Are you looking to understand the cybersecurity model, Zero Trust? Learn to eliminate the concept of “trust” from your network by watching this Pluralsight course clip.
Video Summary
Here are the key points from the video:
- Zero Trust Methodology: This cybersecurity model eliminates the concept of trust within a network, meaning no device or user is trusted by default, regardless of their location.
- Traditional Network Design: Previously, internal networks were trusted, while the internet was not. However, with modern workforces using various devices and cloud technologies, this approach is outdated.
- Zero Trust Principles: The three main principles are:
- Verify explicitly: Always authenticate and authorize based on multiple data points.
- Use least privileged access: Limit user permissions to only what is necessary and for the shortest time needed.
- Assume breach: Continuously monitor and assume that breaches can happen, taking proactive measures.
- Zero Trust Pillars: The model relies on six foundational elements:
- Identities: Verify all users, services, and devices.
- Devices: Monitor device health and compliance.
- Applications: Manage and secure all applications, including shadow IT.
- Data: Classify, label, and encrypt data.
- Infrastructure: Secure both on-premises and cloud infrastructure.
- Networks: Segment networks and use real-time threat protection.
- Implementation: For more detailed guidance on implementing Zero Trust, there are resources like the Zero Trust Architecture course on Pluralsight.
For more information, read the transcript blog below, or watch the video above!
Video Transcript
Now that we know about the tracks out there, let’s learn about the Zero Trust methodology. The Zero Trust methodology, or simply Zero Trust, is a cybersecurity model with a very simple premise: eliminate the concept of trust from your network. But what exactly does that mean? To better understand what this means, let’s take a look at a traditional network design at a very high level. First, I will really split this into corporate resources, internet, and a DMZ part of your network where certain client-facing resources might be hosted. The way that networks have been designed before is that everything that was inside your corporate perimeter or internal was trusted. The internet was untrusted, and the DMZ is where you would have a lot of different rules on who has access to what. But the big problem was that by default, once something was internal or inside your corporate network, it was trusted and free to move laterally. That might have worked a long time ago, but with today’s modern workforce, the corporate perimeter has changed. We now have things such as cloud technology, which is accessed from the internet and anywhere really around the world with all sorts of devices. People now don’t only work from desktop PCs; they work from tablets, laptops, smartphones, from anywhere in the world, even in a train, a plane, or a hotel. Something else that has changed is that bad actors and threats have also evolved, so we cannot rely on that trusted corporate perimeter anymore.
Now that we know a bit more about why we need Zero Trust and the problem before, let’s go into more detail about how Zero Trust can help us. We will start with a detailed definition from the National Institute of Standards and Technology, which has a standard for Zero Trust. Zero Trust assumes that there is no implicit trust granted to assets or user accounts based solely on their physical or network location. So it doesn’t matter if a user is accessing a resource from their corporate offices or from the internet; they have the same level of trust. Or based on asset ownership, we should not trust a laptop just because it’s corporate-owned; we should treat it maybe even as if it were a bring-your-own device. Both of them we should not trust by default.
Zero Trust follows three guiding principles. The first one is to verify explicitly, which advises you to always authenticate and authorize based on all the available data points, including user identity, location, device, service or workload, access test, data classification, and data anomalies. This means that we will not only accept the user’s authentication as a token of trust; we will verify all the other signals mentioned, and what the user is allowed or authorized to do will depend on all of them. For example, if you see that a user logged in from, let’s say, Canada, and then one hour later the same user logged in from Germany, it should trigger an anomaly in your system, and it will need to make a decision whether it will allow the user or not. The next guiding principle is least privileged access. In a Zero Trust model, we should limit user access with just-in-time and just-enough access, which you will often see abbreviated as JIT and JEA. This means that a user should not simply always have administrator permissions on everything all the time, as that can be a security risk. Instead, when a user needs to do something with an elevated permission, they can request it, and it can be approved based on risk-based adaptive policies that evaluate the signals that you have. Those elevated permissions should be just enough for what the user needs to do and should only be for the time that the user needs to do that task, not forever. By implementing just-in-time and just-enough access, you can protect both data and productivity. The last guiding principle, but not the least, is to assume breach. This one is important as it frames the whole mindset with which you should approach your security. You should reduce your attack surface and prevent lateral movement by segmenting your networks, users, and devices. You should ensure that all of your data and sessions are encrypted, and you should use analytics to get visibility of threats and improve threat detection. The last one is important as even once somebody is authenticated, you need to keep monitoring them and see what they do, and at any point, if any threats are detected, assume breach and take corrective action.
In the Zero Trust model, we really need all the elements to work together in order to provide end-to-end security. When we talk about elements, we talk about six elements that are foundational pillars of the Zero Trust model. First are identities. Identities may be users, services, or devices. When an identity attempts to access a resource, it must be verified with strong authentication and follow least privileged access principles. Second is devices. Devices create a large attack surface as data flows from devices to on-premises workloads and the cloud. Monitoring devices for health and compliance is an important aspect of security. Third is applications. Applications are the way that data is consumed. This includes discovering all applications being used, whether they are enterprise applications or applications that shouldn’t be allowed, often called shadow IT because not all applications that people in your organization use are managed centrally. This pillar also includes managing permissions and access to those applications. The fourth pillar is data. Data should be classified, labeled, and encrypted based on its attributes. At the end of the day, security efforts are ultimately about protecting data and ensuring that it remains safe when it leaves devices, applications, and networks that the organization controls. Our fifth pillar is infrastructure. Infrastructure, whether on-premises or cloud-based, represents a threat vector. To improve security, you should assess for version, configuration, and just-in-time access, and always use telemetry to detect attacks and anomalies. This will allow you to automatically block or flag risky behavior and take protective actions. Our sixth and final pillar is networks. Networks should be segmented, including deeper in-network micro-segmentation. You should also use real-time threat protection, end-to-end encryption, monitoring, and analytics.
If you want to learn more about Zero Trust architecture and go more in detail not only about the methodology but also the steps to implement it, there is a course on Pluralsight called Zero Trust Architecture that you can check out.
