Guest post by Rob Allen, who is an IT Professional with almost two decades of experience assisting small and medium enterprises embrace and utilise technology. He now works with Threat Locker.
Stand first: A radically different model to the old ‘castle walls’ approach, it is vital to communicate the benefits of the Zero Trust model to the business.
A director of the FBI said there are two types of companies: those that have been hacked and those that will be. While it may sound ominous to think of such an outcome as inevitable, this position can also provide a different perspective on security, while also reducing reputational risk.
Zero Trust – the model for today’s challenges
uses policies and actions to enforce least-privilege in information systems and services. It views the IT environment as inevitably or already compromised, and therefore limits access to only what is needed.
With the goal of preventing unauthorised access to data and services, and to make access control enforcement as granular as possible, the Zero Trust model represents a shift from a location-centric model to a more data- and user-centric approach.
Zero Trust can be applied to data, applications, services, and servers, just as much as for users.
By understanding what a Zero Trust model can mean for the whole organisation, it can provide a foundation and blueprint for a layered, coordinated approach to security that protects businesses against the realities of today’s threat landscape.
What is the Zero Trust model?
“Zero trust is a way of thinking, not a specific technology or architecture,” said Neil MacDonald, distinguished VP analyst, Gartner. “It’s really about zero implicit trust, as that’s what we want to get rid of.”
In the aftermath of the cyber attack on the Colonial Pipeline in 2021, the US Government announced the ‘Executive Order on Improving the Nation’s Cybersecurity’. This Executive Order stated that the ‘The Federal Government must adopt security best practices; advance toward Zero Trust Architecture’
As part of this Executive Order Zero Trust was defined as follows:
‘the term “Zero Trust Architecture” means a security model, a set of system design principles, and a coordinated cybersecurity and system management strategy based on an acknowledgement that threats exist both inside and outside traditional network boundaries.‘
‘The Zero Trust security model eliminates implicit trust in any one element, node, or service’, ‘Zero Trust Architecture allows users full access but only to the bare minimum they need to perform their jobs’
‘The Zero Trust Architecture security model assumes that a breach is inevitable or has likely already occurred, so it constantly limits access to only what is needed’
This is in stark contrast to the old idea of the castle walls, where it was assumed inside the castle, or your business security perimeter, everyone was a trusted user and therefore had access to pretty much everything. This was implicit trust.
Firstly, today’s user is more likely than ever to be outside your company firewall, beyond your castle’s walls, perhaps at home, or in a hotel, or at a customer’s site. A ZTM never assumes anyone is coming from a safe location. whether inside the castle, or beyond the moat, every endpoint is treated equally, and must be authenticated.
Secondly, the ZTM does not check once and then grant unlimited access. The model is designed to check on each request or interaction. This means that even if credentials are stolen, hijacked or spoofed, unauthorised access or requests are checked against policies, roles, and processes to see that all is as it should be.
This is a fundamental shift in thinking to how many businesses operated before and has many implications. Turning to Gartner again, it says an effective zero trust strategy means focusing on balancing the need for security with the need to run the business. It means building a structure where everyone gets all the access they need to do their job when they nee...
