Zero Trust vs Defense in Depth: Which is right for your org? - One Identity - Blogs - One Identity Community

type

status

date

summary

What is Zero Trust?

So, what is Zero Trust? It is based on the concept of “never trust, always verify.” This cybersecurity framework is based on the idea that no entity – inside or outside of a network – should be implicitly trusted. Everything and everyone needs to prove who they are and that they have the right permissions to access the target resource. In short, they need to undergo continual authentication, verification and authorization to keep access to applications and data.

This is akin to crew members of the Enterprise verifying and authenticating their identity at every doorway before they are allowed to access the next area.

What is Defense-in-depth?

Now, defense-in-depth refers to the practice of using layers of security measures, such as firewalls, secured gateways, authentication and intrusion detection systems, to protect internal networks from external attacks. This provides backup levels of security in case other security measures fail.

It’s circling the wagons, but with multiple layers of protective devices and processes to keep threat actors outside of the perimeter.

In short, if one defensive measure is compromised, another set of defense mechanisms can detect and prevent a breach attempt. By including redundancies and using security defenses across solutions, enterprises can aim to close gaps in security and thwart potential attacks.

What is the difference between Zero Trust vs defense-in-depth?

The main difference between Zero Trust and defense-in-depth security strategies is that Zero Trust never implicitly trusts users inside or outside network perimeters. Whereas with a defense-in-depth security strategy, users within a network are usually implicitly trusted.

While Zero Trust aims to prevent attackers from the outset, the defense-in-depth strategy simply aims to delay the attack by increasing the number of barriers an attacker must overcome to get within the security perimeter.

What are the benefits to a defense-in-depth approach?

The main cited benefit of a defense-in-depth approach is through layered security. If one part of an enterprise fails, then other networks and platforms are kept safe. To build it effectively, you must consider your strengths and weaknesses, and add layers where a breach is most likely. This redundancy helps to ensure that a single point of failure won’t be the sole factor in a successful breach. By layering perimeter defense with a defense-in-depth configuration, threat actors must clear multiple hedgerows which slows down threat advancement and adds complications to their efforts.

Downsides to defense-in-depth

Although defense-in-depth has been a solid strategy for quite a while, there are some downsides. Some of the key shortcomings of defense-in-depth are that as there’s always new threat techniques being created while existing ones continue to evolve.

As these threats develop, the focus of attacks changes. What was safe yesterday is vulnerable today. And if you’re not aware, you are unlikely to have appropriate protection against a threat. Often there’s a lack of integration among the various security measures in a defense-in-depth strategy, which makes coordinating across various security layers difficult. This non-integration leads to gaps in defenses and can extend the time before a breach is detected. Furthermore, it can be expensive to procure, maintain and manage a multilayer cybersecurity strategy, particularly across the modern hybrid, heterogeneous enterprise. Also, you can add other cybersecurity complications to the list, such as third-party contractors, RPA technology, BYOD and remote working. Any time there a change or modification in how work gets done, the defense-in-depth model needs to have a suitable response, which isn’t always possible.

With the migration to ‘work from anywhere’ and ‘as-a-service’ business applications, many of the defense-in-depth concepts no longer apply in their original form. The ‘depth’ now becomes the human and the identity that requires protection.

Key shortcomings

• A continually growing attack surface • BYOD and cloud applications • Complex management • Expensive to maintain • Time to identify threats

• Visibility across the enterprise • Siloed solutions and data • Compliance challenges • Cost of hiring staff and consultantsto integrate ecosystems

What are the benefits of Zero Trust?

Whereas defense-in-depth is the festival seating of cybersecurity, Zero Trust is more along the lines of an exclusive club-style security with velvet ropes controlling access to specific tables and sections, including the VIP and super VIP areas. First, just to get in the front door, you might need to show two forms of ID. Plus, there are bouncers inside that monitor for bad behavior, and for people and activities that don’t belong. If you don’t have the right credentials, can’t act appropriately or seem suspicious for any reason, your night at the club is over.

As they say, Never Trust, Verify Everything. Then, because it’s Zero Trust, a user doesn’t have automatic access to anything. In fact, at the most, their access is governed by the least-privilege framework, where they only have access to the minimum of resources to get their daily job done.

With the processing speed of modern security technology, just-in-time (JIT) access protocols can be applied with minimal impact to productivity or speed of access. If a user needs to access a cloud application or a proprietary database, they need to authenticate, and their identity needs to be verified for each access session.

Escalation processes can be applied to users (human or machine) that are attempting to get to sensitive resources they don’t normally access. These escalation processes can be automated or require manual approvals by managers and/or application owners – or a combination of approvals processes depending on the security policies of your organization.

Whereas defense-in-depth focuses on keeping bad actors out, Zero Trust has the huge benefit of protecting against internal threats. With defense-in-depth, once in, you’re free to move around the cabin, but with Zero Trust, even if you have privileged access, at every critical access point you must authenticate and verify. Add in the collection of user-behavior data, and even if a user normally has access to a resource, if their activities veer too far from their known baseline behaviors, they may be asked to prove they are who they say they are with an MFA process or have their session immediately shut down. As many breaches are executed via compromised identities of legitimate users or by disgruntled employees, this monitoring of internal users is a massively important element of any cybersecurity strategy.

So those are the basics of defense-in-depth and Zero Trust. There are pros and cons to both and which you choose depends on where your organization’s cybersecurity needs to be in the near future, your threshold of risk vs your available budget and your best estimation of vulnerability to internal and external threat actors. We’re biased at One Identity, but we strongly encourage organizations to move to a unified identity security strategy that can deliver visibility across your enterprise. This will help your organization live long and prosper.

Blog Post CTA Image

Learn about our unified identity security platform Identities are proliferating at breakneck speed, as more users are added virtually every day and emerging initiatives are creating even more machine identities than human. On top of this identity sprawl, many organizations manage access rights in silos – the average large enterprise leverage more than 25 different systems, which delivers gaps, inconsistencies and risk.