Zero Trust Assessment & Architecture

Your expert

Dr. Silvia Knittl
Director, Cyber Security & Privacy at PwC Germany
Tel: +49 151 1548-0524
Email
LinkedIn

Why organizations should rethink their approach to security

Traditional IT security is increasingly being weakened by rapidly advancing technological developments and new ways of working. The existing infrastructure and IT systems are often no longer reliable, and traditional perimeter-based security strategies do not provide comprehensive protection against today's cyber threats. The significant change regarding traditional IT security is caused by the following factors:

• Organizations are integrating more and more services that are available on the Internet and that offer access over an untrusted network.
• Access to corporate and cloud applications is becoming increasingly common using different end devices.
• The different user groups, whether employees, externals, or service providers, are increasingly working in different geographical locations.

These diverse use cases increase the potential attack surface and result in new vulnerabilities that offer attackers new opportunities to grab valuable data or disrupt critical business processes and infrastructure. This increases the business challenges that companies face to protect critical assets, data, and resources. For this reason, IT and security leaders must seek modern, comprehensive solutions for their architecture and consider a fundamental change.

Zero Trust – Success Factor for a secured Digital Transformation

What is Zero Trust?

Zero Trust describes a cyber security concept for securing data and infrastructures that, in conjunction with appropriate security tools, control and monitor the state of the entire architecture and make intelligent decisions based on real-time information. The Zero Trust model is based on the principle "trust is good, control is better" and fundamentally distrusts all services, users and devices inside and outside a network. The goal is to minimize risk and eliminate internal and external threats. Zero Trust therefore requires comprehensive authentication and authorization, both internally and when accessing external networks. Thus, the Zero Trust model addresses the modern challenges of the digital transformation of the business world, including securing remote employees, personal data, hybrid cloud environments, and protection against cyber threats.

Why do our customers implement Zero Trust?

For companies, the digital transformation means that the number of critical business processes and systems that are essentially dependent on a functioning IT infrastructure is increasing. The network (intranet and internet) acts as a link that connects the ecosystem of customers, business partners, employees, applications, and data. This results in the increasing need for security solutions, which may also be provided via new service models such as the cloud. There are many reasons why customers are rethinking their current security approach and implementing Zero Trust.

For example, Zero Trust involves building highly resilient networks while leveraging existing technologies. Another reason companies should incorporate a Zero Trust approach into their security architecture is to reduce tool sprawl and traditional security costs. Thus, Zero Trust drives digital transformation, optimizes user experience, and promotes smooth interaction to improve customer loyalty.

PwCs Zero Trust Architecture Approach

Our Zero Trust architecture is based on the “verify all” principle. This means that guidelines or policies determine who can access what and when. In the architecture, policy administrative points, decision and enforcement points form the conceptual basis. This can be a single point gateway that strictly controls any attempt to access resources by devices or people (identities). Secure, location-independent access to resources and data is based on risk-related real-time decisions. The decision as to whether a user can interact with the requested resource is made individually for each individual request. All activities are monitored to determine deviations from a safe state and to enable corrections. The focus is not exclusively on the internal data centers of a company, as is the case with conventional security models, but also on access control and monitoring of data traffic to outsourced cloud, web, and IT services.

Why PwC for Zero Trust?

Confidence, Independence & Expertise

A successful Zero Trust implementation relies on data-centric security strategies, security policies, data classification standards, and identity and access management solutions. PwC has extensive skills in working with interdisciplinary teams, cross-border zero trust expertise and alliances with key technology providers to drive successful digital transformation in your company. Due to the manufacturer independence and the regulatory obligations, PwC guarantees a high degree of integrity and acts as an independent "Trusted Technology Advisor". With the following services, PwC supports your company in planning and implementing an individualized Zero Trust strategy:

• Support in identifying critical or sensitive vulnerabilities within your enterprise architecture
• Application of data categorization and classification and support in the implementation of data protection solutions and processes
• Provision of architecture guidelines for the integration of Zero Trust into the security architecture and the coordinated enterprise architecture
• Assistance in monitoring compliance with guidelines and regulations