The “Zero Trust” Principle in Cybersecurity

In today’s digital landscape, marked by sophisticated threats and increasingly difficult-to-define security perimeters, we can say that we are entering a new era of cybersecurity, in which the implicit assumption of trust disappears completely. Thus, the Zero Trust principle has become an essential strategy for protecting data and systems. Instead of granting implicit trust to users or devices on a network, regardless of their location, Zero Trust is based on explicit verification of each access attempt, thus minimizing the risk of security breaches and offering a more robust and adaptable approach to contemporary cyber challenges.

Zero Trust (ZT) is a cybersecurity paradigm focused on the protection of resources, in which trust is never implicit, but constantly evaluated. The concept was introduced in 2009 by John Kindervag, a Forrester graduate, starting from his belief that “trust is a vulnerability”. Security, says Kindervag, should be designed around the “Never Trust, Always Verify” strategy.

What Is Zero Trust, and What Are Its Benefits in Cybersecurity?

ZT is increasingly becoming the preferred security model for government institutions and large enterprises.

Traditional perimeter-based security grants broad access once a subject is on the internal network, which can lead to problems with lateral movements (for example, when an employee with access privileges for a particular department moves to another). Zero trust, as a cybersecurity paradigm, shifts the focus of defense from static, network-based perimeters to users, assets, and resources.

It operates on the assumption that no implicit trust is granted based solely on network location or asset ownership. ZT aims to minimize uncertainty by applying precise access decisions with the least privilege per request in a network that is considered compromised in principle.

The emphasis is on the importance of continuous verification and the need to design systems where a breach in one component does not compromise the others.

Zero Trust Paradigm Core Principles

The Zero Trust model is based on three core principles:

Explicit Verification

Every access request must be fully authenticated, authorized, and encrypted.

Least Privilege Access

Users should only be granted the minimum access they need to perform their tasks.

Assumption of Breach

Every request is treated as if it came from an untrusted network.

The Zero Trust approach brings significant benefits to the security of public or private networks, including:

• Risk Reduction – By assuming a breach and verifying every request, organizations can reduce overall risk.
• Trust Building – Implementing Zero Trust principles helps build trust across the entire digital asset.
• Real-Time Response – Telemetry and analytics are used to detect threats and respond to them quickly.

According to a NIST US guideline, Zero Trust operates under a broader set of enforcement principles, including:

All data sources and computing services are considered resources.

This includes various types of company devices, as well as personally owned devices that access enterprise resources.

All communications are secure, regardless of network location.

Trust is not implicitly conferred by network location. All communications should protect confidentiality and integrity by authenticating the source.

Access to individual company resources is granted on a per-session basis and determined by dynamic policy.

Policy includes the observable state of the client identity, application/service, requesting assets, and other behavioral and environmental attributes. Policies are based on business needs and acceptable levels of risk.

The organization monitors and measures the integrity and security posture of all assets. 

No asset is inherently trusted. A continuous diagnostic and mitigation (CDM) system should monitor the health of devices and applications, applying fixes as needed.

Authentication and authorization of resources are dynamic and strictly enforced before access.

This involves a constant cycle of gaining access, scanning for threats, adapting, and reassessing trust. Identity, Credentials, and Access Management (ICAM) and asset management systems are used, including multi-factor authentication.

The organization collects information about assets, network infrastructure, and communications to improve its security posture.

Data about asset security, network traffic, and access requests is collected, processed, and used to improve policy creation and enforcement.

Zero Trust Security Architecture Approaches

Organizations can implement Zero Trust Architecture (ZTA) in several ways, focusing on different aspects as a determinant of security policy formulation. A complete ZT solution will incorporate elements from all three approaches below.

• ZTA using enhanced identity governance

Uses the identity of actors as the primary component for policy creation. Resource access policies are based on identity and the attributes used. This approach works well with the resource portal model and cloud-based applications.

• ZTA using microsegmentation

Places individual resources or groups of resources on unique network segments protected by gateway-type security components (Policy Enforcement Points – PEPs). This often requires an identity governance program to fully function.

• ZTA using network infrastructure and software-defined perimeters

Uses the network infrastructure to implement ZTA, often through overlay networks or software-defined perimeter (SDP) approaches. The Policy Administrator (PA) acts as the network controller, configuring the network based on decisions made by the Policy Engine (PE).

Trust Algorithm

The Algorithm of Trust (AT) is the process used by the PE to grant or deny access to resources based on data received from various sources.

Inputs for the trust algorithm:

• Access Request – the specific request from the subject, including the requested resource and information about the requester (OS version, software used, patch level).
• Subject Database and History – information about the organization’s subjects (people and processes), their attributes, and privileges. Some variants may include observed behavior in the past.
• Asset Database (and Observable State) – contains the known state of the assets owned by the organization (OS version, software, integrity, location, patch level) for comparison with the state of the requesting asset.
• Resource Requirements – Policies that define the minimum requirements for accessing a resource, such as authenticator assurance levels, network location, data sensitivity, and asset configuration.
• Threat Intelligence – Feeds about general threats, active malware, and suspicious communications, potentially from external services or internal scans.

Zero Trust Architecture Deployment Scenarios

ZTA can be applied in various organizational environments. The following scenarios assume a hybrid environment where ZTA and perimeter-based infrastructures can coexist.

1. Satellite-facility organization

Remote employees or branch offices need access to organizational resources. PE/PA is often hosted in the cloud with agents on the end assets or on a resource portal.

2. Multi-cloud/cloud-to-cloud organization

An organization uses multiple cloud providers for applications and data. PEPs (Policy Enforcement Points) are placed at the access points of each resource, with PE/PA potentially in the cloud.

3. Organization with contracted services and/or access from non-employees

On-site visitors or contractors need limited access. ZTA can provide access to the intranet while hiding organizational resources, differentiating employee devices from those of visitors.

4. Collaboration across organizational boundaries

When employees from different organizations need to collaborate on a project, ID management systems can facilitate access to the necessary data resources without complex firewall rules.

5. Organization with public or customer-facing services

Public-facing services may or may not require user registration. Although the principles of ZTA do not directly apply to anonymous public access, policies can be established for registered users.

Migrating to a Zero Trust Architecture

Implementing a ZTA is a gradual process. Most organizations will operate in a hybrid zero trust/perimeter mode for some time.

Pure Zero Trust Architecture

Building a ZTA from scratch is rarely viable for organizations with existing networks. However, ZT concepts can be introduced when building new infrastructure for new responsibilities.

Hybrid ZTA and Perimeter Architecture

ZTA workflows will likely coexist with non-ZTA workflows for an extended period. Common elements such as ID management and device management must be flexible enough to work in both architectures.

Steps to introducing ZTA in a Perimeter Network:

1. Migrating to ZTA requires detailed knowledge of assets, subjects, and business processes.
2. Identify the actors in the organization: You should have a good understanding of all subjects, including who the human users are and who the non-person entities (NPEs) are, such as service accounts.
3. Identify the assets owned by the organization: Catalog all hardware, software, and digital artifacts, including non-enterprise devices and shadow IT.
4. Identify key processes and assess the risks associated with the execution process: Identify and classify business processes, data flows, and their importance to the organization’s mission. Start with low-risk processes for the initial ZTA transition.
5. Formulate ZTA candidate policies: Determine the criteria or trust level weights for the resources used in the chosen business process.
6. Identify candidate solutions: Explore available ZTA solutions, considering factors such as client-side installation requirements, local resource support, logging capabilities, protocol support, and impact on subject behavior.
7. Initial Deployment and Monitoring: Implement policies using selected components, initially operating in an observation and monitoring mode to ensure effectiveness and functionality.
8. Extending the ZTA: Once sufficient trust is gained and policies are refined, you can begin planning the next phase of ZT implementation, reevaluating the process for any changes in workflow.

Conclusions

The ever-increasing complexity of organizational infrastructures, including remote users, bring your own device (BYOD) policies, and cloud services, has made traditional perimeter-based security insufficient.

The Zero Trust principle focuses on protecting resources rather than network segments. A ZTA is an organization’s cybersecurity architecture based on zero trust principles, designed to prevent data breaches and limit lateral movement.

ZT is not a single architecture, but a set of guiding principles for workflow, system design, and operations. The transition to ZTA is a gradual journey that involves changes in processes and technological solutions.

If you want to be among those who configure networks according to the principles of Zero Trust, we recommend the IT and Cybersecurity course of NewTech Academy, in which you will acquire a double training: as a network administrator and a cybersecurity specialist, both roles being highly sought after in today’s IT world. Contact us and let’s start your new career path together!