What Is Zero Trust?

First designed in 2010, the zero trust cybersecurity model assumes that every user—whether internal or external—could be malicious. Therefore, every request for network resources must come from an authenticated, authorised and validated user. The zero trust networking architecture is designed to increase cybersecurity posture and reduce the risk of a data breach or compromise.

The strategy behind a zero trust security model is “don’t trust anyone or anything”. It shifts an organisation’s way of thinking about the security of network resources. Traditionally, authenticated users were automatically trusted when they queried network resources. Internal applications within the network were also trusted with little validation after a connection was made. Because internal users and applications were trusted by default, an attacker with access to accounts or application requests could steal data after a compromise and move laterally across the environment.

The zero trust architecture model works differently from a traditional architecture by continually validating user authentication and authorisation for every request. Should the organisation have an application that requires data access, it too must be validated before allowing the application to retrieve or edit data.

Older security architectures are often referred to as a “castle and moat” setup. External users were never trusted and were blocked from accessing the internal network. But once users authenticated, they could traverse the network and access any resource provided they had authorisation. When an attacker gains access to a user account or compromises the network, they have no additional limitations or security to block them from traversing the network to find data and access additional resources.

With the newer zero trust architecture, resource access policies validate users even if they are already authenticated. Users and applications are continually validated, and firewalls segment the network into logical parts to block from traversing the environment. A few common components in a zero trust network include:

• All applications, data resources and network components have security controls.
• All communication is protected with encryption.
• Every request for a resource is validated. Subsequent requests are validated again.
• Access to resources is built around security policies. Behaviour patterns and traffic are monitored and analysed for potential threats.
• All resources have the highest security settings possible and the organisation monitors traffic and user behaviour for anomalies.
• Authentication for every user is dynamic and always enforced. The organisation scans for threats so that the environment can adapt to changes.

Zero trust architecture features several traditional security components. But the way it’s designed and used is different from older models.

An organisation that implements zero trust architecture employs multifactor authentication, identity management, endpoint security for mobile devices, monitoring systems, workload management and maintenance. All communication internally and externally is protected with encryption; sensitive data storage might also be encrypted.

Because many organisations use cloud-based infrastructure and software, traditional models that trust users by default are no longer viable. While a traditional network can block requests from the cloud, it can’t discern between authorised and unauthorised requests. With a zero trust network, cloud resources can be integrated with internal resources and continually validated to avoid unauthorised requests.

An organisation that works with a zero trust architecture model must be aware of all resources and users across the environment, including in the cloud. The model ensures that administrators have complete visibility over the entire environment. Administrators enforce zero trust by using:

• Programmatic and manual human credential validation.
• Authorised validation on each device.
• Monitored and authorised connections between user and device.
• Authorisation based on endpoint hardware and function.
• Geolocation validation and monitoring.
• Firmware monitoring.
• Authentication protocols and risk assessments.
• Operating system versions, updates, and patch management and monitoring.
• Recognition of suspicious activity and cybersecurity incidents.

Because every request is evaluated, the zero trust architecture model offers several benefits. Overall, an organisation decreases risk and more effectively protects sensitive data. It also gives administrators more visibility over data and resources, so fewer network resources fall through the cracks.

Benefits of a zero trust model include:

• Greater visibility across the entire network. Administrators better understand business processes, data workflows, users and user privileges and all risks associated with these components.
• Simplified IT management. The analytics and automation associated with a zero trust model reduce IT staff overhead and enables proactive issue detection.
• Security optimisation. Centralised monitoring and analytics empower staff to make better decisions and implement protections specific to the organisation’s environment needs.
• Improved data protection. Zero trust limits internal access to data, so the organisation reduces risk from internal threats and privilege-escalation attacks.
• Better security for remote users and devices. Endpoint protection includes security and data encryption on mobile devices, so these endpoints do not threaten internal network resources.
• Streamlined user authorisation. Instead of VPNs, a zero trust model involves cloud resources and faster access to resources as administrators create policies that apply to defined job functions.
• Compliance. Ensuring compliance is a struggle for most organisations. A zero trust model centralises security management and provides better security management so that data access is always compliant.

Beyond these benefits, a zero trust model also helps administrators identify specific attacks and alerts them when monitoring and analysis systems detect anomalies. A zero trust architecture also helps administrators respond to and contain incidents faster, including:

• Phishing emails, including spear phishing.
• Lateral movements across network resources.
• Shell execution on servers and other network components.
• Credential theft and misuse.
• Database compromise either from credential theft or application vulnerabilities.
• Hacked application.
• Privilege escalation.
• Device physical compromise.
• Keyloggers and data eavesdropping.

As with any enterprise security implementation, a zero trust model comes with challenges. These must be considered when deciding to migrate current systems to a zero trust architecture. Every organisation has its unique requirements, so challenges depend on its architecture plan and design.

Here are a few specific challenges of deploying a zero trust model:

• An identity access management (IAM) system. IAMs make managing resources more efficient. But changing current authentication and authorisation systems takes time and effort.
• Identifying all vulnerabilities and risks. After deployment, an organisation still needs to identify threats and vulnerabilities. Any existing ones could still harm data security.
• Limiting downtime and user frustrations. During migration, it’s essential to find a method that limits downtime to not interfere with productivity.
• Planning and design. Before implementation, administrators must create a good plan for migration from older systems to newer current zero trust model systems.

Administrators can choose a preferred vendor when deploying zero trust, but the technology must follow standards set out by best practices. Administrators must also properly configure the technology for it to be effective.

Components in a zero trust network include:

• Policy engine. This engine drives the rules for authorised access across the environment.
• Security information and event management (SIEM). A SIEM is a system that collects cybersecurity events and helps administrators review and detect anomalies and potential threats.
• Identity access management (IAM). An IAM manages authorisation and authentication control for every resource.
• Firewalls. Segmenting the network between logical groups of business functions limits risk and blocks access to other segments should an attacker compromise one segment.
• Multifactor authentication (MFA). Instead of a single way to log in using a password, users must enter a PIN or biometrics to access the system.
• Encryption. All data should be encrypted regardless of whether external or internal.
• Analytics. An analytics system will help administrators determine vulnerabilities and detect ongoing attacks.

The zero trust model is governed by strict principles that security experts and administrators should follow to ensure infrastructure efficiency. For outside consulting, the organisation should look for a service that follows these principles:

• Monitoring. Extensive logging and monitoring feed analytics systems so that administrators can review environment efficiency and detect anomalies.
• Least Privilege. The Principle of Least Privilege says that users should have access to only the resources necessary to perform their job functions.
• Device access. Not only are users authenticated on the network, but device access is also heavily monitored and must be authorised.
• Segment network zones. Instead of one large network where all network traffic co-mingles, the network should be separated into security zones to protect sensitive data within each zone.
• Multifactor authentication (MFA). The system should require a secondary method of authentication instead of a single password.

Before an organisation decides whether they need a zero trust architecture, they should consider use cases that apply to their unique needs and pain points. Changing the infrastructure and security processes can be a major undertaking for administrators. Still, several use cases underscore the benefits and reasons to switch to a zero trust model.

Here are a few common use cases for zero trust:

• Remote and hybrid users. At-home workers add significant risk to the organisation and its data, but a zero trust network limits the risk of compromise by continually validating access.
• Third-party vendors. In many cases, third-party vendors are integral to the organisational supply chain, so they need access to some data. The zero trust model limits access to only the data necessary for vendor job functions.
• IoT protection. Manufacturers often use IoT to manage machinery. A zero trust model protects the network from threats.

Before rolling out policies and infrastructure, administrators should follow several best practices to streamline the process and ensure that a zero trust architecture is set up effectively. By employing best practices, the organisation can reduce downtime and struggles. Every organisation has its own requirements, but a few general best practices to follow are:

• Define resources for protection. Before protecting resources, administrators need to know which ones could be at risk. Auditing resources help lay the foundation for deploying security measures.
• Map data flows. Where will data be stored, and where will it be transferred? By mapping data flows, administrators can identify where to apply encryption.
• Find a zero trust architect. If the organisation doesn’t have on-staff consultants familiar with the zero trust model, it might be necessary to find outside consultants to help.
• Create policies around least privilege. With users and resources audited, administrators can build effective authorisation policies that follow least privilege principles.
• Set up monitoring and logging. The environment must be monitored for complete protection and compliance with regulations. Monitoring is a proactive approach to defend the network against threats.