What Is Zero Trust

Recent statistics show that cyberattacks have become more common and damaging as people continue to embrace the digital world. Remote work and the adoption of cloud technology have only served to complicate matters further.

Instead of centralized data centers serving an internal network, companies now have some applications on-premise and some in the cloud, with users accessing these resources from different locations using various devices.

And while companies are increasingly investing more to ramp up their cybersecurity, the number of cyber attacks continues to increase every subsequent year. According to Accenture's ”State of Cybersecurity Resilience 2021” report, security attacks rose by 31% from 2020 to 2021.

Moreover, consumers have become more conscious about their online privacy and security and hold businesses accountable. Your customers will be quick to take their business elsewhere if they have doubts about the safety of their data.

With existing security solutions proving insufficient and the increased pressure from users, businesses have been left struggling to find a better security model and technology.

Well, it appears that they may have found a lifeline in Zero Trust security.

Zero Trust is a new security model designed to address the shortcomings of existing, largely perimeter-oriented models, which aim to better prepare businesses against cyber attackers and minimize the impact of successful cyber attacks.

From large corporations, through SMBs, to start-ups, any business benefits immensely from learning more about Zero Trust and its use.

In this article, we will explore everything you need to know about Zero Trust. What is Zero Trust, how do you implement it into your IT, what are the benefits, and does it have any shortcomings?

Zero Trust Defined: What Is a Zero Trust Security Model?

Zero Trust is a security model that requires all users, whether inside or outside the company network, to be individually authenticated and authorized before accessing individual company resources. The core idea behind Zero Trust is to never trust and always verify.

So even after a user has been granted access the first time, they will continuously be vetted to allow them to keep access to previously accessed resources or to be given access to new ones. This granular access policy can be enforced whenever needed.

Resources, in this case, can be various company assets like servers, data documents, network devices, IoT devices, and applications provided on-premise or in the cloud.

The person can be an employee, contractor, customer, or third-party user.

The Zero Trust Framework is perfect for the modern IT environment where businesses find it challenging to secure remote workers and hybrid cloud environments.

What Does Zero Trust Mean (in Your IT)?

In a nutshell, using a Zero Trust model when you build and manage IT systems will significantly reduce the attack surface in your organization and help you better control access to distributed resources for users located outside your perimeter. More on this when we explore the benefits of Zero Trust.

However, contrary to what some might think, Zero Trust is not specific hardware or software you deploy in your IT. Rather it's an approach to security that assumes no one can be trusted and may even result in your organization combining multiple security solutions.

To make its implementation easy, Zero Trust security follows seven principles that organizations should consider when shifting towards Zero Trust in their existing infrastructure and service ecosystem.

Zero Trust Principles

There are seven central Zero Trust Architecture tenets based on NIST's SP 800-207 publication:

1.      All data sources and computing services are considered resources.

This includes devices and SaaS services that organizations usually may not consider part of “their” network.

2.      All communication is secured regardless of network location.

„Network location alone does not imply trust. Access requests from assets located on enterprise-owned network infrastructure (e.g., inside a legacy network perimeter) must meet the exact security requirements as access requests and communication from any other non-enterprise-owned network.”

3.      Access to individual enterprise resources is granted on a per-session basis.

Trust should not be transmitted between sessions nor between individual resources. Zero Trust means verifying individual sessions and individual resources with maximum technically feasible granularity.

4.      Access to resources is determined by dynamic policy.

The policy should not be restricted to static access rights. Instead, the policy should consider the device, user, as well as situational context. 

5.      The enterprise monitors and measures the integrity and security posture of all owned and associated assets.

An organization should evaluate the security posture of devices, applications, data, or any other assets. 

6.      All resource authentication and authorization are dynamic and strictly enforced before access is allowed.

This is a constant cycle of obtaining access, scanning and assessing threats, adapting, and continually re-evaluating trust at every step. An enterprise implementing a Zero Trust Access (ZTA) would be expected to have Identity, Credentials, and Access Management (ICAM) and asset management systems in place. This includes the use of Multifactor Authentication (MFA) for access to some or all enterprise resources. Continual monitoring with possible re-authentication and re-authorization occurs throughout user transactions, as defined and enforced by policy (e.g., time-based, new resource requested, resource modification, anomalous subject activity detected) that strives to achieve a balance of security, availability, usability, and cost-efficiency.

7.      The enterprise collects as much information as possible about the current state of assets, network infrastructure, and communications and uses it to improve its security posture.

An enterprise should collect data about asset security posture, network traffic, and access requests, process that data, and use any insight to improve policy creation and enforcement. This data can also be used to provide context for access requests from subjects.

What Is a Zero Trust Architecture?

The Zero Trust architecture consists of two main components to monitor the flow of data in your organization and control access to resources so that access is not granted before trust has been established. These components are:

1. Policy Decision Point (PDP) – PDP is the control system where policy decisions are made and administered. It typically involves an administrative user interface, where organizations can make decisions about their policy rules, and an engine that is able to work on the wishes of their admin masters. This would typically involve some type of automation and provisioning to provide the right instructions to Policy Enforcement Points.

2. Policy Enforcement Point (PEP) – This is the technical component ultimately responsible for enforcing a particular policy - establishing, monitoring, and terminating connections between the user and the company resource. 

 

How Does Zero Trust Work?

Zero Trust is a major deviation from the traditional security model that’s based on the idea of ”trust but verify.”

The old security model focuses on external threats and uses perimeters like firewalls to control access. Once a user has been verified and granted access to the internal network, there is little control to monitor how they access resources in the network. Consequently, once hackers breach a network, they can remain unnoticed for a long time leading to unimaginable losses. This old model also leaves organizations unprotected against insider threats and with no way to secure resources located outside their network.

 

The Zero Trust model, on the other hand, sees everything as a threat meaning it can stop both internal and external threats.

It’s well aligned with more cyber technologies, including passwordless authentication, biometric identity verification, endpoint protection, and cloud workload technology to effectively secure enterprises against modern threats targeting remote workers and hybrid cloud environments.

Types of Zero Trust – ZTNA and ZTDP

Two of the more common Zero Trust models are Zero Trust Network Access (ZTNA) and Zero Trust Data Protection (ZTDP), each focusing on different Zero Trust principles. Here is a basic summary of ZTNA and ZTDP:

Zero Trust Network Access 

ZTNA, also known as software-defined perimeter, is a product or service that creates a secure perimeter around an application or a set of applications based in the cloud or on-premise. It’s similar to Secure Access Service Edge (SASE) solutions, a cloud model that combines network and security functions into a single service.

Proper use of ZTNA services can give remote users seamless and secure access to resources without needing to place the user on the network or exposing resources. Under this approach, users are only provided access to the resources they request based on their access levels.

Users are also connected through a unique and temporary connection with outbound-only connections, which makes enterprise infrastructure invisible to other parties.

Zero Trust Data Protection 

ZTDP is an approach focused on protecting data. The core component of ZTDP is not trusting data with any user, device, app, or service. There are many ways this can be done, such as through enhanced identity governance (EIG) or micro-segmentation.

EIG uses user identity as the driving factor of policy creation. Microsegmenting involves placing resources on their own or in a group in their own unique network segment. Each segment is then protected by gateway security components. Under this approach, an enterprise places solutions such as intelligent switches, firewalls, or special-purpose gateway devices to function as policy enforcement points to protect each segment.

Zero Trust Security Benefits

Zero Trust solutions can help you secure your networks, data, and apps. As technology evolves, policies and strategies should also evolve. Here are some of the top benefits of using Zero Trust:

• Reduced risk of attacks

Zero Trust assumes that all access requests are hostile and are only allowed to communicate once they are verified.‍ It reduces risk by verifying everything that is on a network and the way they are communicating. Also, Zero Trust reduces the risk of lateral movement. In the case of a single user/resource compromise, the risk of the entire network being compromised is significantly decreased compared to the classic perimeter model.

• Provides better access control in the cloud

As many enterprises use cloud apps and environments, they may lack control over their assets. When using cloud technology, cybersecurity becomes a shared responsibility between a cloud provider and the user. By implementing a Zero Trust security architecture, security policies are applied based on the identity of communicating workloads and are tied directly to the workload itself. This results in security being managed as close as possible to the assets being secured, and it's not affected by the environment.

• Provides secure remote access

Many companies are transitioning to a remote work model. Using Zero Trust allows remote work to be performed without risk of exposure. This can ensure that staff does not have to worry about securing their own devices and apps.

• Mitigates breach impact

Zero Trust is based on the principle of least privilege. The least privilege means that users or computer systems have access to the minimum information possible to be able to get the job done. In case attackers breach your organization’s defenses, they will only be able to access a limited number of resources, and they won’t be able to move across a single network laterally. 

• Maintain compliance

Zero Trust shields users and connections from the public, so they are not exposed or exploited. This makes it simpler to comply with privacy laws as well as compliance standards. The use of micro-segmenting can also ensure you secure more sensitive data.

• Improve accountability

Zero Trust constantly monitors and tracks resources across a network. Under Zero Trust, user access is always logged. Any issues that may not be related to cyber threats can also be tracked. For example, lost or misplaced data may be more easily found. 

Challenges of the Zero Trust Security Model

While there are many pros to using Zero Trust, there are also concerns about its potential challenges. Here are some common challenges organizations have when thinking about  Zero Trust:

• More complex: Going with Zero Trust can indeed get difficult. Especially if you try using old tech for the new model, it’s crucial to prioritize and focus on high-impact security designs and fit-for-purpose technologies. 

• Gaps during deployment: Developing Zero Trust policies and software takes time and expertise so you must be careful not to downgrade your security when making changes or deploying new tech on your organization’s own IT infrastructure.

• Less productive: Constantly verifying can take a heavy productivity toll if done wrong. Be careful not to forget users on the way to Zero Trust. Peig, the passwordless access platform can help make Zero Trust architectures invisible to end users. 

• Cost: It takes time and funds to adopt reasonable security in general. Unfortunately, the threat landscape has made investing in security unavoidable.

• Scale: Scaling across networks (rather than at a single point) takes work. On the other hand, your organization likely uses cloud environments and SaaS to have great tools at minimal cost already. Zero Trust is just a way to think about and implement sound security in a homogenous environment, which most companies already use.

How to Implement the Zero Trust Model?

While the concept of Zero Trust is simple, deciding how to implement Zero Trust is more complicated. There are diverse ways that Zero Trust architecture can be applied using different technologies. Ultimately, taking small steps and developing your Zero Trust strategy iteratively is essential.

Here are some tips you can follow to help you implement Zero Trust without compromising yourself:

1. Prepare reliable and secure user identification & authentication: Take advantage of modern access security and user authentication. Password-based authentication is obsolete; deploy passwordless alternatives that rely on reliable protocols and cryptography. 

2. Always use MFA for very sensitive assets: Use only secured MFA implementations and avoid well-known attacks on second-factor authentication. Make sure all purchases are protected with phishing-resistant access protection.

3. Implement individual Zero Trust components step by step: Hide and protect your data and applications behind Policy Enforcement Points one at a time. Execute access policies from one place using Policy Decision Point. Starting with cloud-based resource access protection is a fast way to increase IT security significantly.

4. Scale protection landscape: Protect resources outside the perimeter. Companies typically have sensitive data or assets with services they don’t think are within their reach. Expand your security policy to entail tools that Sales & Marketing use.

5. Set only minimal resource rights for people following company policy: Monitor and evaluate user behavior and the use of IT resources, then propose preventive tasks.

 

What’s Next?

Learn more about how Peig: Passwordless Access Platform can help your organization on the Zero Trust journey.