-end encryption and use analytics to get visibility, drive threat detection, and improve defences.
If you start from a position where you assume you have been breached and build security within the environment to account for this by minimising risk of lateral movement and only allowing users access to resources they need access to at any given time, you will significantly reduce the impact of any potential real breach.
Summary
The Modern Workplace is great for business as it improves collaboration, mobility, productivity and end user experience but as described, it brings with it new security threats.
By taking a zero-trust approach as described above and leveraging all the available tools and features available with Microsoft 365 – you will find that you are more secure and productive in this new world than you ever were before!
In part 2 of this article, we will discuss more in depth why you should use a Zero Trust model and how Microsoft empower you to achieve a mature Zero Trust security posture in a Microsoft 365 cloud or hybrid environment