Establishing Zero Trust Security, One Step at a Time
Yesterday, implementing Zero Trust security was important—today, it’s an imperative. Tomorrow, organizations that still haven’t rethought their security strategies could be left in the dust. But there’s still a chance to get ahead without investing in all the infrastructure you need at once; once you start the journey, it’s easy to continuously build and evolve.
To create a roadmap for this evolution, our Zero Trust Maturity Curve shows how each stage of the implementation journey expands on the previous one. As a result, you can organically build your Zero Trust security architecture to meet the needs of your organization—you just need the right tools.
With identity at the core of everything we do, Okta connects you with these tools, facilitating your journey to Zero Trust maturity. Let’s break down which solutions can help take your model to the next level.
Stage 1: Unified identity and access management
The most basic principle of Zero Trust is “never trust, always verify.” In practice, this means boosting your security layer with stronger authentication, ensuring visibility into who your users are, deploying seamless user management, and adopting robust policies under one consolidated system.
Single sign-on
This is important because: Zero Trust architecture helps reduce the risk of data breaches, and that starts with reducing the risk of compromised credentials.
Where to start: Okta Single Sign-On (SSO) is the first step in consolidating passwords for all your resources. Using Okta, you can enable SSO for multiple resource types - cloud apps, servers, on-prem apps and more. And, if you want to take it further, the common password check feature prevents users from setting common passwords or those associated with data breaches.
Learn more about Single Sign-On implementation here.
Basic multi-factor authentication
This is important because: The fastest, simplest way to secure your accounts is to have users sign in with more than one factor. All access is untrusted in a Zero Trust model, and MFA should be table stakes.
Where to start: Okta Adaptive Multi-Factor Authentication (Adaptive MFA) is a flexible solution that you can deploy across all your software and servers, from cloud applications to VPNs to on-prem apps.
Learn more about MFA implementation here.
Unified access policies
This is important because: Being able to control the factors and password policies for all users, devices, and servers is fundamental for a Zero Trust framework. Just because all access requests start as untrusted, doesn’t mean the same permissions and protocols are appropriate in all situations.
Where to start: Okta Universal Directory gives admins a single source of truth to oversee and manage all users, groups, and devices. Meanwhile, Okta Access Gateway (OAG) applies the same security experience across your hybrid environments, and Advanced Server Access (ASA) transforms how you protect on-prem infrastructure by minting ephemeral client certificates for users—and eliminating credential management pain in the process.
Learn more about implementation for:
Stage 2: Contextual access
Now that you have strong passwords, multiple factors, and a consolidated place to manage them, the next step in the Zero Trust journey is adding context. This means looking at the devices, locations, and networks trying to access your data, as well as the specific applications or information they’re trying to access.
Contextual-based access policies
This is important because: The more proactive you can be in protecting your systems from unrecognized traffic, the better. That means having policies that will prompt for additional factors based on user context and behavior.
Where to start: Okta ThreatInsight is a security feature that helps identify and block malicious and suspicious IPs. Okta Device Trust also allows you to limit access for users whose devices are not part of your Enterprise Mobility Management (EMM) or Mobile Device Management (MDM) solution, or whose context is unfamiliar. With Okta, you also have the ability to set policies based on different pieces of context in a user’s login (e.g., device, IP, location) and use our Behavioural Detection functionality to uncover anomalous behaviour patterns.
Learn more about implementation for:
Multiple factors
This is important because: Not all factors are created equal. You should enable and prioritize high assurance factors such as WebAuthn or biometrics; this helps protect your organization and brings you a step closer to eliminating passwords.
Where to start: Okta Adaptive MFA includes built-in contextual awareness to determine which factors to deploy from a long list including Okta Verify, hard tokens, mobile authenticators, and more. Factor sequencing is another feature that lets you configure multiple high assurance factors along with risk-based auth so that you can remove passwords from the mix.
Learn more about implementation for Factor Sequencing here.
Automated deprovisioning
This is important because: One of the biggest risks to your network security is inactive accounts that haven’t been properly shut down. Automated deprovisioning helps mitigate this risk—while automated provisioning streamlines onboarding and enables the right people with the right level of access to the right apps.
Where to start: Okta Lifecycle Management (LCM) and Okta Workflows let you automate both provisioning and deprovisioning so you can reduce the risks that come with manual processes.
Learn more about implementation for:
Secure API access
This is important because: APIs are becoming increasingly critical to business processes, but as a consequence, they’re also projected to become the biggest attack vector in the months and years ahead.
Where to start: Okta API Access Management empowers your IT and security admins with centralized control over creating, maintaining, and auditing policies for who can access which APIs.
Learn more about implementation for Okta API Access Management here.
Stage 3: Adaptive workforce
Through continuous monitoring of authentications, context, and changing signals, a complete Zero Trust model actually makes access more seamless—and secure—than it has ever been before. As a bonus, passwords are finally phased out in favor of stronger credentials.
Risk-based access policies
This is important because: Setting context-based access policies is good, but adding an intelligent, risk-based engine that lets you set risk tolerances is better. The system automatically assesses the potential risk of any authentication event and prompts for second factors if needed
Where to start: Risk-based Authentication has these defenses built in. Get granular with the protections that we can provide for your infrastructure, and gather a more complete picture of the risks to your organization.
Learn more about implementation for Risk-based Authentication here.
Frictionless access
This is important because: Security and user friendliness have traditionally been at odds. But if you build your Zero Trust model to its full potential, it’s possible for your workforce to be both agile and safe.
Where to start: Okta FastPass is one of multiple solutions that minimizes friction for end users while still enforcing adaptive policy checks, and is one of the easiest ways to unlock the power of passwordless authentication for your organization.
Learn how to go passwordless through Okta Factor Sequencing here.
Continuous and adaptive authentication
This is important because: With the growing number of devices and applications that users have to navigate, businesses need identity solutions that can continuously assess access, without compromising user experience. Continuous authentication does this by using data rich tools to passively review a user’s access after the initial point of authentication, using long-term secrets.
Where we’re going: With tools such as Okta FastPass and Device Trust, Okta is making continuous auth a reality—driving secure and seamless user experiences that also delight your IT admins.
Get started
A Zero Trust framework is both the present and the future of security—and all the functionality needed to put it in place is available today. It’s never too soon to start building, but it will be too late if you wait for your data to be compromised.
Check out our latest research on how enterprise organizations are realizing Zero Trust, and talk to our team about taking a proactive approach.
Follow Kelsey Nelson
