Zero Trust Security

Chapter 12 What About People?

What about people? They are everywhere, like ants messing around with our systems! Can we really say that we have implemented zero trust if we have not talked about the people that make up the organisation?

People, like any other system or protective surface, have a life cycle, from when they are first interviewed to when they leave or retire from the organisation. We have to protect the entire cycle of our people. Traditionally, security professionals have viewed people as ‘the weakest link’. This mindset, while common, is misaligned with Zero Trust. Instead of treating people as a vulnerability to be contained, we must recognise them as active participants in our security architecture. They represent both our largest attack surface and our most dynamic defence mechanism. A common mindset to have about people is ‘if we really want to protect the organisation, we need to put in technical controls, as nothing else will work, as we can not trust people not to click on links’. The problem with this mindset is twofold. First, it requires implementing so many controls that employees can’t effectively do their jobs. Second, it creates an adversarial relationship between security and employees. The other assumption is just to let people get compromised and instead have effective control in place in response to such an event. It is kind of like having the mentality of why have speed limits on the road, when we have seatbelts and airbags in cars to protect ...