A Guide to Complete Zero Trust – Cloud, Mobile and Remote-work as Drivers of the Zero Trust Approach

The IT landscape has indeed changed massively in recent years. In this second blog in our “A Guide to Complete Zero Trust” blog series, we take a closer look at two of the biggest changes in recent years and analyze what impact these changes are having on IT security. Let’s start with the cloud:

In the current cloud service environment, there are mainly three types of services, namely Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS). All three have been enjoying a steadily increasing demand for years, so that almost every company today relies on cloud services at least to some extent. This rapid growth is not only generated by the migration of existing applications to the cloud, but also accelerated by the development of new applications in the cloud. These solutions are often referred to as cloud-native applications. The growth rates are impressive that the Synergy Research Group currently quantifies the growth for the Software as a Service market to 30 percent annually.

This shift to the cloud is not surprising given the many benefits cloud brings – from cost and increased efficiency to time-to-market. Furthermore, the cloud also has several advantages in terms of security because the focus of cloud providers on their core business – i.e., the cloud including its security – is usually better positioned compared to the cloud customers (users).

Now let’s look at the implications of using cloud services in the context of Zero Trust. The cloud market is very heterogeneous, with Amazon (AWS), Google (GCP), Microsoft (Azure) as the dominant players in the Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) market. Although Microsoft and Google also dominate a category in the area of Software as a Service (SaaS) with Office 365 and Google Workplace, the market for Software as a Service in particular is very heterogeneous. From ERP and CRM providers to Project Management tools, Time Tracking systems, Helpdesk solutions and more, there are a variety of services used by companies and offered as Software as a Service.

Despite the great advantages that Software as a Service (SaaS) solutions bring with them, distribution in particular has proven to be a problem for classic IT security concepts. The software used no longer runs in the company network and the previous starting point of IT security, i.e., the protection of the company network, is therefore proving to be obsolete. To put it bluntly: “The Software as a Service runs where the provider wants it to be” – although the Software as a Service providers guarantee the highest level of security for their applications, the users, i.e., the company employees are no longer protected to the same extent as was the case with previous IT security measures. Access, which previously took place mostly in and from the company’s internal network, is now shifting to the Internet.

Besides various advantages that the cloud offers over conventional solutions, organizational trends and changes also contribute to the relocation of applications from the company’s internal network to the Internet. Mobile and remote work ensure that users are no longer just in the company’s internal network, but are increasingly accessing it outside of the network, i.e., via the Internet. The increasing networking with customers and partners also ensures that access from and within the company’s internal network is the exception rather than the rule. Moreover, the concepts such as Bring Your Own Device (BYOD) must also to be taken into consideration, – device management of all devices is no longer possible simply by networking with partners and customers.

The above and many other conceptual and technical innovations in the field of IT security have in fact accelerated a necessary rethinking of IT security, which is leading to a paradigm shift, namely Zero Trust. This is where a modern Cloud Identity & Access Management like cidaas comes into play. cidaas lives Zero Trust and pioneers it day by day, but also ensuring, thanks to its behavior-based clustering, that the users are never bothered with complicated login processes, so that the focus is never diverted from user-friendly digital identity management in any form. cidaas guarantees a unique and secure user experience with cidaas FDS (Fraud Detection System), Smart Multi-Factor Authentication and many more!

Don’t miss our further parts of our ‘Guide to complete Zero Trust’ blog series

• What is ‘Zero Trust’ and why do we need it? (part 1)
• How Forrester and Google made Zero Trust mainstream? (part 3)
• Identity as the Core Building-block of Zero Trust (part 4 – coming soon)

If you would like to learn in detail about “Complete Zero Trust – The Paradigm Shift in IT Security”, our whitepaper is now available to you!