Zero Trust doesn´t replace anything
Jun 17th, 2019 by Jesper Kråkhede
I get the question surprisingly often: ‘If we go for Zero Trust, can we get rid of the firewalls?’ Short answer: No.
Zero Trust is not a new religion that makes everything before it obsolete. It is an extension of the security we have always done. Defense in depth, least privilege, separation of duties, logging. None of that is new and none of it goes away. What Zero Trust does is to remove the one assumption that has been hurting us for years: that anything inside the network can be trusted.
The firewall is still there. It just isn´t the only one making the decision anymore. The identity, the device and the context gets a say as well. Your patching, backups and incident response are still needed, probably more than ever.
The danger of treating it as a competitor is that it becomes a political fight. The network group defends their turf, the identity team builds their own thing and the money is spent twice without the two talking to each other. I have seen that movie before and it doesn´t end well.
Start with what you have, add verification on top and let the old and the new strengthen each other. That´s Zero Trust.