Blog
What is Zero Trust Security?
Zero Trust security is a concept formed around the belief that organizations should never automatically trust anything inside or outside its perimeters and must confirm anything and everything trying to connect to its systems before allowing access.
Zero Trust security requires the strict identity confirmation for every person and/or device that is attempting to access resources on a private network, regardless of whether they are outside or within the network perimeter. No single specific framework or technology is related to the Zero Trust security model, rather, it is a generalized approach to network security that integrates several different principles, policies and technologies
Traditional Network Security is Outdated
Zero Trust security represents a major exit from the traditional network security model, which follows the “trust-but-validate” system. This traditional castle-and-moat approach trusts both users and endpoints as long as they are within the organization’s network perimeters. Unfortunately, this “blind trust” puts organizations at risk from internal threat actors, such as rogue employees, and allows unauthorized users with expansive access once granted access.
The Zero Trust security model of IT security dumps the castle-and-moat mentality that had organizations focused solely on defending their perimeters while assuming everything already inside poses no threat and should be cleared for access. Generally, the “castle” itself does not exist in isolation as it has in years past. Organizations do not have data centers serving an isolated network of systems – instead, they typically have some applications on-premises and some in the cloud with users – employees, partners, customers – accessing applications from a variety of devices across several locations.
By now, it is apparent that the castle-and-moat methodology is no longer a workable model. They highlight that many modern data breaches transpired because threat actors, after gaining initial access, were free to move through internal systems without much (or any) resistance – thus driving the implementation of the Zero Trust security model.
The Zero Trust Security Model
The core philosophy behind the Zero Trust security network is the assumption that there are threat actors inside and outside of the network: in other words, no users or machines should be automatically trusted.
With that, a key principle of zero trust security is least-privilege access. What this entails is giving users only as much access as they require to perform their daily functions – and nothing more. Access to information is privileged on a strict need-to-know basis. This mentality minimizes each user’s exposure to sensitive directories of the network. As well, by limiting each user’s access, you prevent a threat actor from gaining access to large amounts of data should they gain access to a single user account.
Another key principle to the Zero Trust security model is the enforcement of multi-factor authentication. Multi-factor authentication means requiring more than one element of identification verification to authenticate a user; in other words, simply entering a password is not sufficient to gain access. The most common application observed today is 2-factor authentication or ‘2FA’ which can be seen used on financial institution websites and online platforms like Instagram, Facebook and Gmail. As well as entering a password, users with enabled 2FA for these services are required to also enter a code sent to another device, such as a mobile phone, providing two forms of proof of identity.
Zero trust security networks also make use of segmentation. Segmentation is the security strategy of breaking up security perimeters into zones, or segments, to preserve separate access for separate segments of the network. Someone with access to only one of these segments will be forbidden from accessing any of the other zones without separate authorization.
Case Study: Solarwinds Breach – Could it have been prevented?
As what may potentially go down as one of the most significant security events in US history, the Solarwinds breach represents a grand-scale example of the critical importance of cybersecurity to national security. The event is likely to accelerate mass-scale modifications to the cybersecurity industry. Organizations are turning to a new method of assuming that there may already compromised assets in any given network, rather than merely responding to attacks only after they are discovered.
In a recent Bleeping Computer article, Microsoft President Brad Smith defined the Zero Trust security model as the very best in cybersecurity while testifying in front of the US Senate after the SolarWinds breach.
He went on to expand that, “…basic cyber hygiene and security best practices were not in place with the regularity and discipline we would expect of federal customers with the agencies’ security profiles. In most cases, multi-factor authentication, least privileged access, and the other requirements to establish a ‘zero trust’ environment were not in place, said Smith. “Our experience and data strongly suggest that had these steps (Zero Trust security model) been in place, the attacker would have had only limited success in compromising valuable data even after gaining access to agency environments.”
Since this testimony, Microsoft and the US National Security Agency (NSA) have recommended that all public and private sector organizations should aim to follow a Zero Trust security program for cybersecurity.
The NSA later published a paper, titled “Embracing a Zero Trust Security Model” stating that the use of Zero Trust security principles will better position an organization against the existing and evolving threat landscape.
Summary
To wrap things up, in a Zero Trust security model, no one is trusted by default – not from inside or outside the network. Verification, often in the form of MFA, is required from all users trying to gain access to the network. This along with the principles of least privilege and proper segmentation adds layers of security that have been demonstrated to prevent data breaches. Considering the current threat landscape, with threats such as initial access broker and supply chain attacks becoming a regular occurrence, it should be no surprise that organizations are being encouraged by today’s experts to adopt a Zero Trust security policy. This model represents a superior solution to building security from the inside out and not the outside in.
If you would like to learn more about Zero Trust security principles, and how Packetlabs team od security experts can help streamline the process for your organization, please contact us for more details! As always, we are here to help!!