Unfortunately, Zero Trust has become a bit of a marketing slogan for all things cybersecurity-related, but that’s diverting focus from what it is and why it’s important. Zero Trust is more of a philosophy than it is a technology, it’s a mindset that your organisation needs to adopt for cybersecurity technologies to work. Zero Trust operates around a central mantra of “Never trust, always verify”, meaning that for someone or something to be able to access something else it must first prove who it is, why it needs access and that it meets all the security requirements to have access granted to it. This approach replaces the traditional “trust but verify” security model which relies on the assumption that all internal actors are trusted until proven to be malicious. In a Zero Trust environment, you start by assuming that every actor is hostile, so each request must be verified.

The Zero Trust mantra of “Never trust, always verify” can seem quite vague and often results in an implementation that’s difficult to define and even more difficult to execute. So, to make it simpler, break it down into more digestible bite-sized principles.

What are Zero Trust Principles?

You may read that there are five or even eight Zero Trust principles, but they can be distilled down to these three core Zero Trust principles:

1. Enhanced device visibility and segmentation
2. Strong identity-based access controls
3. Ability to secure endpoints everywhere

Those principles are then defined as policies and continually policed by a mixture of software and appliance-based agents.

Essentially, if a person or device can prove who or what they are, that they have a legitimate need to access something and that they can do that securely the access should be allowed, otherwise, it should be denied.

Enhanced Device Visibility and Segmentation

Trust has to be earned and for devices or endpoints that means they must be visibly compliant with the standards required by whatever they are attempting to connect to. Compliance is whatever the organisation defines as required and can differ by segment and may include things like whole disk encryption, joining to a domain, having the latest version of any agent and current policies plus any other specific requirements.

Perimeter networks intrinsically assume that the threat originates outside the network, which is why most perimeter security solutions (IPS/IDS/Firewalls) focus only on in-out traffic. However, over three-quarters of network traffic is internal server-to-server, which is largely invisible to security teams. Any threat which is already inside the network can move laterally and remain undetected for days or even months.

To make policies easier to implement micro-segmentation is used to define logical groups of devices and people. Those segments then have specific requirements attached to them, so for example, if some device that’s in the finance segment wants to access some engineering drawings in the engineering segment then it’s likely that there would be no policy to allow that and consequently, the access would be denied.

Strong identity-based access controls

Identity has to be proven and not just for people but also for devices or endpoints. That identity has to be proven in a way that cannot be forged, so it will need to employ some form of trustable authentication mechanism. For people that will be in the form of multi-factor authentication to generate a trusted access token, which is only valid for a certain period of time or even just a single transaction. For endpoints, whether they’re servers or computers or other devices they will combine hardware-based factors like chip serial numbers, TPM (trusted privacy module) or HSM (hardware security module) information along with device name and other identifying factors.

Ability to Secure Endpoints Everywhere

In order for Zero Trust to be effective, every endpoint (appliance, desktop, IoT device, laptop, phone, server, tablet) must be secured, be capable of reporting its compliance to the security standards and be capable of securely communicating with the network and other devices it needs to connect to. Different levels of security requirements can be required depending on the role and what the device needs to communicate with and in what way. So for some devices, the security requirements will be quite minimal and for others, the requirements will be extensive.

Benefits of Zero Trust Architecture

One of the main benefits of implementing a Zero Trust network is that it can help businesses prevent data breaches and other security incidents. By always assuming that external networks and actors are untrusted, the organization can take steps to verify the identity of users and devices before granting them access to its network and data. This can help to prevent attackers from gaining unauthorized access to sensitive information or systems.

In addition to the improved security posture, Zero Trust provides additional benefits such as reduced complexity, improved visibility, and improved compliance. By leveraging a comprehensive security posture, organizations can reduce the complexity of their security infrastructure and become more efficient in managing the security of their systems and data. Additionally, organizations can gain improved visibility into their security posture and become more effective in detecting and responding to potential threats. Finally, Zero Trust helps organizations become more compliant with industry standards and regulations such as GDPR, HIPAA, and PCI.

Overall, Zero Trust Architecture provides organizations with a comprehensive security posture that is both proactive and adaptive. It helps businesses reduce their attack surface, improve their security posture, and become more efficient and compliant.

Pros of Zero Trust Network Architecture:

• Zero trust networks strictly limit access to data, resources, and users based on their identity, ensuring that only authenticated and authorized users have access to data.
• It provides an extra layer of security by verifying user identity at each step of the network, reducing the risk of a malicious actor gaining access to sensitive information.
• It can provide better visibility into user activity, allowing organizations to quickly identify suspicious activities.

Cons of Zero Trust Network Architecture:

• Zero trust networks require a higher level of user authentication and authorization than traditional firewalls and intrusion prevention systems.
• It can be difficult to implement and manage, especially if the organization does not have the resources or personnel to do so.
• It can be expensive to implement and maintain, which may not be feasible for some organizations.