If you are wanting to learn more about exactly what is zero trust, you’ve come to the right place.
In this all-new guide, you’ll learn about:

- Failures of modern security techniques
- Zero Trust Principles
- The process for implementation
- Lots more

So, if you want to make sure that you understand zero trust and can implement it in your organization, you should get a lot of value from today’s guide.

What is Zero Trust?

Zero Trust is a security model built around a philosophy that considers everything on a network to be hostile. This means that strict access controls and traffic inspection are implemented. The core principles of Zero Trust are: micro segmentation, not trusting devices or users by default, and adaptive security controls.

Security Challenges of Modern IT Environments

Let’s start off by looking at the issues zero trust seeks to correct.
Specifically, why modern security is broken and how the ever-changing IT environment means that security needs to change as well.

In the last decade, there have been a couple of data leaks that exemplify what is wrong with information security.
They are the leaks by Chelsea Manning and Edward Snowden.
Politics aside, there were severe security flaws that allowed them to steal the data they did.
The organizations they both worked for had perimeter models that afforded insiders much more access than they needed to do their job.
This is exactly what zero trust seeks to rectify.
So, let’s talk about the perimeter model and its flaws.

The defunct Perimeter Security Model

When computers were first connected to the ARPANET in 1969 and the years thereafter, everything was connected directly.
There wasn’t any such thing as perimeter security.
When people realized that we were running out of IPV4 addresses, network design changed.
Instead of every device being directly connected to the ARPANET, they decided to use routers and NAT (Network Address Translation) all computers behind the router.
This perimeter method became the de-facto network architecture.
From that time, security defenses began to focus on the perimeter of the network.

The problem with a perimeter approach is that you simply can’t assume that everything inside of your network is a trusted device.
This is especially true with the rapid rate of the adoption of cloud technologies.
We have gone from networks where most of the systems you use are located at your building.

To most things other than employees now being outside of your network.

And with more employees working from the road or home, even that is changing.
There simply isn’t a clear perimeter that can be used.

Rapid adoption of cloud computing

Cloud technologies is another huge factor affecting companies’ decision to move forward with zero trust.
Think about how much of your IT environment is actually some kind of cloud solution – SaaS, PaaS, or IaaS.
If you’re anything like most other companies, it’s estimated that between 60% and 70% of technology spending is for cloud solutions.

And while you still have some control over the cloud applications that you use, it has become harder than ever to keep up with it all.
You have some employees logging into O365, some logging into Salesforce, some logging into AWS, and the list goes on.
If any one of your employees is compromised, an attacker could have access into your network.
This is the challenge that companies adopting cloud technology face.
But there’s an answer in Zero Trust – a single identity and access authority.
More on that later though.

Now that you understand the problem with information security, let’s look at the principles of zero trust.

Zero Trust Principles

The Zero Trust Model’s core principles are: there’s no inside the network, trust nothing, and adaptive security. This means everything is secured as if it were on the internet, everyone and everything must be verified with multiple factors, and security controls must change in real time based on intelligence from the environment

Zero Trust Principle #1: There’s no inside the network

We discussed this some earlier, but let’s expound.
With a zero trust approach, every device on your network should be protected like you are in a hostile environment – think on the WiFi at Starbucks.
So, just like you protect your main network with a next-generation firewall, you should protect your devices with one too.
The goal is to bring the perimeter from the edge of your network.

To as close to the device as possible.

This is accomplished using micro segmentation gateways.

Zero Trust Principle #2: Trust nothing, but verify everything

Trust is where information security has gone wrong.
If someone knows the username and password for an account, we have trusted that they are the person they claim to be.
With zero trust, we trust nothing and make the user or device prove their merits.
This is done by:

- Always identifying – using a single authority source like SSO and MFA to verify a user based on as many data points as possible (time of day, geolocation, etc)
- Always controlling – Use the principle of least privilege to give users access to the minimum level necessary to do their jobs.
- Always analyzing – all traffic is inspected at micro segmentation gateways and logged to analytics systems for review and threat hunting
- Always securing – an inside-out approach is taken to secure data. This simply means that the areas of your organization with toxic data get the most attention. Security is modified and improved as necessary

Zero Trust Principle #3: Security should be adaptive

One of the problems with non-zero trust security was that once a user was considered trusted, there remained trusted.
Layer three security rules are a great example.
Just because traffic comes from a certain IP address does not make it trusted,

Instead, that security rule should be adaptive.
If who (UID) = Sales, What (AID) = Salesforce, When (TOD) = Working Hours, Where (LOC) = US, Why (CLASS) = Toxic, How = Clean, THEN ALLOW

One of the problems with non-zero trust security was that once a user was considered trusted, there
See how much more robust that is?
If any of the points fails, the security rule adapts.

Five steps to a zero trust network

If you are ready to create robust security for your organization and implement a zero trust model, there is a certain process you should follow.
One thing to note is that you don’t have to rip and replace your entire network to implement zero trust.
You can simply change one department at a time.
This actually works better since you can test and resolve issues as you go.

Here are the five zero trust implementation steps recommended by Jon Klavberg:

1. Identify toxic data sources – identify the data in your environment that could harm your business if it is leaked. Harm could come from compliance failures, lawsuits, reputational damage or anything else that would impact the company.
2. Map transaction flows of toxic data – take note of the paths that data takes in your environment. Find out who accesses it, from where, for what reasons, with what applications, and as much other detail as you can gather.
3. Architect zero trust network based on data sources and use cases – based on the data you collected in your inventory process, begin architecting the paths and micro perimeters that will be needed. Think this through before you begin configuring equipment.
4. Create rules on segmentation gateways – configure your security gateways in a zero trust manner. Instead of traditional Layer 3 rules, use zero trust concepts.
5. Monitor network – inspect and log network traffic to identify threats early. Update rules in your network based on the visibility and intelligence you get from your analytics.

Conclusion

Now that you understand what is zero trust more thoroughly, you can go integrate the philosophy into your company’s security.
Remember, IT is changing rapidly and your security must change as well.
Let me know what part of Zero Trust you plan to implement first by leaving a comment below.