Zero Trust: The Next Big Thing or Just the Latest Buzzword?

Blair Compston, BizStream’s Systems Administrator, delves into the Zero Trust buzz in tech, detailing its complexities and how BizStream employs the framework by posing critical questions about user, device, context, and resource.

By Blair Compston

December 12, 2023
Advice

If there’s one thing the tech world has in abundance, it’s buzzwords. If our servers thrived on buzzwords, we’d be powering the entire global server ecosystem for centuries. Okay, maybe that’s a bit of a stretch, but you get the idea.

Enter the latest buzzword on the block: Zero Trust. Now, here’s the thing—Zero Trust means many things to many different people/vendors in the tech realm. Ask five vendors about their Zero Trust product, and you’re likely to get five different answers, a toolkit that resembles a tech wizard’s dream, and likely a price tag to fit that dream. So, let’s roll up our sleeves and dig into Zero Trust—at least, what it means to BizStream and what it could mean for you and your company.

What Is Zero Trust Really?

At its core, Zero Trust is essentially saying, “Just because a device is on a ‘trusted network’—you know, your in-house corporate Wi-Fi with all those nifty monitoring systems and high-end firewalls—doesn’t automatically mean it should be there or that it’s safe.” This helps your security model by flipping the script to verify and then trust. I choose to think of it as a security framework. Once I have that, I can find the tool to match my needs.

The Problem

When I dove into this Zero Trust rabbit hole and quickly realized that everyone had their own spin on it, I decided I needed to carve out what I was aiming for. Here’s the rough sketch I came up with:

We need a better way to grant secure access to our legacy network and cloud resources from devices we may not own and networks we may not control.

Man, that is like a mission statement or something. I kid, but this really helped as I talked to vendors to find the right tool/software.

How Is BizStream Using This?

So, after researching and talking with vendors, I came up with the following “question” to build my Zero Trust framework upon. Should this user, on this device, in this given context, have access to this resource? It might not sound revolutionary if you’ve been around tech for a while, but it helped me frame what I was looking for, more context around that control.

I may have gone a bit rogue with the implementation, though, not just logically separating my network traffic (VLANS) but physically separating them too. Picture this—when our team strolls into the office, the Wi-Fi network is just another network. It’s got zero connection or context to our core. We’re using a next-gen Zero Trust application that lets us answer that crucial question: should this user, on this device, in this given context, have access to this resource?

Let’s Break Down That Question:

User: Is this a valid/real user? How long has it been since I have seen this user?
Device: Is this a work-issued device, something they brought from home, or a public device? Does it meet our security standards (encryption, firewall, antivirus, fully patched, etc.)?
Context: Where is the request coming from? The office might have different rights compared to someone connecting from home or overseas.
Resource: What exactly are they asking for? Is the data sensitive? Does the resource have access to sensitive information?

Now, armed with all this info, I can toss it into a risk matrix of sorts to decide whether to grant the request. This helps the company leadership, and me understand the risk we are introducing with our access. Maybe the data is highly sensitive, and I only want to grant that access with additional security measures in place, like forcing an MFA challenge. The added bonus is that the framework is now applied to all of my networks. We can layer on extra security to legacy networks that lack MFA or need additional security with very little effort. We can route traffic after security challenges have been met without complicated firewall rules.

That’s a Wrap

So, there you have it—Zero Trust in action at BizStream. It’s not just a tech buzzword; it’s a framework that reshapes how we approach security. By adding layers of context and separating the physical and logical realms, we’re navigating the ever-evolving landscape of cybersecurity with a sharper focus.

In a world where technology evolves at warp speed, Zero Trust isn’t just a tool, a buzzword, or a framework; it’s a mindset shift. It’s about questioning assumptions and ensuring that access isn’t just a given but earned through a calculated evaluation. As we embrace the future of cybersecurity, buzzwords, and ever-changing threat models, one thing’s for sure—trust may be a rare commodity, but with the right approach, it’s the backbone of a secure digital frontier.

Want to talk about it more? Hit me up. Happy to share our journey and dive into the details more.

About the Author

Blair Compston

Blair has been playing with computers as long as he can remember. He has worked in companies both big and small and in every position from helpdesk through manager, and now he brings his knowledge of all things IT to BizStream. As our IT and DevOps guy, he keeps our servers running, networks in line, and clouds fluffy. Outside of work, this family guy can be found spending some QT with his wife and four kids or tackling yet another home renovation project.