Can Zero Trust Live Up To Its Promise? Unpicking The Latest NSA Guidance

Zero trust (ZT) has been hailed as the paradigm shift that could finally turn the tide against rising cybercrime. But despite growing industry consensus and a presidential order mandating all US agencies adopt it this year, many organizations seem stuck.

Gartner predicts that just 10% of large enterprises will have a mature zero trust program in place by 2026. Now, a report from America’s National Security Agency (NSA) offers practical advice for firms struggling to develop a workable zero trust implementation plan.

Is it enough to break the logjam? We unpick the NSA’s recommendations, speak to industry experts, and suggest five ways firms can move their zero trust architecture ambitions from roadmap to reality.

Table of Contents Table of Contents

1. Key Takeaways
2. What Is Zero Trust Architecture?
3. Why Is Zero Trust Architecture in the News?
4. The NSA’s Key Recommendations for Zero Trust Implementation
5. Facing Up to Zero Trust Challenges
6. The Bottom Line
7. FAQs
8. References

Show Full Guide

Table of Contents

1. Key Takeaways
2. What Is Zero Trust Architecture?
3. Why Is Zero Trust Architecture in the News?
Show Full Guide
4. The NSA’s Key Recommendations for Zero Trust Implementation
5. Facing Up to Zero Trust Challenges
6. The Bottom Line
7. FAQs
8. References

What Is Zero Trust Architecture?

Zero trust starts from the premise that relying on a strong perimeter to keep cybercriminals out is fundamentally flawed. It assumes bad actors are already inside — actual hackers and the error-prone employees who let them in.

To that end, zero trust treats every login, file access, or use of network resources as a potential breach.

Applied across seven pillars of trust, it comes closest to achieving what military planners call ‘defense in depth,’ a system of multiple barriers and backstops that stop intruders from penetrating deep into the defended territory.

Haider Iqbal, Identity and Access Management Product Marketing Director at Thales, told Techopedia:

“Zero trust involves a complete paradigm shift from legacy enterprise security approaches to more modern decentralized and cloud-first approaches.”

It’s understandable that adoption has been sporadic, he adds, because zero trust “isn’t a specific type of certification that can be measured. It’s not a singular piece of technology or a security control that can be plugged in.”

The US National Security Agency’s Seven Pillars of Zero Trust. Source: NSA

But here’s the thing: zero trust is a model — not a technology. The correct mix of applications, platforms, and devices depends entirely on the needs of each organization.

It’s comprehensive, strategic, and customized, or, put another way, complex and expensive. Despite a 2021 executive order by President Joe Biden mandating that all US federal agencies move to zero trust by 2024 by this year, it hasn’t yet achieved liftoff.

Why Is Zero Trust Architecture in the News?

According to IBM, the average cost of a cyber attack reached $4.45 million in 2023, a 15% increase over three years. Cybersecurity Ventures reckons the global cost of cybercrime last year was a whopping 8 trillion USD, heading for 9.5 trillion in 2024.

In March, the NSA published advice for implementing zero trust in the Networking pillar. Enterprises need to be worried about lateral attacks, the agency says, as hackers get better at sneaking in unnoticed and then lurking around for days, weeks, and even months as they seek valuable information to exfiltrate.

John Kindervag, who coined the term ‘zero trust model’ back in 2010, recently wrote that the NSA’s latest guidance “reaffirms the value of network security technologies in establishing any zero trust environment.”

?Sean Frazier, VP, Federal CSO at Okta, said:

“Cyber attacks are continuing to increase, and the impact of them is more damaging for all types of organizations.”

The firm’s State of Zero Trust Security report says 61% of organizations have a defined zero trust initiative in place, but “there is still a significant need for the rate of adoption to increase, and for companies to continue to update their processes as threat actors find new ways to infiltrate systems.”

The NSA’s Key Recommendations for Zero Trust Implementation

Facing Up to Zero Trust Challenges

What will it take to accelerate zero trust adoption? There are significant hurdles to jump:

Add to that shortlist concerns about culture change, employee experience, cost, skills shortages, integration, compatibility, compliance, scalability, and more. Zero trust can seem like a mountain to climb. But some see clear signs of progress.

Drew Epperson, VP of Federal Engineering for the US Public Sector at Palo Alto Networks, told Techopedia that zero trust adoption is gaining traction.

“There are definitely cases where organizations are not as mature as they would like to be, but in our experience everyone has started the journey and made progress.”

Epperson says legacy technologies can be a real source of struggle. The answer is to take a platform approach.

“Attempting to integrate 5,10, or 50 security products into an end-to-end Zero Trust architecture is a losing battle. We have to consolidate and adopt industry leading platforms that provide the functionality required in a natively integrated platform.”

The Bottom Line

Okta’s Sean Frazier says zero trust “is never a completed task.”

It needs to evolve as the threat landscape changes and threat actors find new ways to effectively hack companies.

Given the lack of finality and the number of pillars that need to be addressed, it’s no surprise that zero trust hasn’t fully arrived. Some of the resistance could even be emotional.

In a time when tech is focused on collaboration, sharing, partnership, and even co-opetition, ZT grates against the zeitgeist. When bringing your own device (BYOD) is the corporate norm, suggesting that employees become a business risk every time they open an app or access a file feels a bit rude.

Still, Doug Winzell, a Cyber Security Consultant at Eidolon Associates, believes the NSA has made a welcome intervention. He told Techopedia:

“The lack of adoption of security frameworks has been missing in the Zero-Trust journey. Most systems today are interconnected and available over the web. Zero Trust takes security to the Cloud and the edge.”

FAQs