The Zero Trust Approach to Cybersecurity

Cybersecurity threats are everywhere and new government information standards are being implemented to keep data secure. As cybersecurity practices receive updates, companies should reevaluate their current data protection approach.

Challenges with a Trustful Approach

Current cybersecurity practices tend to follow a “trust but verify” or a castle-and-moat approach. In these models, personnel and devices inside the network (or castle) are trusted. Simple, one-step authentication is used to verify those attempting to access the network, and once verified the user navigates the network freely. Outside of the “castle,” some form of security (or moat) is constructed to prevent attackers from getting inside.

However, in today’s digital age, data often exists outside the “moat” in the cloud, with vendors or inside remote employees’ homes, rendering the castle-and-moat protection strategy ineffective. Worse, once attackers breach the moat, there are no extra security parameters stopping them from infiltrating the entire network.

Choosing a zero trust approach means acknowledging that attacks can occur both inside and outside a network and that no users or devices should be automatically trusted. The zero trust approach model follows a “never trust, always verify” mentality.

Building a Zero Trust Approach

In August, NIST released Special Publication 800-207, which outlines components of a zero-trust architecture:

• Whole Network Security All communication is secured regardless of location. Access requests are the same for company-owned devices within the network and employee-owned devices outside the network.
• Multi-Factor Authentication – There are multiple steps users and devices must take to verify their identity so an attacker gaining information for one step still needs the others. Access should need to be re-granted every session.
• Least-Privilege Access – Users only have access to the specific resources they need and nothing more so an attacker can only gain access to limited resources.
• Real-Time Monitoring – The network is continuously monitored so attacks are identified quickly and shutdown.

A zero trust architecture may include one or more of the following additional features:

• Enhanced Identity Governance – Network access isn’t simply granted through multi-factor authentication. A device’s location, user behavior and resources requested may be assessed and access limited or denied if found suspicious.
• Microsegmented Network – The network is separated into smaller sections, each requiring their own verification process. So an attacker gaining access to one part of the network doesn’t automatically have access to the others. Approved personnel and devices must again verify their identity before accessing other areas.
• Software Defined Perimeters – Software algorithms manage network access and resource privileges.

To create a zero trust security model, one should:

1. Identify sensitive data: What assets are sensitive and need to be protected?
2. Identify employee roles and groups: What roles need access to sensitive data? How can roles be grouped together according to data needs?
3. Map transaction flows of roles throughout systems and devices: What devices do employee roles and groups need? How does data flow through these devices and throughout the network?
4. Segment network and limit access: How can the network be segmented based on employee groups and data flow? Where should access limitations be drawn?

Zero Trust for The Future

The downsides of zero trust include increased user and device management and increased recourses to set up and run security. However, as the zero trust approach closes gaps in common cybersecurity measures and makes networks harder for attackers to infiltrate, the benefits may outweigh the costs and push zero trust into the new security standard.