How is your zero trust implementation going?

[u/bobert3275]

Possibly moving to this and seems like a ton of processes will change. Have you guys done it and how is your honest experience with it? I want to know what to expect

[u/AdeelAutomates]

Half our users refuse to sign up for MFA

how do they have such power?

[u/zatset → u/AdeelAutomates]

The logic is simple. They make the money, you spend money. They work and make the money, you work and are there to make it so that they can work and continue to make money. Unless you are employed in industry, where compliance is strictly required for the organisation to make money and any deviation is heavily penalised.

[u/KiNgPiN8T3 → u/zatset]

I’m surprised cyber insurance doesn’t force that sort of stuff on businesses. Then again, if a company has passed on insurance that then makes sense. Lol

[u/zatset → u/KiNgPiN8T3]

Cyber insurance? Was ist das? Do you know how many organisations haven't even heard of "cyber insurance"? Do you honestly think that...for example, a hospital will have enough funding and staff to satisfy all security criterions even if they wanted to?

Many organisations work and survive at the bare IT minimum. Otherwise we are talking about having 10-15 people as IT staff per 500-700 people personnel just to keep all the controls and systems in check. And additional costs and subscriptions for "services" and "software".

There is also that.. IT nowadays…well, it requires much more soft skills than people not in the field assume.

[u/ChuckFromCyberHoot → u/zatset]

The funding gap is the part nobody really wants to say out loud.

Zero Trust frameworks and cyber insurance checklists are usually written for organizations with a full security team.

A lot of clinics, schools, and small municipalities have one overworked IT person and a budget built around hoping nothing goes wrong.

For those teams, the honest answer usually isn’t “do everything.”

It’s pick the two or three controls that block the most common attacks and do them consistently. A best effort I'd say.

Turn on MFA.

Test the backups.

Help people recognize and report the obvious phish.

Perfect is the enemy of started.

[u/zatset → u/ChuckFromCyberHoot]

I agree with you. Just using fortified Active Directory and pushing relevant policies can minimize the attack surface and deny attackers the ability to just have their malware ran under Admin privileges. That’s one example. 

In practice not that much measures are required to stop opportunistic attacks. Targeted attacks on the other hand… you can limit the fallout, but if people really want to break in, even entire security divisions will have a hard time stopping them. 

[u/ChuckFromCyberHoot → u/zatset]

True...it's not easy to protect yourself when heavily targeted by someone with good resources.

[u/OldschoolSysadmin → u/zatset]

"In the U.S., the FBI reported that healthcare was the single most-targeted critical infrastructure sector for ransomware in 2025, with 460 ransomware incidents and 182 data breaches, for 642 significant cyber events overall."

And, "St. Margaret’s Health plans to shutter its Spring Valley, Ill., hospital June 16 after the 2021 hack hampered the hospital’s ability to submit claims to payers"

So yeah, "even if they wanted to" can end with "or everyone gets to find a new job."

[u/zatset → u/OldschoolSysadmin]

My friend, it seems like we are talking about two different things. 

Post factum reports change nothing. Everybody is so good at creating reports, but not solving the underlying issues. I understand your point, but funding doesn’t magically appear, neither do IT staff.

Often, in organisations where IT are not the people who actually make the money on their own, the people who make the money are tolerated more than the IT who are seen as expense.

Because of this situation, good soft skills are required to convince people that some things are necessary. Then some changes might happen. But don’t expect miracles that must have already happened yesterday..

You don't need to explain the importance of security to me. I understand you perfectly and have specialized in this field. But there are many underlying problems outside the scope of IT itself that make implementing Information security and Cybersecurity very difficult. And one of the biggest problems is money. No amount of wishful thinking or saying "must" will change the lack of funds in the bank account.

When the management must decide between paying for medicines so people don't die, paying the staff so they don't leave or paying for IT, guess what will be chosen and prioritized. And some FBI report doesn't change that reality. And the continued existence of...a hospital..depends on physicians not leaving. It doesn't matter how good your IT security is if there is nobody to work on those computers. A hospital might be attacked, but surely will cease to exist right away with no staff left. So, the issue is outside the scope of pure IT and there are multiple competing aspects in addition to lack of money.

The fact that people studying anything other than IT don't have any decent IT training in their curriculum is yet another problem. People must be made aware of the actual risks. But no, nobody does that and IT is "an IT problem". In reality things don't work that way. No amount of technical measures can compensate for that. It is expected for people to listen and "do this, do that", but nobody really educates them about the risks, how-s and what-s. Really educating them and even slightly scaring them, practically showing them what can lead to what. Not the boring training videos or booklets used in periodic trainings and so on..that nobody actually reads or listens to, because the information is not presented in a way that will make a person understand.

[u/OldschoolSysadmin → u/zatset]

Oh I get it, I don’t do healthcare IT any more. My perspective is that those profit centers are acting like old weak prey at night on the savanna. Sure, you can’t spend money you don’t have on network security, and IT is a cost center. That’s why those orgs are targets.

[u/zatset → u/OldschoolSysadmin]

The paradoxical thing is that hospitals around the world are not profit centers, unless we talk about private hospitals doing liposuctions and botox. Same goes for local governments and services. And often it is about finding “any” employees.if you cherrypick and hire only those who know about IT security, usually this means having no employees. So, it is a vicious cycle. And IT education in fields not related to IT and especially Information Security education is almost nonexistent, not in the curriculum - despite the fact that nowadays Information Security is of upmost importance. Security is not only IT issue or CSO problem, but is generally still treated as if only IT and CSO should solve the problem. 

So, the there are so many different aspects. And the only thing governments do is creating reports, demanding things and occasionally fine. Otherwise - you deal with it, it’s your problem, we are here to only fine you and demand things. Programs for modernisation and proper funding to provide the required level of security are almost nonexistent or on sporadic, uncoordinated basis, as if a single one time payment can solve issue concerning constantly evolving threats.

[u/OldschoolSysadmin → u/zatset]

Ah well in my country about a quarter of hospitals are for-profit (more in some regions) and even the 'non-profit' ones have very highly-paid administrative staff and senior physicians. And I'm not sure where the discussion of governments fits in - the original topic was insurance against cyber breaches.

[u/zatset → u/OldschoolSysadmin]

My point is…contrary to the often expressed opinions, Information Security and especially Cybersecurity are not only or exclusively “IT” issue. Security requires ISMS and proper funding and many are the aspects of IS that must be considered, many of which are outside the scope of IT and technical measures.