IoT Security and Zero Trust Security in the Consulting Area

Zero Trust is a security framework requiring all users, whether inside or outside the organization's network, to be authenticated, authorized, and continuously validated before being granted or keeping access to applications and data, in order to ensure proper security configuration and posture. Today industries rely on Internet-of-Things (IoT) devices to automate processes, improve service delivery, bring user convenience and innovation in people's lives. As a result, IoT Security has become an increasingly crucial subject nowadays. Security in this field inherently becomes something requiring management through innovative and technical approaches to protect enterprise infrastructure and business applications. At Deloitte Switzerland both topics have been studied and put in practice in order to help clients enhance their business activities and improve their security infrastructures. The aim of this thesis is to describe the core elements and the main idea that underpin IoT and Zero Trust security, while uncovering strengths and weaknesses of these solutions. Furthermore, such topics will be analyzed from the perspective of the companies that are trying to adopt them, describing challenges and benefits that technicians are experiencing during the entire deployment process. Finally, the principles and claims previously expressed will be reviewed through two case studies depicting an IoT and a Zero Trust security assessment and development.