Zero Trust Assessment & Architecture

Your expert

Dr. Silvia Knittl is your expert for Cyber & Privacy at PwC Germany

Dr. Silvia Knittl
Director, Cyber Security & Privacy at PwC Germany
Tel: +49 151 1548-0524

Why organizations should rethink their approach to security

Traditional IT security is increasingly being weakened by rapidly advancing technological developments and new ways of working. The existing infrastructure and IT systems are often no longer reliable, and traditional perimeter-based security strategies do not provide comprehensive protection against today's cyber threats. The significant change regarding traditional IT security is caused by the following factors:

  • Organizations are integrating more and more services that are available on the Internet and that offer access over an untrusted network.
  • Access to corporate and cloud applications is becoming increasingly common using different end devices.
  • The different user groups, whether employees, externals, or service providers, are increasingly working in different geographical locations.

These diverse use cases increase the potential attack surface and result in new vulnerabilities that offer attackers new opportunities to grab valuable data or disrupt critical business processes and infrastructure. This increases the business challenges that companies face to protect critical assets, data, and resources. For this reason, IT and security leaders must seek modern, comprehensive solutions for their architecture and consider a fundamental change.

“With a zero trust architecture, you can protect your assets more efficiently to strengthen your cyber security. The new premise is Zero Trust and Always Verify, so trust no one and always verify or authenticate.”

Dr. Silvia Knittl,Director, Cyber Security & Privacy at PwC Germany

Zero Trust – Success Factor for a secured Digital Transformation

What is Zero Trust?

Zero Trust describes a cyber security concept for securing data and infrastructures that, in conjunction with appropriate security tools, control and monitor the state of the entire architecture and make intelligent decisions based on real-time information. The Zero Trust model is based on the principle "trust is good, control is better" and fundamentally distrusts all services, users and devices inside and outside a network. The goal is to minimize risk and eliminate internal and external threats. Zero Trust therefore requires comprehensive authentication and authorization, both internally and when accessing external networks. Thus, the Zero Trust model addresses the modern challenges of the digital transformation of the business world, including securing remote employees, personal data, hybrid cloud environments, and protection against cyber threats.

Why do our customers implement Zero Trust?

For companies, the digital transformation means that the number of critical business processes and systems that are essentially dependent on a functioning IT infrastructure is increasing. The network (intranet and internet) acts as a link that connects the ecosystem of customers, business partners, employees, applications, and data. This results in the increasing need for security solutions, which may also be provided via new service models such as the cloud. There are many reasons why customers are rethinking their current security approach and implementing Zero Trust.

Infographic about Enterprise Security Architecture by PwC Deutschland

For example, Zero Trust involves building highly resilient networks while leveraging existing technologies. Another reason companies should incorporate a Zero Trust approach into their security architecture is to reduce tool sprawl and traditional security costs. Thus, Zero Trust drives digital transformation, optimizes user experience, and promotes smooth interaction to improve customer loyalty.

PwCs Zero Trust Architecture Approach

Infographic about Enterprise Security Architecture by PwC Deutschland

Our Zero Trust architecture is based on the “verify all” principle. This means that guidelines or policies determine who can access what and when. In the architecture, policy administrative points, decision and enforcement points form the conceptual basis. This can be a single point gateway that strictly controls any attempt to access resources by devices or people (identities). Secure, location-independent access to resources and data is based on risk-related real-time decisions. The decision as to whether a user can interact with the requested resource is made individually for each individual request. All activities are monitored to determine deviations from a safe state and to enable corrections. The focus is not exclusively on the internal data centers of a company, as is the case with conventional security models, but also on access control and monitoring of data traffic to outsourced cloud, web, and IT services.

Our approach to your Zero Trust Security Architecture

Initial Zero Trust Maturity Assessment

Together, we assess the current level of maturity and the capabilities of your company about a Zero Trust transformation. We identify current challenges and gaps through technological analysis of currently deployed capabilities and assess their environment through information and documentation collection and review.

Definition of an individual Zero Trust Architecture

Provision and selection of a range of Zero Trust technology and architecture blueprints that can be customized to meet your organization's challenges and needs to design a suitable target architecture.

Roadmap & Technology Modelling

Determination of the desired end state through workshops, appropriate case studies and situational models created using the PwC Reference Architecture to develop a strategic and actionable Zero Trust roadmap to enable cost-effective planning and implementation.

Realization of the Zero Trust Target Operating Model

Our interdisciplinary expertise, key technology partnerships, and years of experience in defining target operating models for enterprises enable us to select a zero-trust model that is suitable for you and help you with implementation.

Why PwC for Zero Trust?

Confidence, Independence & Expertise

A successful Zero Trust implementation relies on data-centric security strategies, security policies, data classification standards, and identity and access management solutions. PwC has extensive skills in working with interdisciplinary teams, cross-border zero trust expertise and alliances with key technology providers to drive successful digital transformation in your company. Due to the manufacturer independence and the regulatory obligations, PwC guarantees a high degree of integrity and acts as an independent "Trusted Technology Advisor". With the following services, PwC supports your company in planning and implementing an individualized Zero Trust strategy:

  • Support in identifying critical or sensitive vulnerabilities within your enterprise architecture
  • Application of data categorization and classification and support in the implementation of data protection solutions and processes
  • Provision of architecture guidelines for the integration of Zero Trust into the security architecture and the coordinated enterprise architecture
  • Assistance in monitoring compliance with guidelines and regulations

Enterprise Security Architecture – The path to a secure enterprise architecture

The world is changing rapidly and so is the need for new technologies, which also increases the risk of digital threats. Therefore, the importance of cyber security is growing. Enterprise Security Architecture offers a holistic and preventive security approach that examines the current security architecture for vulnerabilities as well as potentials and develops a target model including measures.

Learn more

Follow us

Contact us

Dr. Silvia Knittl

Dr. Silvia Knittl

Director, Cyber Security & Privacy, PwC Germany

Tel: +49 1511 5480524

Oliver van de Kamp

Oliver van de Kamp

Senior Manager, PwC Germany

Stefan Hiebl

Stefan Hiebl

Senior Associate, PwC Germany

Tel: +49 1516 1580649