What are the three main concepts of Zero Trust?
|
The zero trust security model, also known as zero trust architecture (ZTA), zero trust network architecture or zero trust network access (ZTNA), and sometimes known as perimeterless security, describes an approach to the design and implementation of IT systems. The main concept behind the zero trust security model is "never trust, always verify,” which means that devices should not be trusted by default, even if they are connected to a permissioned network such as a corporate LAN and even if they were previously verified. ZTNA is implmented by establishing strong identity verification, validating device compliance prior to granting access, and ensuring least privilege access to only explicitly authorized resources. Most modern corporate networks consist of many interconnected zones, cloud services and infrastructure, connections to remote and mobile environments, and connections to non-conventional IT, such as IoT devices. The reasoning for zero trust is that the traditional approach — trusting devices within a notional "corporate perimeter", or devices connected via a VPN — is not relevant in the complex environment of a corporate network. The zero trust approach advocates mutual authentication, including checking the identity and integrity of devices without respect to location, and providing access to applications and services based on the confidence of device identity and device health in combination with user authentication.[1] The zero trust architecture has been proposed for use in specific areas such as supply chains[2][3] Show History[edit]In 1994 (April) the term "zero trust" was coined by Stephen Paul Marsh in his doctoral thesis on computer security at the University of Stirling. Marsh's work studied trust as something finite that can be described mathematically, asserting that the concept of trust transcends human factors such as morality, ethics, lawfulness, justice, and judgement.[4] In 2003 the challenges of defining the perimeter to an organisation's IT systems was highlighted by the Jericho Forum of this year, discussing the trend of what was then coined "de-perimiterisation".[citation needed] In 2009, Google implemented a zero trust architecture referred to as BeyondCorp. In 2010 the term zero trust model was used by analyst John Kindervag of Forrester Research to denote stricter cybersecurity programs and access control within corporations.[5][6][7] However, it would take almost a decade for zero trust architectures to become prevalent, driven in part by increased adoption of mobile and cloud services.[citation needed] In 2018, work undertaken in the United States by cybersecurity researchers at NIST and NCCoE led to the publication of SP 800-207, Zero Trust Architecture.[8][9] The publication defines zero trust (ZT) as a collection of concepts and ideas designed to reduce the uncertainty in enforcing accurate, per-request access decisions in information systems and services in the face of a network viewed as compromised. A zero trust architecture (ZTA) is an enterprise's cyber security plan that utilizes zero trust concepts and encompasses component relationships, workflow planning, and access policies. Therefore, a zero trust enterprise is the network infrastructure (physical and virtual) and operational policies that are in place for an enterprise as a product of a zero trust architecture plan. There are several ways to implement all the tenets of ZT; a full ZTA solution will include elements of all three:
In 2019 the United Kingdom National Cyber Security Centre (NCSC) recommended that network architects consider a zero trust approach for new IT deployments, particularly where significant use of cloud services is planned.[10] An alternative but consistent approach is taken by NCSC, in identifying the key principles behind zero trust architectures:
See also[edit]
References[edit]
What are the key factors of zero trust model?The zero-trust model states that the identity of every user and device attempting to access network resources must be verified, whether inside or outside the network perimeter. Use multifactor authentication to prevent network access with stolen passwords. Strictly enforce access controls.
What are 3 of the more common challenges associated with implementing zero trust architectures?Top 3 challenges of a zero-trust security model. A piecemeal approach to zero-trust cybersecurity can create gaps. ... . Zero-trust cybersecurity requires commitment to ongoing administration. ... . Zero trust vs.. Which are the three primary solutions that make up Cisco zero trust?Cisco has engineered integrated solutions to address three major pillars of Zero Trust; the workforce, workplace, and workload.
What is a zero trust design principle?Zero trust is an architectural approach where inherent trust in the network is removed, the network is assumed hostile and each request is verified based on an access policy.
|
