Understanding Zero Trust Architecture

• Zero trust architecture is a concept that does not trust any machine based on its physical or network location.
• It requires the authentication of both users and devices to establish a connection.

The history

John Kindervag, a security analyst at Forrester Research Inc. coined ‘Zero Trust’ when a model for the concept was presented in 2010. Google announced a few years later that it had implemented zero trust security in its network. This architecture has been gaining popularity among tech companies for improved security.

What is Zero Trust Architecture (ZTA)?

The ZTA is a security model that works on the elimination of trust and focuses on data protection.

• While implementing this architecture, a ‘protect surface’ is identified. This includes the network’s critical data, assets, applications, and services (DAAS).
• Depending on the traffic to the ‘protect surface’, a firewall that allows only legitimate access must be implemented.
• A Zero Trust Policy can help monitor users and prevent unauthorized access to the ‘protect surface’.
• After this, regular monitoring must be done to update the Zero Trust Policy as necessary.
• This architecture also relies on multi-factor authentication, the popular concept for requiring multiple evidences before granting access.
• Yet another core principle of ZTA is least-privilege access. This means that any user is given access to only the portions of the network that are required. By restricting access, the network portions are exposed to the minimum number of users only.

Why ZTA?

Traditional security models work on the assumption that users on the network can be trusted.

On the contrary, ZTA works on the ‘never trust, always verify’ principle. It protects the network in cases where threat actors infiltrate a system and are able to laterally propagate throughout the network.

Risks in ZTA

Although this architecture eliminates many security concerns, there are certain risks associated with it.

• Insider threat is a factor that ZTA does not address. A compromised employee with authorized access can bypass this architecture and perform malicious activities. The problem is amplified if the compromised employee has control over the Zero Trust Policy. Any changes to it must go through proper channels to limit the chance of this threat impacting your network.
• If a misconfiguration results in the implementation of the Zero Trust Policy being affected, there are chances of the entire network becoming inaccessible.