Zero Trust Explained: What is Zero Trust Security?

Key takeaways about Zero Trust

• Zero Trust isn't a technology. It's an approach
• Zero Trust extends beyond the traditional network perimeter
• Zero Trust tenet is not trusting even your own network
• Zero Trust Architecture offers practical implementation of the Zero Trust concept
• Zero Trust Architecture is better adapted to tackling modern cyber threats
• Zero Trust Architecture can be expanded to offer customized security solutions

Zero Trust approach

Zero Trust is a security approach that eliminates implicit trust in internal and external networks. It enforces mandatory checks at each access step, keeping network controls tight.

The Zero Trust scheme assumes that all network traffic is untrustworthy regardless of origin. Connections coming from the inside of your network could be just as malicious as those coming from the outside.

As a modern enterprise's IT infrastructure is large in scale, it can be very challenging to oversee everything in the network. In addition, the fact that a device is already inside your perimeter says nothing about the user's intentions. The Zero Trust method enforces stricter controls for each user, independent of the connection's source.

In this framework, scrupulous authentication and re-authorization of each data access is the primary line of defense. It's a radical shift from previous perimeter-based security models that trusted connections based on their network location. As digital transformation expands the network to the point where its boundaries are no longer clear, the perimeter as a fundamental component is largely obsolete.

Three core components of the Zero Trust approach can be highlighted:

1. Verification before trust — every time a user or a device makes a connection, it’s essential to verify its access rights.
2. Least privilege rights — users should be granted a bare minimum of access rights, increasing them only if required to perform their job.
3. Plan for the worst-case scenario — think of a data breach as a real threat and shrink the total attack surface to a minimum.

When applied in practice, the Zero Trust methodology allows the delivery of perimeter-less infrastructure much more secure in the current threat landscape. It enables the delivery of high-security network access services for organizations of all sizes.

This approach adapts well to any IT infrastructure and can drastically improve access controls of highly sensitive data. It may also be important when staying compliant with regulatory requirements. Ease of integration and improvements in network visibility are the key benefits of the Zero Trust approach.

Zero Trust Architecture

Zero Trust Architecture (ZTA) puts Zero Trust principles in the practical framework for IT infrastructure planning. Using Zero Trust as a core design philosophy, various network components are added to implement mechanisms for strict access control. ZTA rejects traditional network perimeter and offers a more flexible alternative without emphasizing assets or network location.

Some requirements apply when building a ZTA network:

1. Only secure connections can access internal resources

Technologies like VPN can help encrypt data in transit to ensure that it’s not hijacked during exchanges.

2. Need-to-know basis for access control

Granting only limited access rights prevents privilege escalation.

3. Authentication at all access levels

Users should pass authentication when accessing the network and pass additional checks during specific data requests.

4. Network monitoring

Everything transpiring within your network should be monitored to detect suspicious activity.

5. Inside-out network sequencing

Network infrastructure planning should start with tight controls from within the network, expanding its rules to the outside connections.

These components work in tandem to filter out untrustworthy connections by adding additional checks. This makes it much more difficult for bad actors to stage an attack and infiltrate the internal network. Even when the perimeter is breached, there’s a limit on how much data could be accessed due to multi-level authorization checks.

Emerging trends like bring your own device (BYOD) and remote work policies functioned as a catalyst for ZTA’s popularity. Its traditional architecture is moving away as users connect from outside the perimeter. As of 2021, the United States government-mandated requirements for ZTA implementation across all government departments. The framework can also be helpful when addressing regulatory compliance requirements for companies handling sensitive data.

ZTA is a much more future-focused approach that is likely only to expand in the following years. Its adoption will likely play an important role when countering threats from within and outside the organization.

Components of Zero Trust

In 2020, NIST released a special document outlining the model of Zero Trust Architecture. The document describes what to focus on when building a ZTA and its founding components. Zero Trust can be achieved by focusing on suggested methods:

• Relying on software-defined perimeter
• Segmenting the network and applying separate policies and access rules
• Implementing context-based identity verification and adjusting access privileges

Three core components of any ZTA network include:

• Policy engine — allows or denies the user access to company resources.
• Policy enforcement point (PEP) — supervises the existing connections between a user and company resources.
• Policy administrator — an intermediary between policy engine and PEP. It sends commands to PEP depending on the policy engine’s decision.
  
  

It’s not necessarily the case that each component should act as a separate entity. All of them can be consolidated into a single asset. The opposite can be true, and several different assets could handle one component.

The ZTA model also relies on six pillars to base its model.

Pillar #1 — Users

Users are a key Zero Trust strategy element as they could serve as a gateway for cyber attacks. Diligent evaluation of employee access rights is a key step to building a solid defense against threats. Within the Zero Trust framework, the goal would be to restrict users’ access without interfering with their day-to-day tasks. This also needs strict and efficient authentication tools and continuous monitoring to keep tabs on access rights.

Pillar #2 — Devices

The expanded network perimeter and emergence of IoT devices are huge threats to internal network security. Zero Trust network should have high control over every connected device on the network, possibly revoking rights if they threaten the company’s security. Whether a secure device should include its software versions, protection status, encryption enablement, etc. Methods like allowlisting serve as good tools to allow only specific devices into the company’s network.

Pillar #3 — Network

Network administrators should be able to segment internal networks into smaller subsections to ensure better oversight and control. Only specific users that need access to certain resources should be allowed. It should reflect the transition from perimeter-based systems to data-focused networks. With micro-segmentation and data-focused approaches, the network perimeter is still there, emphasizing the end-user and its access.

Pillar #4 — Applications

Used applications should be monitored and their execution controlled within the company’s network and the cloud. Controlling access at the application level is paramount when implementing the Zero Trust model. Each such component used within an enterprise is a potential attack vector and shouldn’t be taken lightly.

Pillar #5 — Automation

Leveraging orchestration and automation is one of the most important tools when detecting suspicious behavior or real-time threats. Automated processes free up admins’ time to spend on other, more complex tasks. Flagging something invites immediate action-response, meaning the incident response time is faster and avoids manual monitoring and supervision.

Pillar # 6 — Analysis

Various tools like security information management systems (SIM) or security user behavioral analytics (SUBA) provide valuable insights into the company’s network. Better visibility, regardless of network location, device, and user count, also contributes to the company’s overall security.

Gathering such intelligence can help administrators to better prepared against various threats. That might make a huge difference as they’re not simply reacting to the already happening attacks but preparing in advance.

For users, it’s impossible to distinguish between the ZTA and conventional methods. All the work is done behind the scenes.

Types of Zero Trust solutions

There are two main types of ZTA setups: endpoint-initiated and service-initiated. Here’s how they’re different.

Endpoint-initiated

The information about each device’s security status is collected from each endpoint. It’s set up by deploying special software in all used endpoints that communicate with the broker as part of the authentication process. This model reflects software-defined perimeter specifications, part of the SASE framework.

Service-initiated

A connector appliance is introduced to the network instead of having software on each endpoint. The connector communicates with the ZTA provider’s cloud maintaining the connections that have passed through authentication. Typically, a user interacts via browser with a connector passing connections through various proxies. The provider’s network is a single control point upon which the whole enterprise’s network security relies.

Both options provide more detailed and advanced access control. Some vendors combine both options offering a hybrid approach. That way, third-party contractors could be connected via service-initiated connectors, while employees could be connected via deployed software.

A look at the Zero Trust diagram

The Zero Trust framework should encompass all your digital assets, including endpoints, identities, networks, applications, and infrastructure. This model requires close integration across all elements within the same framework.

Identities — human or non-human identities that are connected from personal or corporate networks

Endpoints — devices used by identities to initiate connections to the company’s resources

Zero Trust Policy — each connection request is thoroughly analyzed based on policy configuration. Factors like device security, its update status, and assessment from threat protection play a role when deciding the approach.

Policy Optimization — your Zero Trust Policy should be treated as a living entity, which should evolve. This component analyzes the aggregated data for optimization purposes.

Threat Protection — a significant amount of telemetry goes into the Threat Protection component, analyzed automatically or manually. Risk assessment insights are transmitted into the policy engine.

Network — public or private connectivity environment.

Data — all digital information used by the business.

Applications — software solutions used by the company.

Infrastructure — a collective body of the organization’s hardware and software assets.

ZTA could also be set up on-premises or through a cloud service. In that case, the outline would look different. This graph shows relations between the components in a broad context.

Building the Zero Trust enterprise

Placing the Zero Trust concept at the core of your business strategy means reorganizing areas like users, applications, and infrastructure.

In this model, users become a key risk and asset. The straightened control measures begin from heightened identity control. Strong identity policies combined with the minimal access policy system ensure that the enterprise is protected at the most rudimentary level.

Application-focused access removes the emphasis on being connected to the network itself. In addition, as the network’s importance is shrunk, its attack surface is also limited. Network presence is only function-oriented, sealing off numerous gaps that could be exploited.

Infrastructure is only the facilitator to making network connectivity possible. The main security burden is left to the network policies more than some advanced tools that would supervise internal traffic.

By reorganizing your enterprise according to Zero Trust fundamentals, it’s much easier to meet the rising cybersecurity requirements.