With diminishing enterprise boundaries and users accessing corporate resources remotely, the number of cyber threats is rising rapidly. Approximately 34% of breaches occur due to insider threat actors.

Today’s complex infrastructure cannot rely on traditional security architecture as it does not have a single defined perimeter due to remote access from users, use of cloud services, and emergence of edge computing. That is why most of the breaches occur due to lack of control mechanisms or visibility, with unhindered lateral movement of malware in the network.

Enterprises are adopting zero trust security through different initiatives to enhance their security posture. Several leading vendors offer products or services, which can secure, restrict, or control access, based on the zero trust model. But, are these solutions empowering enterprises with a holistic approach to security?

Confusions around zero trust

After the inception of the concept of zero trust security, multiple vendors came up with solutions and methodologies using their integrated product suites, offering zero trust security. Their approach is mostly around the product suites, and what they offer, and does not provide a holistic view to improve security posture, or cater to the enterprise requirements.

Most of the times, these products do not focus on an integrated approach or co-existence of ecosystem security controls, neither orchestration of data to influence or control access for a user.

This often creates confusion for people responsible for the security wellbeing of the enterprise, while strategizing zero trust security and choosing the correct set of tools.

Zero trust is an approach that cannot be achieved using a single solution, tool, or product. It is rather a methodology, usually designed based on enterprise needs, and always contextualized and fine-tuned based on the business priorities of an enterprise. 

Zero trust is all about access to data

Zero Trust, first coined by Forrester more than a decade ago, has gained more acceptance now. 

The zero trust extended ecosystem talks about data, network, people, workloads, and devices, along with analytics and automation, to provide visibility and access based on trust-but-verify approach. These five core elements contribute toward the build of a zero trust model and should be used to measure the maturity of an enterprise’s ability to secure its environment.

The zero trust security model allows establishing gateways or interception points in the network or data flow path, to gain complete visibility and thereby enforcing controls. The ultimate goal is protection of data or sensitive information while providing access to users, based on the need in that particular context. Figure 1 shows indicative zero trust security use cases across various elements of zero trust.

Figure 1:  Five elements of zero trust security and use cases

A holistic approach to zero trust security

Wipro provides a holistic approach to zero trust security, leveraging a framework and a working model, which uses different security tools and functionalities while integrating elements of cybersecurity controls. This helps enterprises adopt zero trust security seamlessly, using specific security toolsets driven by processes to control the level of access to organizational resources. Enterprises need to prioritize elements and security controls to be part of a zero trust solution in heterogeneous environments.

Figure 2 depicts a universal working model of zero trust security, which can be adopted by the enterprise, while multiple security products with zero trust capabilities can contribute as building blocks of the overall solution. Zero trust security allows access based on context, and always monitors and improves security posture.

Figure 2: Universal working model of zero trust security

The zero trust capabilities should be enhanced with feeds coming from other entities in the environment to further control the level of access. This can be achieved using products that are capable of integration to external feeds or leverage external orchestrators.

True maturity relies on building an interconnected system, where any anomaly in the system can trigger a change in the level of access.

Figure 3: Data flow of zero trust security architecture

Wipro’s zero trust working model helps enterprises achieve zero trust security, which blends with any vendor tools or zero trust engines or customized tools. The working model follows the National Institute of Standards and Technology  approach but expands further to an adaptable architecture. 

Wipro’s consulting approach

Our assessment helps the enterprise to identify the prioritized elements and areas to focus, while building the use cases on infrastructure, data and identity, which can be deployed in the organization, with possible products to be added or features to be enhanced. Existing tools or products take precedence while aligning products across different elements. This is followed with establishing a possible relationship with different zero trust elements and integration mechanism, while providing detailed maturity report of zero-trust.

Figure 4: Wipro's consulting approach and possible outcomes

Zero trust security maturity starts from basic, developing, advanced, optimized to highly resilient, which includes the presence of security controls, processes used, governance methods, integration with external tools to influence or restrict the level of controls, and unified management from the cloud. Figure 5 shows how all of these are used to derive maturity scores across the five elements of zero trust.

Figure 5: A sample maturity with five elements

There are solutions that offer the capability to orchestrate various feeds or information to allow access or restrict or deny, while a few others offer point solutions to cater to specific zero trust needs. Wipro provides a contextual view of security tools along with the features relevant for the enterprise, using a heat map. This helps to identify products that can be leveraged to adopt zero trust security.

Benefits of Wipro’s zero trust framework

• Effective approach to zero trust security using different elements of cybersecurity controls, and leveraging framework, and process of continuous risk assessment
• Use feeds from infrastructure elements, organizational policies, and static data to process and analyze for decision making on access requirements
• Methods to enforce zero trust security policies based on context to allow access to the applications or enterprise resources
• A working model of zero trust which can accommodate multi-vendor tools for monitoring or protection or enforcing policies
• Consulting approach to identify the focus areas to enable zero trust, multiple toolsets with possible relationship and maturity model
• Define a phased approach to adopt zero trust leveraging existing and new security tools

To know more about how Wipro’s zero trust working model will help you achieve security maturity, connect with us at cybersecurity.services@wipro.com

Angshuman Chattopadhyay
Consulting & Solutions Lead for Infrastructure Security within Cybersecurity and Risk Services at Wipro

Angshuman Chattopadhyay is the Consulting & Solutions Lead for Infrastructure Security within Cybersecurity and Risk Services at Wipro. He brings extensive experience with over 19 years in IT and Cybersecurity across a wide range of global roles.

Angshuman can be reached at angshuman.chattopadhyay1@wipro.com