The primary reason zero trust security’s popularity has surged is the transformation of how we work. Remote and work-from-home workers have become the new norm after COVID shut down offices around the globe. Many businesses are now more reliant on cloud computing to allow their employees access to company data.

The other reason businesses are more interested in zero trust security is the rise in cybercrime. Companies must now face the challenge of protecting their data and distinguishing remote employees from cyber threats.

Companies must set up a “protect surface” which is made up of its most secure data, applications, assets, and services. The company then sets up a micro perimeter surrounding the protect surface and requires users to authenticate themselves whenever they cross it to access sensitive information. The barrier set up is a zero trust barrier, requiring everyone to prove who they are through biometrics or two-factor authentication. This idea of business processes, technologies, and policies that allow the management of digital identities is called identity and access management (IAM), and is a cornerstone of zero trust security.

Organizations should be working toward consolidating the systems mentioned above. Consolidating identity management reduces the size of the surfaces vulnerable to an attack because there is one point of entry. Their goal should be a decentralized identity structure that allows different organizational systems to retrace their steps to a single user more accurately.

A decentralized identity structure system would automatically perform provision, deprovision, modify access rights and make reports on all users in the system. Additionally, bulletproof policies, access rules and current MFA methods would protect the system much better.

Not very long ago, only highly secure government agencies and industries used the security measures we now take for granted. Everything now uses biometrics, from banking to unlocking a laptop to opening an office door with an RFID card.

Ironically, all this extra security has become a problem. As more security identities are created, the more likely an ID will be used for a breach. It increases the size of a company’s vulnerability to an attack.

Take the Colonial Pipeline cyberattack, for example, where hackers breached the security of the largest pipeline in the U.S. using a single compromised password. Authorities traced the hack back to an employee’s VPN, which was active but no longer in use. The employee had used the same password for multiple sites. In an unrelated data breach, the password was stolen and sold on the dark web. The Colonial Pipeline hackers used that password to breach the systems and wreak havoc on the pipeline, causing the entire pipeline to shut down temporarily.

Unfortunately, the hacked VPN account inside Colonial Pipeline Co. did not use MFA, zero trust security or any other consolidated identity management systems. This whole situation — and the $5 million ransom that was paid — could have been avoided.

A proper digital identity paradigm for organizations would include:

• A holistic solution for governing and managing digital identities
• The ability to manage identity governance
• Authentication assurance
• Zero trust security
• Proofing

Ideally, passwordless and straightforward user access and authentication with a consolidated identity management system should be most businesses’ online network security goals.