A decade ago, an organization's cybersecurity posture was predicated on controls and defense mechanisms deployed at the perimeter—the physical network demarcations where security solutions keep malicious actors out while protecting internal users and IT assets from external threats.
With the advent of the cloud and continued developments in work from home (WFH), IoT proliferation, and a general expansion of attack surfaces, security models focused on protecting the physical network perimeter are becoming increasingly ineffective in thwarting cyber attackers.
For these reasons, previous security architectures in which all entities within a physical network perimeter are trusted by default are falling to the wayside; in their place, zero trust-based solutions emerging to protect organizations against increasingly sophisticated cyber attackers.
What is the zero-trust concept?
The term "zero-trust" was coined in 2010 by then Forrester Research analyst John Kindervag to describe a new security model that removes implicit trust from IT environments. Per zero-trust, all connections, and interactions to an organization's IT assets are continuously assessed and validated on-premises and in the cloud to ensure that entities are properly authenticated and authorized to access any requested IT assets/resources.
Not to be outdone, Google later introduced its BeyondCorp model for enterprise security—a zero-trust implementation that considers both internal and external networks completely untrustworthy. Since then, zero trust has been steadily gaining prominence in the information security industry as a leading security model for defending organizations against current and future cyber attackers.
Zero-trust and cybersecurity
At the core of the zero-trust concept are the principles of "never trust, always verify" and need to know. These two concepts—and the resulting security controls and measures—establish the specifics to which zero trust can be achieved in today's IT environments.
"Never trust, always verify" does away with the concept of trusted entities inside of the corporate network since the presence of any "internal/external" network demarcations have gradually dissolved with the cloud and edge environments. All entities are considered untrustworthy in this paradigm until proven otherwise through authentication/authorization. Need to know dictates that entities should have only enough access to a service or resources required for the task.
With these two pillars of zero-trust as guiding principles, security architects can implement protective measures for modern IT environments that enable safe innovation and protect against increasingly sophisticated cyber attacks. These measures may include stronger default authentication controls, network micro-segmentation to prevent lateral movement, and more granular "least privilege" access policies, to name a few.
Zero-trust for mitigating phishing attacks
The continuous rise in successful phishing attacks is why traditional security measures are waning in their efficacy against modern cyber threats. By exploiting vulnerabilities in human behavior (e.g., tricking recipients into clicking on a malicious link or disclosing privileged information), cybercriminals can circumvent traditional email security controls and gain a foothold inside their IT environment.
By implementing zero trust into their email servers/services, organizations are better positioned to protect their users against phishing attacks, adhere to compliance measures, and increase email deliverability.
Policies are central to the mechanics of zero trust, whether for creating micro-segmented environments to limit the spread of malware or for developing more effective email security controls. In the latter case, a zero-trust email security model would block messages not originating from authenticated senders with granular privileges (e.g., explicit sending permissions to a specific inbox/account).
Additionally, AI/machine learning can also determine the risk posture of incoming emails since authenticated senders can become compromised and malicious. Through zero trust, the risk postures of senders/emails are continuously measured to account for the shifting dynamics of the current cyber threat landscape.
Limitations of secure email gateways
Organizations typically employ secure email gateways (SEGs) to filter inbound/outbound email traffic for spam and phishing-related content. Despite being initially effective for improving email security, SEGs—like other traditional security approaches—are also waning in their efficacy.
Because they primarily work by scanning for flagged keywords and blacklisted URLs/domains, they are effectively implemented in "open trust" mode. Email is received and processed first before ascertaining whether the contents are malicious.
Additionally, cleverly designed emails can often elude email security scanners, potentially compromising legitimate email accounts. Most existing anti-phishing products rely heavily on blocklists and filters that can only detect/quarantine against known threats.
In contrast, zero trust-based email systems would block any emails from unauthorized recipients and analyze email contents for the more common/known threats. Dynamic email security controls ensure that emerging threats are blocked by continuously updating policies, informed by machine learning, natural language processing capabilities and other non-black list-based technologies.
The future of email security
In short, email security requires a zero-trust approach that incorporates a default "never trust, always verify" model coupled with advanced technologies like machine learning and natural language processing to ensure every inbound email is safe for recipients to open.
To this end, solutions like Egress Defend incorporate machine learning, natural language processing capabilities, advanced contextual analysis, and social graphs to flag malicious emails as threats to the user immediately.
