What is Zero Trust?
Zero Trust is a modern security model founded on the design principle “Never trust, always verify.” It requires all devices and users, regardless of whether they are inside or outside an organization’s network, to be authenticated, authorized, and regularly validated before being granted access.
In short, Zero Trust says “Don’t trust anyone until they’ve been verified.”
Zero Trust helps prevent security breaches by eliminating the implicit trust from your system’s architecture. Instead of automatically trusting users inside the network, Zero Trust requires validation at every access point. It protects modern network environments using a multi-layered approach, including:
- Network segmentation
- Layer 7 threat prevention
- Simplified granular user-access control
- Comprehensive security monitoring
- Security system automationWith the rise of remote work, bring your own device (BYOD), and cloud-based assets that aren’t located within an enterprise-owned network boundary, traditional perimeter security falls short. That’s where Zero Trust comes in. A Zero Trust architecture (ZTA) is designed as if there is no traditional network edge, retiring the old castle-and-moat model of perimeter security.
In essence, Zero Trust security not only acknowledges that threats exist inside and outside of the network, but it assumes that a breach is inevitable (or has likely already occurred). As a result, it constantly monitors for malicious activity and limits user access to only what is required to do the job. This effectively prevents users (including potential bad actors) from moving laterally through the network and accessing any data that hasn’t been limited.
Zero Trust security can be applied in multiple ways depending on your architecture design and approach.
Three Core Principles
Zero Trust is an integrated, end-to-end security strategy based on three core principles.
• Never trust, always verify— Always authenticate and authorize based on all available data points—including user identity, location, device, data sources, service, or workload. Continuous verification means there are no trusted zones, devices, or users. Instead, Zero Trust treats everyone and everything as a potential threat.
• Assume breach— By assuming your defenses have already been infiltrated, you can take a stronger security posture against potential threats, minimizing the impact if a breach does occur. Limit the “blast radius”—the extent and reach of potential damage incurred by a breach—by segmenting access and reducing your attack surface, verifying end-to-end encryption, and monitoring your network in real time.
• Apply least-privileged access— Zero Trust follows the Principle of Least Privilege (PoLP), which is the practice of limiting access rights for any entity and only permitting the minimum privileges necessary to perform its function. In other words, PoLP prevents users, accounts, computing processes, etc., from having unnecessarily broad access across the network, which leaves your network vulnerable and creates a higher attack surface in case of a breach.
Benefits of Zero Trust
An effectively implemented Zero Trust model should go beyond security. It should enable businesses to operate more effectively, enabling secure, granular access for everyone, including:
• Decreasing infrastructure complexity
• Working in hybrid physical and cloud environments
• Working with a variety of different devices and in different physical locations
• Complying with internal and regulatory standard
Virtual private networks (VPNs) often struggle to keep up with the complexity of modern tech environments. And although Zero Trust and VPN are not mutually exclusive, many organizations find that VPN is unnecessary after the adoption of a Zero Trust model.
VPNs offer perimeter-based security that provides network-wide access; in contrast, ZTNAs grant access only to specific resources after verification and authentication. Compared with VPNs, ZTNA strengthens security around internal and external networks by reducing the attack surface and implementing more granular control. Additionally, ZTNA offers increased flexibility and scalability, improving resource utilization and reducing the strain on IT.
This makes ZTNA a great option for CISOs and IT leaders looking for a security solution that addresses the needs of an increasingly remote and distributed workforce.
How to Achieve Zero Trust
Zero Trust implementation won’t happen overnight. Often, existing infrastructure can be integrated into a Zero Trust approach, but to reach maturity, most networks will need to adopt and incorporate additional capabilities and processes.
Fortunately, transitioning to a mature Zero Trust architecture can occur one step at a time. And in fact, incrementally adopting a Zero Trust security posture can reduce risk as improved visibility enables the organization to adapt to meet threats as they emerge. Follow a strategic plan to adopt Zero Trust as part of a continually maturing roadmap.
From the initial planning to basic, intermediate, and advanced stages, your Zero Trust maturity model should help you improve cybersecurity protection, response, and operation over time.
Migrating to ZTA requires a thorough understanding of your network architecture’s current state, including all its assets (both physical and virtual), subjects, and business processes. If this information is incomplete, you will have blind spots in your network security—particularly if there are unknown “shadow IT” components operating within your ecosystem.
By conducting a comprehensive audit and analysis of your network’s current state, you can then map out what steps need to be taken to optimize the network for ideal ZTA.
The Cybersecurity and Infrastructure Security Agency (CISA) describes a Zero Trust Maturity Model enterprises can follow based on the key defensive pillars listed earlier. Additionally, it citesgovernance, how you control and direct your security strategy, as another key part of a mature ZTA foundation.
CISA’s model represents a gradient of implementation across those key pillars “where minor advancements can be made over time toward optimization.” Organizations can take isolated steps focusing on one pillar at a time, with each category progressing at its own pace until cross-coordination is required. This model supports gradual evolution toward Zero Trust, distributing costs and resources over time, and easing the burden of implementation.
The National Institute of Standards and Technology (NIST) has outlined six steps for migrating to a Zero Trust architecture.
- Identify Actors on the Enterprise.
Who are your subjects and users? In order for Zero Trust to work, your policy engine needs to know who your enterprise subjects are and their access permissions. Pay attention to users with special privileges, such as developers or systems administrators who are often given blanket access on legacy systems. Zero Trust should allow these users enough flexibility to perform their work while applying logs and audit actions to verify and validate access. - Identify Assets Owned by the Enterprise.
Zero Trust Architecture also needs to be able to identify and manage assets and devices. These assets include hardware components like laptops, phones, and IoT devices, as well as digital artifacts, such as user accounts and applications.Managing enterprise assets involves not only cataloging but also configuration management and monitoring. Your architecture should be designed to observe the current state of an asset in order to effectively evaluate access requests. - Identify Key Processes and Evaluate Risks Associated with Execution.
The next step is to inventory and rank your business processes and data. Business processes should inform how resource access requests are granted and denied.Your assessment will help you identify which processes to target first for ZTA migration. You may want to start with low-risk business processes as disruptions are less likely to negatively impact the rest of the organization. Then, you can migrate more complex and business-critical processes. - Formulate Policies for the ZTA Candidate.
Which services or processes you target for initial ZTA migration will depend on a number of factors, including:• The importance of the process to the organization
• The group of subjects affected
• The current state of resources used for the workflowAssess the value of assets and workflows based on risk. Consider all upstream resources, downstream resources, and entities that are used or affected by the workflow. These can all influence which assets are chosen as candidates for migration. - Identify Candidate Solutions.
Once you’ve identified a list of potential candidates, create and consider a list of solutions to implement Zero Trust strategies. Keep in mind the various Zero Trust principles and requirements as you determine which candidates are best suited for migration. - Initial Deployment and Monitoring.
When you’ve chosen a candidate workflow and identified which ZTA solutions you’ll be applying, you can start deployment. This will be an iterative process as you observe and monitor the new solution and update the workflow as needed.
As you build up your Zero Trust architecture and gain confidence in the process, you’ll enter a steady operational phase. While you will continue to monitor and make adjustments to the network and assets, you can start planning the next phase of Zero Trust deployment.
Zero Trust Best Practices
Rigorously enforce authentication and authorization—All resources must be verified and authenticated. This often includes using technologies like multi-factor authentication (MFA) to grant access rather than operating on implicit trust.
• Maintain data integrity— Measure and monitor the security of all owned assets to ensure data integrity and reduce cyber threats.
• Gather data for improved security—Regularly collect data from multiple sources, like your network infrastructure and communication to continuously adapt and improve your security posture.
• Consider every data source and computing device as a resource— Any device that has access to a network should be treated as a resource.
• Keep all communication secured regardless of network location— Location no longer carries implied trust. Users and devices connecting via external or internal networks must undergo the same security requirements to gain access.
• Grant resource access on a per-session basis— Enforce least privilege, requiring users to request access for each session.
• Moderate access with a dynamic policy— Protect resources with a transparent and dynamic security policy that adapts to the evolving needs of the network and its users.
