What is Zero Trust?

 

Zero trust is a security model based on the principle of maintaining strict access controls and not trusting anyone by default, even those already inside the network perimeter.

Zero Trust is a security concept that requires all users, even those inside the organization’s enterprise network, to be authenticated, authorized, and continuously validating security configuration and posture, before being granted or keeping access to applications and data. This approach leverages advanced technologies such as multifactor authentication, identity and access management (IAM), and next-generation endpoint security technology to verify the user’s identity and maintain system security.
Zero Trust is a significant departure from traditional network security, which followed the “trust but verify” method. The traditional approach automatically trusted users and endpoints within the organization’s perimeters, putting the organization at risk from malicious internal actors and allowing unauthorized users wide-reaching access once inside.
However, Zero Trust can only be successful if organizations are able to continuously monitor and validate that a user and his or her device has the right privileges and attributes. One-time validation simply won’t suffice, because threats and user attributes are all subject to change.
As a result, organizations must ensure that all access requests are continuously vetted prior to allowing connection to any of your enterprise or cloud assets. That’s why enforcement of Zero Trust policies heavily relies on real-time visibility into user attributes such as: User Identity, O/S versions, Applications installed, User Logins, Vulnerabilities, Incident detections and many more.

Why is Zero Trust important?

Zero Trust is one of the most effective ways for organizations to control access to their networks, applications, and data. It combines a wide range of preventative techniques including identity verification, microsegmentation, endpoint security and least privilege controls to deter would-be attackers and limit their access in the event of a breach.

This added layer of security is critical as companies increase the number of endpoints within their network and expand their infrastructure to include cloud-based applications and servers. Both of these trends make it more difficult to establish, monitor and maintain secure perimeters. Furthermore, a borderless security strategy is especially important for those organizations that have a global workforce and offer employees the ability to work remotely.

Finally, by segmenting the network and restricting user access, Zero Trust security helps the organization contain breaches and minimize potential damage. This is an important security measure as some of the most sophisticated attacks are orchestrated by internal users.

The Edward Snowden Example

The case of Edward Snowden demonstrates the importance of why organizations can’t drop their guard with approved internal users. As a subcontractor for the NSA, Snowden had the appropriate credentials to access the network.  However, without a Zero Trust framework in place, once he was granted access to the network, there were no further authentication procedures required for Snowden to download top-secret material. Had Zero Trust and the principle of least privilege been in place, Snowden’s activities would have been more easily discovered, if not outright prevented.