Reaching the Convergence of Security and Productivity

It’s all too common that IT security tools and practices come at the cost of productivity. Even physical security has this trade-off. There would be no rush to arrive at the airport an hour early if it weren’t for the extensive security measures that flying entails. As a result of this trade-off, our concern often isn’t if we can increase security in our networks — rather, it’s if the increased security is worth the impact on the business.

We must also consider the risk vs. reward implications when adopting new business-enabling technologies. After we decide that a new technology is of value to the business, we then have to decide if that value outweighs the expanded attack surface and, in turn, the breach risk that comes along with it. Because of this, a constant tension between security and IT teams has become a given. But this doesn’t have to be the case.

In the April 2022 platform update, we’ll dive into the ways in which Akamai is building a future of work in which its customers can embark on a Zero Trust journey that minimizes breach risk while accelerating business productivity. Reaching this convergence of security and productivity begins with tackling the challenges that are commonly associated with implementing Zero Trust principles.

The dark side of Zero Trust

Analysts, vendors, and security professionals have offered plenty of perspectives on what “Zero Trust” means and how to achieve it. The one thing that we all seem to agree on is that it is a strong foundation on which security teams can minimize breach risk and impact. However, it’s easy to agree on the ideal end state of Zero Trust without delving into the details on how to get there and what impact it may have on the business.

Consider Zero Trust to have an end state at which you “zero out” any implicit trust within the environment that creates risk but doesn’t facilitate work. I think we can all agree on how amazing that would be; there would be no room for attackers to abuse vulnerabilities in our systems or to introduce new malware. 

The dark side of Zero Trust comes into view when we consider everything that must happen to get to that end state. We have to consider the journey to Zero Trust and not just the destination. A lack of focus on the journey itself is a large part of the reason it’s rarely put into practice. There are a few key points to think about as we highlight this journey.

Productivity slowdowns 

The first is the impact on employee productivity, either by accident or design. A fundamental aspect of Zero Trust is restricting access, primarily through denylisting. This is the practice of dictating what can happen; everything else is denied by default. As we decrease an attacker’s ability to carry out their malicious campaign, we often increase the likelihood of accidentally preventing someone from being able to do their job. 

It is unlikely that a security team can foresee each and every possible scenario in which assets and people must communicate with one another. Furthermore, businesses and workforces evolve and change in unpredictable ways. IT and security teams must account for scenarios in which trust is not granted, but should be.

Another potentially harmful implication of enacting Zero Trust principles are slow-downs in productivity that are accounted for. Added identity checks, agents that burden workloads and end-user devices, and tools that end users must log into are just a few of these. Each one on its own may well be within our tolerance. However, when we consider the stacked impact of these minor hindrances, they can reach the point where they are no longer worth the value that they provide.

The need for multiple touchpoints

The last but not least of the pain points in the Zero Trust journey that we’ll discuss is the impact on security teams, and their integrators, architects, and analysts. Currently, there is no single product on the market that can facilitate the Zero Trust journey on its own. As a result, security teams need to maintain policy across multiple consoles, roll out multiple agents, and maintain multiple integrations. 

This is a difficult task for even the most well-staffed security teams, and can incur substantial costs in both dollars and people-hours. This final issue compounds the first two by increasing the likelihood of false positives as well as the number of agents and tools that begin to burden end users.

An asymptotic pursuit

It’s also worth noting that the pursuit of true Zero Trust is actually asymptotic; we can get close, but removing every iota of implicit trust is likely an impossibility. Especially if we expand our thinking on exactly where we can invoke Zero Trust principles. 

For example, consider a supply chain attack in which we have a trusted user downloading and launching a trusted application from a trusted source. Current definitions of Zero Trust would allow this to happen and the malicious payload is able to bypass all our zones of trust. In that case, we might consider a need for Zero Trust applied to the endpoint, within memory … but that is a conversation for another day. The point is that while perfect Zero Trust might be an impossibility, and moving closer to our goals might involve several pain points, it is very much a worthy endeavor because it offers a future of work in which minimizing risk and maximizing productivity go hand in hand. 

In today’s post, we’ll discuss how Akamai is working toward helping businesses make this vision a reality. With each step along the journey, we can reduce the likelihood of a catastrophic breach without disrupting the business. With the wide adoption of Zero Trust as the desired end state, it is now incumbent on security vendors like Akamai to make these steps achievable by more businesses, rapidly, and without any negative consequences such as those mentioned above.

Bridging the gap between vision and reality

Zero Trust means allowing only what is needed for a business to operate, and prohibiting everything else. Making the distinction between necessary and unnecessary actions and then acting on them with precision is at the heart of the Zero Trust journey. Without the right tools in place, this is nearly impossible. As a result, businesses allow more than is necessary and are left exposed to too many risks, or they prevent more than they should, which inhibits productivity. 

Daunting as this task might be, there are ways to remove implicit trust with such precision and granularity that end users won’t even notice. Furthermore, if done correctly, this can minimize the attack surface to the point where adopting new technologies is safe and all business-enabling actions are trusted. Security and productivity will converge such that Zero Trust both minimizes breach risk and impact while simultaneously enabling the workforce. But how do we make this future of work a reality?

Three key components of achieving Zero Trust

There are three key components to getting to Zero Trust without having to realize its dark side. These are:

• Visibility

• Understanding

• Control

We need real-time and historical visibility of all of our assets and their respective flows. We need to understand what is happening and why. And, finally, we need to act on this understanding with precise and granular control.

Visibility means providing the security admin a view into the various assets, flows, applications, and users from which we are trying to remove implicit trust. This visibility needs to be broad enough to cover the various operating systems, devices, and other aspects of our network.

Next, we have to understand the function of that which we now have visibility. Only with this understanding can we accurately delineate between what is required and what is not. Context, guidance, and visualizations allow us to understand what should and should not be happening, what is required for the business, and what is creating risk.

Once everything can be seen, and we understand what is happening, we can begin to remove implicit trust. Granularity and precision are key here. For example, some processes are required for normal operations but have services that are not required, which adversaries will abuse. In this case, we need to be able to enforce policy at the service level. A broad stroke policy at the machine or even application layer would lead to false positives. 

The tools of the trade

As it stands, no one tool can offer the enforcement capabilities required to root out all implicit trust in our networks such that we can reach Zero Trust. To combat this, Akamai is building the most complete portfolio of Zero Trust products with a roadmap that shows these tools fully integrated.