Zero trust is one of the most celebrated concepts in cybersecurity right now. The basic tenet of zero trust architecture is – trust nothing, always authenticate in order to protect the network. We explore what is a zero trust security model, the benefits of adopting it, and how to implement a zero trust architecture in an organisation.
What is zero trust security model?
The zero trust security model treats all users, devices, and resources as untrustworthy, regardless of who or what they are, or whether they are connecting to a system from within the network. Each resource within the network is treated as a separate entity that must be successfully authenticated to before users can access it.
Zero trust security is in contrast to traditional security models which focus on creating a secure perimeter and implicitly trust any account within that perimeter without any need to re-validate them, which makes it difficult to track a malicious actor through the network. Furthermore, as more and more organisations undergo digital transformations and migrate their network to the cloud, the traditional concept of the perimeter has been severely challenged, making zero trust a good choice for many organisations.
In a zero trust security model, every user and device is challenged to prove they are legitimate in order to carry out any action within the perimeter, from accessing systems to removing data. Lateral movement across the network is restricted, and the zero trust model creates a more secure environment that protects against unauthorised access to sensitive data and digital assets.
The zero trust security model contains several key elements, including granular security controls, strong authentication methods, network segregation, and controls against lateral movement.
Zero trust security model principles
A zero trust security model follows the idea that no network can be trusted, including the organisation’s own network. The creator of a zero trust architecture will need to utilise these principles:
Continuously monitor and validate everyone
Zero trust security models work on the assumption that anyone could be a malicious user whether they are from within or without the network. As a result, continuous monitoring, inspection, and logging of all traffic and activities is required to keep the network safe. This continuous monitoring will enable systems to verify user identity, privileges, device identity, and security at all times.
Require authentication and authorisation throughout the network
A zero trust security model breaks the network into many segments and creates access gates between every segment and for every application or resource within it. Every user (individual, device, and infrastructure component) is treated as suspicious until it can be verified.
The zero trust security model encourages the use of multi factor authentication as it strengthens the authentication process for users to access the network and individual systems, ensuring that only authorised users can access the network in the first place.
Follow the principle of least privilege
The principle of least privilege argues that users, devices, and systems must only be given access to the data and services they require in order to do their jobs. In a zero trust network, access is only allowed on an absolutely necessary basis, and when the request to access a system can be verified.
Know what and who is allowed in the network
All policies within a zero trust architecture should be as granular as possible. As a result, organisations will need to ensure that they know every component of the network’s architecture well to identify key resources, risks to the architecture, and who the users are.
Users on the network can include individuals (usually collectively known as users), applications, and infrastructure (including routers, switches, cloud components, and suppliers). Every user must be uniquely identifiable in order to navigate a zero trust architecture.
Separate the network into microsegments
Reducing security perimeters into small zones and requiring verification to move between those zones limits lateral access throughout the network. This means that even if a malicious actor is able to access one segment, they are unable to move to a different segment, and they are denied access to sensitive information. Ultimately microsegmentation minimises the impact should a breach occur.
Restrict lateral movement across the network
In a traditional perimeter network security model there are no internal access gates, and traffic can roam freely once it is within the perimeter. This makes it difficult to detect where a malicious actor is within the network.
In the zero trust security model, attackers can’t move laterally around the network because the network is divided into segments, and there are access gates to move from one segment to another. This allows the organisation to detect where the attacker is in the network, and cut the attacker off from the rest of the network.
The benefits of a zero trust security model
The zero trust security model relies heavily on tools to implement it, and as such requires significant investment and resources to monitor and maintain the system. However, zero trust architecture ultimately creates a far more secure environment, with significant benefits for organisations.
Protection against attack
Organisations are experiencing frequent and increasingly severe cyber attacks including ransomware, supply chain attacks, and insider threats. The main components of zero trust such as strong user authentication, network segmentation, and continuous monitoring are important elements of an effective cybersecurity programme.
Reduces risk by creating smaller attack surfaces
In a zero trust architecture users are connected directly to the applications and systems they require, not the entire network. This smaller connection represents a smaller attack surface as an attacker can only access that one system and is prevented from moving laterally across the wider network.
Provides access control over cloud environments
Digital transformation and migrations to the cloud have changed how the perimeter operates, and cloud security is a sometimes uneasy alliance between cloud service providers and the organisation.
With a zero trust architecture, security policies apply directly to the user requesting access, and therefore keeps security as close as possible to the assets that are being protected. This way, assets are protected by the authentication of the user.
Secures remote working
Remote or hybrid working patterns create insecurity for organisations as employees log into the network from outside the organisation’s safe space. Zero trust security’s strong emphasis on authentication and authorisation allows organisations to extend the corporate network into remote locations, protecting the network.
Improved monitoring and alerting
The range of tools that make up a zero trust security model include tools such as SIEM systems, security orchestration automation and response systems, and network detection and response systems. These automated tools will notify organisations of any unauthorised activity, and maintain logs to aid event analysis, all of which will allow them to identify security issues quickly, and begin their incident response.
Improves user experience through single sign on
The zero trust security model encourages the use of single sign on (SSO). With SSO, users only enter credentials once, making the entire system more usable and enables users to create (and remember) only one password at a time, encouraging stronger, more secure passwords.
Enables a streamlined, holistic approach to security policy creation
In a traditional model, security policies are created for and applied to each security system and area of the network in their own silos. The overarching zero trust security model encourages a more holistic approach to security policies across the network, and enables universal policies implemented end to end across the network.
Working towards a zero trust security model
Zero trust security architecture is estimated to improve the effectiveness of an organisation’s information security programme by up to 144%. While implementing a zero trust architecture may seem like a daunting task, it is undeniable that it has significant benefits in today’s challenging environment of remote working, cloud services, and cyber attacks.
Stay safe
