If you’ve studied the reference architectures, read the BeyondCorp whitepapers, poured over strategies and fan charts, or tried to plot your position in any of the (many) Zero Trust maturity models and found yourself inspired by the concepts but puzzled by the process, you’re not alone.

If the sheer number of Zero Trust something-or-others available from cybersecurity vendors filled you with skepticism and made you wonder whether the whole endeavor was just “expense in depth” with a catchier title, you’re in good company.

If the wave of 2.0 announcements and “innovations” seemed unconnected to widespread (and successful) implementations of 1.0, well…

Does that mean that Zero Trust was nothing more than a flash in the pan all along? No. But there’s no doubt that Zero Trust fatigue is real or that perfect has become the enemy of good for many organizations.

Keeping up with the Joneses

The highest profile, most sophisticated Zero Trust initiatives had something in common: they were undertaken by organizations whose technical and financial resources were effectively infinite, especially relative to the average enterprise. These programs lent credence to Zero Trust as a viable approach to security strategy. They also created a perception that adoption would necessarily involve sweeping changes and a lot of new technology (accompanied by the usual costs). These conditions may not have directly disincentivized Zero Trust, but they raised the stakes in ways that left many organizations perpetually admiring the problem instead of taking steady, incremental action.

Fits and starts

The advent of Zero Trust Network Access (ZTNA)—or, in more explicit terms, remotely-hosted remote access with multi-factor user authentication and device posture checking—was the first genuine step on most organizations’ Zero Trust journeys. It was also where a lot of initiatives stalled. To be clear: it was an important step; it was not, however, a precursor to an obvious next step.

There are still internal and external pressures to “improve Zero Trust maturity” but that is very much a “what” and not a “how”. Vendors and enterprises alike seemed to treat it like the titular character in the Beetlejuice movies: if they repeated the name enough times (and tacked on enough new adjectives for good measure), Zero Trust would somehow magically appear.

Making Zero Trust real without breaking the bank

So what should organizations do? A lifetime ago (in technology terms, at least), my predecessor’s predecessor (we’re careful about name-checking former analysts around here, lest their specters reappear like the aforementioned Beetlejuice) wrote about an undertaking he called Zero Trust On A Beer Budget. It was an exercise in making reasonable investments that would help build security capabilities without outlandish budgets or the sorts of big, risky swings that doom projects to failure during implementation or subsequent operation.

It’s time to put a finer point on that idea. Rather than leaning on abstract reference architectures and high-level maturity models for guidance, it’s time to start thinking more about how to implement Zero Trust with the least amount of effort while still satisfying its tenets. We’re christening this pivot “Minimum Viable Zero Trust (MVZT).”

We’re borrowing a bit from the idea of a Minimum Viable Product (MVP), not because Zero Trust is a product, but because MVPs are helpful for learning by building and Zero Trust is a way of building. MVPs are also deliberately less resource intensive than massive, cross-functional efforts. Lastly, MVPs help establish guideposts on the path of what to build next. To be clear: I’m not suggesting that you should “roll your own” solutions, but one of the greatest myths about Zero Trust is that implementing its principles requires the procurement of new technology.

MVZT is about leveraging what you have and overcoming the very real—and sometimes very difficult—systems integration challenges so you can make the most out of your current and future security investments.

Join me in Washington, D.C. on November 9th and 10th at Forrester’s Security & Risk Forum for a deep-dive session introducing Minimum Viable Zero Trust, where I’ll talk about what the journey really entails, how to get started using tools you already have, and some elbow grease.

Share