By Ronan Mahony
Zero-trust is an approach to information security that reflects an IT landscape characterized by mobile workforces and hybrid multi-cloud infrastructures. This article explains what zero-trust is, its defining characteristics, benefits, and some implementation steps that your business can use as a guideline.
Zero Trust: Definition and A Brief Background
The zero trust model secures a company’s network environment by taking a prudent approach that doesn’t trust traffic, users, devices, or applications on the network regardless of whether they are inside or outside the network’s perimeter.
The zero-trust approach contrasts with the older ‘castle and moat’ approach which automatically trusts hosts inside the network’s perimeter. There is no well-defined network perimeter now with data stored in the cloud and users accessing those resources remotely.
Furthermore, placing automatic trust on devices or users inside the network perimeter is not advisable because threat actors can compromise user identities or remotely control workstations.
One of the first and highest-profile implementations of a zero-trust architecture was Google’s BeyondCorp Project. Powering this implementation was an access policy based on information about a device, its state, and its associated user.
Zero Trust: Defining Characteristics
Exploring the full scope of a zero-trust architecture is a lengthy task, however, there are some defining characteristics worth becoming familiar with as an introduction to this security model.
Identity-Driven
As was the case for Google’s BeyondCorp initiative, identity and access management (IAM) is a key component of a zero-trust architecture. With employees accessing sensitive data or mission-critical apps from devices outside the corporate firewall, identity is the new perimeter. As cloud computing uptake continues to rise, there’s a debate among security professionals about whether to trust cloud providers with access security or whether zero-trust is the answer.
An effective IAM system must use modern access management that relies on policy and risk-based authentication to control access to corporate resources, whether that access comes from inside or outside the corporate firewall and regardless of whether those resources are on-premises or in the cloud. A recent April 2021 podcast goes into more detail on the interplay between IAM and zero-trust.
Multifactor Authentication
A zero-trust approach relies heavily on strong authentication and authorization covering devices, users, and network flows. A useful component of any zero trust implementation is multifactor authentication, which requires two or more categories of evidence before authenticating user access requests. A 2017 data breach at Deloitte compromised an email server admin’s account that only required a single password to log in.
Adaptive Trust
The implementation of a zero-trust architecture should use an adaptive, data-driven approach to authentication. This means that the level of trust granted to users, devices, or applications dynamically shifts in real-time based on attributes, behaviors, and context.
For example, a privileged employee typically logs into an application from their home in Delaware during normal business hours. There’s a sudden login to this app at 2 am from Moscow. The standard level of trust should shift to require an extra authentication factor in this instance before granting access.
Risk baselines are essential so that too much friction doesn’t affect user experience. Normal levels of login behavior or context in line with this baseline shouldn’t trigger stronger authentication requests.
Cryptography
Encryption ensures the confidentiality of data while digital signatures ensure the integrity and authenticity of user devices and applications. Cryptographic techniques are critical in zero-trust networks because the network is assumed to be hostile by default, which means that prying threat actors could be lurking from any device inside or outside the network perimeter trying to capture and exfiltrate sensitive information. In the infamous Equifax breach of 2017, sensitive data was stored as plaintext and left exposed via the Internet.
Benefits of Zero-Trust
Here are some of the main benefits from realizing a zero-trust implementation:
- Lower Data Breach Risks: With data breach costs averaging millions of dollars, preventing the exfiltration of sensitive data from systems is vital. The identity-driven approach in zero-trust ensures only authorized users and devices get access to applications and data.
- Better User Experience: Both remote and on-premises employees can access corporate resources using single-sign-on, which reduces time spent resetting passwords. Stronger authentication requests come into play only when the risk context changes. The result is a better user experience and more time spent being productive.
- Accurate IT inventories: Since the success of zero-trust is predicated on having visibility into users, devices, data, and applications, its implementation results in more accurate IT inventories. An accurate IT inventory benefits both security and long-term capital expenditure planning.
Conclusion
You could write a book on the zero trust security model (and there are several!) but the crux of the matter is that this approach shifts network security from “trust, but verify” to “never trust, always verify.” In a world with increasingly sophisticated threat actors and increasingly complex IT infrastructures, zero-trust security is a sensible way forward.
##
ABOUT THE AUTHOR
Ronan Mahony is a freelance content writer mostly focused on cybersecurity topics. He likes breaking down complex ideas and solutions into engaging blog posts and articles. He’s comfortable writing about other areas of B2B technology, including machine learning and data analytics. He graduated from University College Dublin in 2013 with a degree in actuarial science, however, he followed his passion for writing and became a freelance writer in 2016. In his spare time, Ronan enjoys hiking, solo travel, and cooking Thai food.
