In December 2021, a report from Forrester says Microsoft Zero Trust solutions can see an ROI of up to 92%.
This new published study details and outlines the financial implications of implementing a Zero Trust architecture with Microsoft specific solutions.
The research study, dubbed Total Economic Impact, was released in December 2021 and highlighted the costs, benefits as well as risks associated with this investment.
The researchers found that the adoption of Microsoft Zero Trust solutions can help to enhance security and reduce the chance of a data breach by 50 percent. Additionally, the study reveals that implementing a Zero Trust security strategy yields a three-year 92 percent return on investment (ROI) with a payback period of less than six months. These organizations also reported significant efficiency gains (50 percent or higher) due to improved security processes.
So what is Zero-Trust Security and Architecture?
The NIST SP 800-207 document spells it out like so:
Zero trust is a cybersecurity paradigm focused on resource protection and the premise that trust is never granted implicitly but must be continually evaluated. Zero trust architecture is an end-to-end approach to enterprise resource and data security that encompasses identity (person and non-person entities), credentials, access management, operations, endpoints, hosting environments, and the interconnecting infrastructure. The initial focus should be on restricting resources to those with a need to access and grant only the minimum privileges (e.g., read, write, delete) needed to perform the mission. Traditionally, agencies (and enterprise networks in general) have focused on perimeter defense and authenticated subjects are given authorized access to a broad collection of resources once on the internal network. As a result, unauthorized lateral movement within the environment has been one of the biggest challenges for federal agencies.
The Trusted Internet Connections (TIC) and agency perimeter firewalls provide strong internet gateways. This helps block attackers from the internet, but the TICs and perimeter firewalls are less useful for detecting and blocking attacks from inside the network and cannot protect subjects outside of the enterprise perimeter (e.g., remote workers, cloud-based services, edge devices, etc.).
Honestly Zero Trust is so much more than a new cybersecurity buzzword over the past couple of years.
An operational perspective of the Zero Trust definition is:
Zero trust (ZT) provides a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as compromised. Zero trust architecture (ZTA) is an enterprise’s cybersecurity plan that utilizes zero trust concepts and encompasses component relationships, workflow planning, and access policies. Therefore, a zero trust enterprise is the network infrastructure (physical and virtual) and operational policies that are in place for an enterprise as a product of a zero trust architecture plan.
The Unclassified DoD definition of Zero Trust Reference Architecture can be found here: https://dodcio.defense.gov/Portals/0/Documents/Library/(U)ZT_RA_v1.1(U)_Mar21.pdf
Zero Trust strategy can help to prevent data breaches
“Zero Trust has become the essential security strategy for successfully preventing data breaches and mitigating risk in today’s complex cybersecurity landscape,” explained Vasu Jakkal, CVP of Security, Compliance and Identity. “These customers were able to improve their security posture, reduce costs, achieve greater business agility, and increase efficiency in managing security.”
