A zero-trust model is a security framework that fortifies the enterprise by removing implicit trust and enforcing strict user and device authentication throughout the network. This guide goes in-depth into the origins of zero trust, its architecture, the technology and products that comprise a zero-trust model, as well as how to implement and manage zero trust. Links enable readers to dig even deeper and become experts in this critical security strategy.
A zero-trust model supports microsegmentation — a fundamental principle of cybersecurity. Microsegmentation enables IT to wall off network resources so potential threats can be easily contained and not spread throughout the enterprise. Organizations can apply granular policies enforced by role-based access to secure sensitive systems and data.
The main tenet of zero-trust security is that vulnerabilities often appear when companies are too trusting of individuals or devices. The zero-trust model suggests that no user, even if allowed onto the network, should be trusted by default because they could be compromised. Identity and device authentication are required throughout the network instead of just at the perimeter.
By limiting which parties have privileged access to each segment of a network, or each machine in a secure organization, the number of opportunities for a hacker to gain access to secure content is greatly reduced. The term zero trust was introduced by an analyst at Forrester Research in 2010, with vendors, such as Google and Cisco, adopting the model shortly after.
Traditional IT security strategies, such as VPNs and firewalls, create a perimeter around the network that enables authenticated users and devices to traverse the network and access resources with ease. Unfortunately, with so many users working remotely and so many assets being placed in the cloud, relying solely on the perimeter approach is becoming less effective, less efficient and more dangerous.
A zero-trust model, conversely, provides strong protection against the types of attacks that plague businesses today, including the theft of corporate assets and identities. Adopting zero trust enables organizations to do the following:
- protect company data;
- boost the ability to do compliance auditing;
- lower breach risk and detection time;
- improve visibility into network traffic; and
- increase control in a cloud environment…”
