Zero Trust is a strategic cybersecurity model designed to protect modern digital business environments, which increasingly include public and private clouds, SaaS applications, DevOps, robotic process automation (RPA) and more. Zero Trust is centered on the belief that organizations should not automatically trust anything, whether it’s outside or inside its network perimeter. Zero Trust models demand that anyone and everything trying to connect to an organization’s systems must first be verified before access is granted. The main objective of Zero Trust is to mitigate the risk of cyber attacks in the modernized environments in which most organizations operate.
Industry analyst John Kindervag coined the phrases “Zero Trust” and “Zero Trust architectures” in 2010. This “never trust, always verify” concept quickly began to take hold and soon large enterprises, such as Google, began architecting their own interpretation of the Zero Trust model. After the massive U.S. Office of Personnel Management (OPM) breach, the House of Representatives recommended that government agencies adopt Zero Trust frameworks to protect against cyber attacks.
The Zero Trust model largely discounts the traditional “castle and moat” approach to cybersecurity, which focused on defending the perimeter, keeping attackers out, while assuming that everyone and everything inside the perimeter was cleared for access and, therefore, did not pose a threat to the organization. This approach relied heavily on firewalls and similar security measures, but was defenseless against the threat of bad actors inside organizations who gained — or were given — access to privileged accounts.
Today’s technology ecosystem has been made more complex by digital transformation and, consequently, necessitates adjustments to traditional security strategies. As the attack surface grows, perimeter-focused methods are increasingly ineffective. Furthermore, remote vendors often require privileged access to critical internal systems and keeping track of who needs access to what can be increasingly difficult. In contrast, Zero Trust is enforced from everywhere to ensure the only right users and non-human identities can access the data and only the data they need, when they need it. In Zero Trust frameworks, a “software-defined perimeter” provides secure privileged access to human and non-human identities – regardless of where they are, which endpoint devices or machines are being used or where the data and workloads are hosted (on premise, in the cloud or in hybrid environments).
How to Implement Zero Trust in Your Organization
There is no one Zero Trust technology. Effective Zero Trust strategies utilize a mix of existing technologies and approaches, such as multi-factor authentication (MFA), identity and access management (IAM), Privilged Access Management (PAM) and network segmentation, for comprehensive defense-in-depth. Zero Trust also emphasizes governance policies such as the principle of least privilege.
To build out modern architectures that align with Zero Trust, organizations often take a phased, programmatic approach over time, which involves some or all of the following steps:
- Protect high-power privileged accounts. It’s well established that the majority of insider threat and external attacks involve privileged access abuse. Organizations should identify the most important privileged accounts, credentials and secrets across their environment and pinpoint potential weaknesses and vulnerabilities that could jeopardize their most sensitive data and critical infrastructure. With this intelligence, they can implement access controls for protecting the privileged accounts that present the most risk as it relates to Zero Trust. Over time, they can extend protections to other users and applications across the enterprise, in the cloud, at the endpoint and throughout the DevOps pipeline.
- Implement multi-step authentication for business-critical assets. In Zero Trust models, Tier 0 assets must be protected above all else. Continuous multi-factor authentication (MFA) is essential in narrowing the focus of trust for users and devices. Additionally, step-up or just-in-time authentication and managerial approval processes that enable the authentication of privileged users at the exact point of access help to mitigate the risk of privileged credential-based attacks.
- Strengthen endpoint security. If a malicious attacker or insider gains access to a privileged credential, he or she will appear to be a trusted user. This makes it difficult to detect high-risk activity. In combination with endpoint detection and response, anti-virus/NGAV; application patching and OS patching, organizations can reduce the risk of attacks by managing and securing privileges on endpoint devices. Additionally, organizations should implement restriction models that only trust specified applications run by specific accounts under specific circumstances. This will help mitigate the risk of ransomware and code injection attacks.
- Monitor the privileged pathway. Continuous monitoring of the privileged access pathway prevents malicious insiders and external attackers from progressing their attack. Organizations should place tight controls around what end users can access; create isolation layers between endpoints, applications, users and systems – and continuously monitor access to reduce the attack surface.
- Implement the principle of least privilege. It’s essential to know who (among both human and non-human users) has access to what assets when and which actions they can perform. Organizations should enforce the principle of least privilege broadly along with attribute-based access controls that combine enterprise-level policy with specific user criteria to balance security with usability.
Learn More About Zero Trust
- CyberArk Zero Trust solution
- Zero Trust Part I: The Evolution of Perimeter Security
- Zero Trust Part II: The Evolution of Trust and Five Key Considerations
- Breaking the Cycle of Security Failure with Zero Trust
- Zero Trust: Securing Your Digital Transformation with Identity
- Implementing Privilege Access Security into Zero Trust Models and Architectures
- Zero Trust’s Evolution- The Role of Identity Security
