Zero trust security

What is the zero trust security model?

Traditional security assumes that entities logged into the corporate network should be trusted by default – whether the entity is remotely connected using a virtual private network (VPN) or physically connected at a brick-and-mortar location. However, this assumption is risky, because it does not secure against internal threats or malicious entities already within the network.

Remote work continues to dominate the workforce as organizations worldwide still attempt to cope with the COVID-19 pandemic and other catastrophes – traditional, trust-based security no longer works. Supply chain breaches, like the SolarWind attack, and the rise in cloud phishing schemes put organizations with traditional security in danger.

Zero trust security is a paradigm that requires distrusting any entity attempting to access a corporate network and its resources. It means adopting a methodology that assumes the network has already been breached.

Why is a zero trust security model needed?

The traditional ‘verify, then trust’ model allows entities with correct user credentials to access any website, application, or device requested. This level of trust puts the network at critical risk, exposing it to many threats, like malicious software (malware), ransomware, data leaks, and data breaches.

The modern network is highly distributed and complex, allowing users, devices, applications, services, APIs, and data to interact internally and externally. The environment is constantly changing, and there is no one clear perimeter to protect. As a result, organizations need to apply security where applications, users, data, and services are located:

A zero trust network architecture protects critical data and systems, regardless of where devices and users are located, without disrupting the user experience. It involves using microsegmentation to contain lateral movement and any threat that manages to enter the network.
A zero trust network employs tools to continuously monitor and respond to indicators of compromise and threats. Monitoring tools provide visibility into components, users, workloads, and devices. Some tools can also identify what is accessed or running and enforce organizational policies.
A zero trust network logs, reports, and alerts when detecting threats, and uses rules to initiate predefined automated responses. It extends security protection across various computing and containerized environments, working independently of the underlying infrastructure.

Together, these capabilities help secure the organization, ensure a consistent user experience, and reduce architectural complexities.

How does zero trust cyber security work?

Traditional security automatically trusts all verified entities. Zero trust security involves applying security measures that require continuous verification and monitoring to prohibit unauthorized access and contain threats.

Like traditional networks, zero trust networks also encrypt data and secure emails. However, zero trust networks introduce additional security measures to achieve greater visibility and control. Here are the core components of zero trust security:

Multi-factor authentication (MFA) or two-factor authentication (2FA)—these authentication methods require more verification, in addition to usernames and passwords. It helps ensure that even if threat actors compromise regular credentials, they cannot enter the network without the additional requested factor.
Identity access management (IAM)—enables organizations to apply more granular access control. For example, organizations can use IAM services to implement least privileged access to harden security and leverage single sign-on (SSO) to ensure a positive user experience.
Microsegmentation—involves breaking the network into smaller pieces that enable more granular access control and help prevent threats from moving laterally.

Real-time visibility—zero trust networks achieve real-time visibility using geolocation monitoring, device credential privileges, endpoint function knowledge, incident detection, user identity credentials, and software versioning.

Best practices for implementing zero trust security

Verify all devices

Zero trust networks go beyond simply verifying users. It extends verification to endpoint devices to ensure any device accessing internal resources meets security requirements. Additionally, zero trust requires continuous verification – it is not enough to verify once. Rather, verification is constantly applied to track and enforce the status of all devices.

Implement the principle of least privilege

The principle of least privileges (PoLP) determines access in a zero trust network. It ensures each user is granted only the privileges needed to complete certain tasks and nothing more. For example, a software engineer responsible for updating legacy code does not require access to financial records.

PoLP enables organizations to contain the potential damage a threat actor can inflict when compromising credentials. Organizations should also apply just-in-time privileged access to restrict privileges only to the specific times they are required. Common controls include one-time-use credentials and expiring privileges.

Monitor and audit everything

Zero trust requires monitoring and reviewing all user activity across the entire network. It enables organizations to identify suspicious activity in real time. It is especially critical to gain visibility into users with a high level of privileges and administrative rights because of the scope of their access permissions and the sensitivity of the data they can access.

Adopt attribute-based controls

Attribute-based controls enable organizations to authorize access to resources across the security stack, including on-premises and cloud-based applications, APIs, infrastructure, and data. It ensures administrators can easily enforce and adjust access policies to block suspicious security events in real time.

Consider your end users

A zero trust network should not cause disruptions for end-users. Rather, it should extend protection while creating a seamless experience. Disruptions can reduce productivity and disrupt the organization’s normal operations. A zero trust architecture and its tools should create a frictionless and SaaS-like experience for end-users.