What is Zero Trust?

If you want to learn more about exactly what Zero Trust is, you've come to the right place. In this guide you'll learn about the failures of modern security techniques, the core Zero Trust principles, and the process for implementation.

Zero Trust is a security model built around a philosophy that considers everything on a network to be hostile. Strict access controls and traffic inspection are implemented throughout. The core principles of Zero Trust are: micro-segmentation, not trusting devices or users by default, and adaptive security controls.

Security challenges of modern IT environments

Let's start by looking at the issues Zero Trust seeks to correct — specifically, why the traditional model is broken and how the ever-changing IT environment means security needs to change too.

The organizations behind some of the most famous data leaks used perimeter models that afforded insiders far more access than they needed to do their jobs. That is exactly what Zero Trust seeks to rectify.

The defunct perimeter security model

As networks grew, routers and NAT put most devices behind a perimeter, and security defenses began to focus on that perimeter. The problem with a perimeter approach is that you simply can't assume everything inside your network is trusted — especially with the rapid adoption of cloud, and with employees increasingly working from home or the road. There is no longer a clear perimeter to defend.

Rapid adoption of cloud computing

For most companies, an estimated 60–70% of technology spending now goes to cloud solutions — SaaS, PaaS, and IaaS. Employees log into O365, Salesforce, AWS and more. If any one account is compromised, an attacker may gain a foothold. Zero Trust answers this with a single identity and access authority.

Zero Trust principles

The Zero Trust model's core principles are: there is no "inside" the network, trust nothing, and security must be adaptive. Everything is secured as if it were on the open internet, everyone and everything must be verified with multiple factors, and controls change in real time based on intelligence from the environment.

Principle #1: There's no inside the network

Every device on your network should be protected as if it were in a hostile environment — think of the Wi-Fi at a coffee shop. The goal is to bring the perimeter from the edge of the network to as close to each device as possible, using micro-segmentation gateways.

Principle #2: Trust nothing, verify everything

Trust is where information security has gone wrong. With Zero Trust, we make the user or device prove its merits by:

Always identifying — using a single authority like SSO and MFA to verify a user against as many data points as possible (time of day, geolocation, etc.).
Always controlling — using least privilege to give users the minimum access necessary.
Always analyzing — inspecting all traffic at micro-segmentation gateways and logging it for review and threat hunting.
Always securing — taking an inside-out approach so the areas with the most sensitive data get the most attention.

Principle #3: Security should be adaptive

In older models, once a user was trusted, they stayed trusted. Layer-3 rules are a good example — traffic from a given IP address is not inherently trustworthy. Instead, rules should be adaptive: if who = Sales, what = Salesforce, when = working hours, where = US, and how = clean, then allow. If any point fails, the rule adapts.

Five steps to a Zero Trust network

You don't have to rip and replace your entire network — you can change one department at a time, testing as you go.

Identify sensitive data sources — find the data that would harm the business if leaked (compliance failures, lawsuits, reputational damage).
Map transaction flows — note the paths that data takes: who accesses it, from where, for what reasons, with which applications.
Architect the Zero Trust network — design the paths and micro-perimeters you'll need before configuring equipment.
Create rules on segmentation gateways — replace traditional Layer-3 rules with Zero Trust rules.
Monitor the network — inspect and log traffic to catch threats early, and update rules based on what your analytics reveal.

Conclusion

Now that you understand Zero Trust more thoroughly, you can begin integrating the philosophy into your organization's security. IT is changing rapidly, and your security must change with it.