What is zero trust security, now drawing attention with the push for DX? Basic concepts and benefits

In recent years, companies have been actively pursuing digital transformation (DX), and work environments have changed greatly, with the spread of remote work and improvements to business systems using cloud services. In manufacturing, too, technologies such as IoT, AI, and edge computing have made remote operation and monitoring of production equipment, automated operation, and predictive diagnosis possible, changing the working environment on the factory floor.

As DX drives work style reform and changes in working environments, the amount of new data handled has grown far beyond what it used to be. At the same time, there are more occasions to access company systems from outside the company and to access production equipment directly from outside the factory. This is where security becomes a problem. As access from outside increases, so does the risk that important internal information will be stolen or systems damaged. Conventional security measures have found it harder to respond appropriately.

In this situation, security based on zero trust is drawing more and more attention. This article explains what zero trust is, its basic concepts, the benefits of adopting it, and how to use it.

Recommended products

Cloud applicationsSoftware

remote.it

What is zero trust?

Zero trust is a new security model for the cloud era (the zero trust model) based on the principle “never trust, always verify.” Conventional security divided the network into a trusted inside and an untrusted outside, and built a wall at the boundary to monitor and defend it. The trusted inside meant networks such as the company LAN and networks connected by VPN, and the untrusted outside meant the internet and similar networks. The wall at the boundary meant security systems such as passwords, firewalls, IDS, and IPS. These security systems monitored and controlled access from outside to protect internal networks and information from cyberattacks.

However, with this conventional approach to information security, once computer viruses, worms, or other malware get through the wall and inside, they can act freely as if their access were authorized, causing serious damage. In recent years, with the spread of the cloud, more data and applications also exist on the internet, which is outside. The things that need protecting have become more complex, and conventional methods are finding it harder to cope.

How a zero trust network works

Zero trust network security assumes that no communication, inside or outside, can be trusted, and designs and implements secure communication methods on that basis. Even internal company traffic, which used to be treated as trusted and safe, is checked and authenticated every time, and users get only the minimum privileges they need. Examples include encrypting all communication paths, stronger checks such as two-factor authentication, and automatic monitoring of access logs. This allows countermeasures even against malicious users or programs that have got inside the wall, keeping risks to a minimum.

Why zero trust security is needed

The zero trust concept was proposed in 2010. It has drawn attention especially with the growing use of the cloud and the spread of remote work.

With remote work, employees take company devices out of the office or use their own devices, and they need to access important company data from anywhere outside the office. As more employees work remotely and handle more kinds of work, the number of accesses from outside grows. With cloud services, all kinds of company data are gathered in the cloud, and many people inside and outside the organization access it from various devices. In recent years, information leaks caused by insider wrongdoing or mistakes have also become common. Conventional security that builds a wall to protect against outside attacks can no longer keep up with growing numbers of access points, growing traffic, and threats from inside.

There is also strong demand to access systems and equipment from anywhere. For example, in remote monitoring solutions with surveillance cameras, internal company systems need to connect to cameras outside to get image information. For remote equipment maintenance, a PC or other device in another location accesses equipment in the factory to get maintenance information and operate it. When maintenance is done not only by your own staff but also by engineers from other companies, such as the equipment manufacturer, security restrictions for outsiders need to be lifted temporarily. With conventional security, there was the problem that intruders could get in through another route and steal information. Conversely, tightening security could make remote operation or connections by outside contractors impossible.

A network built on the zero trust approach, with stronger security that withstands threats from inside and outside, is essential for the business environment ahead.

Benefits of zero trust security

Zero trust security has many benefits. One is a lower risk of information leaks and early detection of their causes. With zero trust security, every user must authenticate every time to access information, and access rights are kept to the minimum needed. Even if someone gets in by some means, the data they can see is limited, so leaks are also kept to a minimum. Because authentication happens on every access, access history can be recorded in real time, and the route of an intrusion can be identified quickly and dealt with. No security measure can reduce risk to zero, but zero trust security keeps it to a minimum and, if something does happen, lets you resolve it early.

Another benefit is greater convenience. For example, with conventional security, each system had its own ID and password, and users were sometimes asked to set longer, more complex passwords for better security. Users had to remember them all, which sometimes led to practices that actually lowered security, such as writing passwords down on paper. With zero trust security, methods such as authentication through distributed cloud services make single sign-on possible, so users can access multiple systems securely with one password. Devices based on the zero trust approach also allow secure communication between devices on private IP networks without global IP addresses. This greatly improves convenience for users who perform remote operation and remote monitoring.

Growing demand for zero trust security in manufacturing

Zero trust security, drawing attention with the growing use of the cloud and remote work, is also needed in manufacturing. Traditionally, data from inside a factory was used mainly within the factory and stored and processed on the factory network. Equipment was managed and controlled within the factory network, and most of it could not be accessed from outside. Owning information systems in-house and running them on your own equipment like this is called “on-premises.”

Recently, however, production lines have rapidly gone online, and production equipment is now connected to networks accessible from outside and managed and controlled centrally. Besides the equipment itself, cameras, sensors, and other IoT devices that monitor and manage factory floors and facilities are evolving every day, and all kinds of devices are now connected to networks. Conventional security systems that build a wall around the factory network have found it harder to prevent threats from outside. Network connections also made remote support possible, but with conventional security it was very hard to access equipment safely, so it could not be done easily. To solve these problems, zero trust security is drawing attention in manufacturing as well.

On the factory floor, there is demand for highly secure remote access based on the zero trust approach that can be set up without engineers with advanced networking knowledge.

Simple remote control with remote.it, designed on zero trust principles

amnimo’s IoT Router (Japanese) comes with an application preinstalled for using remote.it (Japanese), a cloud service from remot3.it, Inc. remote.it (Japanese) is a new remote access service designed on zero trust principles. It uses a trusted P2P network to provide an SDP (software-defined perimeter: a technology that protects software, hardware, and information from various threats over networks). With remote.it (Japanese), devices without specific global IP addresses can establish one-to-one communication with each other, so it is expected to serve as a way to access production equipment from outside.

Because of the recent spread of COVID-19, it has been hard to send people to customers’ factories and other sites where production equipment is running for inspection and maintenance. This service lets you use existing control systems remotely over the internet without changing them, which can greatly reduce the costs and risks of sending employees.

Summary

This article introduced zero trust, which is described as a new security model. The zero trust approach can be called essential in today’s business environment, which demands diverse ways of working. In manufacturing, too, there is demand for simpler and faster ways to achieve highly secure zero trust security. With growing interest in zero trust security, many EDR (endpoint detection and response) products and services that help achieve it have also been developed. Make effective use of them and consider a secure network that keeps risks low while staying convenient for users.

Recommended products

Cloud applicationsSoftware

remote.it