Zero Trust Framework

What is the Zero Trust Framework?

The Zero Trust framework describes a strict approach to cybersecurity in which every individual or device that attempt to access a private network, whether they are located inside or outside of that network, must be identified and authorized. Unlike other security models, which automatically trust individuals and devices that are already within the corporate network, zero trust advocates trusting no one at any time. The model was first described by John Kindervag, then a principal analyst at Forrester Research, in 2010.

Principles of Zero Trust

Zero Trust can best be described by the axiom “don’t trust, always verify.”

It acknowledges that traditional IT security models that seek to protect networks from outside threats but that inherently trust individuals or devices already within the network, are flawed. The reason is because that trust could be misplaced: there may be insider threats within the network in the form of an employee who wants to compromise corporate data, or a device that has been compromised by an outside attack, or a set of user security credentials that has been stolen by a bad actor outside of the organization.

Zero Trust proposes that by inherently trusting all users or devices within a network, traditional IT security models leave open the possibility that unchecked bad actors could roam freely within the corporate network, accessing more corporate data along the way, and raising the potential scale and severity of a cyberattack.

Zero Trust strategies

By comparison, the argument with Zero Trust is that organizations should assume their network has already been compromised and implement strategies or technologies to minimize further risk. Several of those strategies include:

Segregation of Duties

This principle describes the idea that no one individual or device should have full access to all of an organization’s critical IT sources. If that were to happen, then a hacker who gains control of that individual or device’s security credentials would have unfettered access to everything in the corporate network.

Least privileged access

In practice, the segregation of duties is achieved by giving each user least privileged access, meaning that every user or device within the network can access only the most essential resources they need, and nothing else. The benefit is that if that user’s credentials or device is compromised by an outside attack, a hacker would only have access to that device’s environment, and nothing more than that, which reduces the potential security risk.

Microsegmentation

Similarly, the Zero Trust model favors microsegmentation, which involves splitting up the corporate IT environment into security zones and requiring separate authorization in order to access each of those zones. This practice limits the chance that a hacker could “jump” from one part of the network to another in order to access and compromise more sensitive data.

Multifactor authentication

This principle requires more than one method of authentication to verify user credentials. For example, rather than relying on a password alone, multifactor authentication might require that a user also input a secret code that has been sent to an email address or a mobile phone number that only the user should have access to.

Zero Trust technologies

A number of technology solutions have been created to address aspects of the Zero Trust framework, including but not limited to: