Z is for Zero Trust

Image Source: https://www.globaldots.com/resources/blog/zero-trust-explained/

With increased data leaks and data breaches, the traditional way of protecting or securing infrastructure are outdated.

Today the IT experts say to trust no one and verify everyone.

Thus, zero trust. But what is Zero Trust? When was the first time this term was used? Who coined the term Zero Trust?

Starting with the basics, what is Zero Trust?

What is Zero Trust?

Zero Trust is essentially a security framework that requires all users to be authenticated, authorized, and continuously validated for security configuration and posture before they are granted access to any applications and data.

The users can be within or outside the organization’s network.

With Zero Trust there is only one assumption that there is no traditional network edge. With Zero Trust there is a belief that networks can be local, or in the cloud. The network can be a combination or hybrid with resources anywhere as well as workers in any location.

Zero Trust: The Definition

As defined by Zscaler.com, “Zero trust is a cybersecurity strategy wherein the security policy is applied based on context established through least-privileged access controls and strict user authentication—not assumed trust. A well-tuned zero trust architecture leads to simpler network infrastructure, a better user experience, and improved cyber threat defense.”

Image: what-is-zero-trust-security-callout. Source: https://www.akamai.com/our-thinking/zero-trust/zero-trust-security-model

What Does Zero Trust Seek to Address?

A framework designed to secure infrastructure and data for the contemporary digital transformation, Zero Trust, uniquely addresses the challenges faced by businesses in the present scenario. The challenges include – securing remote workers, hybrid cloud environments, and ransomware threats.

No doubt numerous vendors have tried to create their own definitions of Zero Trust, however, Zero Trust seeks to address the following key principles that are based on NSIT guidelines.

1. Continuous verification is a must
2. Limiting the ‘Blast Radius’ implying minimize the impact in case any external or internal breach happens
3. Automating Context Collection and response  

Fundamental principles behind Zero Trust Network Access

Based on five basic principles the Zero Trust model believes that: 

1. Every user connected to a network is hostile
2. There is always a threat risk both externally as well as internally
3. To decide whether the network can be trusted or not it is not sufficient to have network locality
4. Each device, user, and network flow are not only authenticated but also authorized
5. There must be dynamic policies, which must be calculated from as many data sources as possible