What Is Zero Trust?

The Zero Trust security model is a strategy that by default trusts nothing. For example, before allowing a network connection, risk is assessed based on the health of the device, the identity status, the data being accessed or uploaded, and the health of the application. After the risk is assessed and a connection is allowed “just in time”, it is continuously assessed for changes that may warrant terminating the connection. This requires, among other things, new situational awareness, new policy mechanisms, dynamic authorization, just-in-time provisioning, real-time de-provisioning, live data and application integrity monitoring, availability enforcement, revised monitoring technology and a suite of detective, forensic and remediation tools.

The rapid evolution of attacker behaviors (stealthy movement, credential compromise, hiding in plain sight, etc…) has been among the main drivers behind the Zero Trust approach. The Zero Trust approach makes it more difficult for attackers to move laterally across the network leveraging compromised identities by requiring at a minimum multi-factor authentication, dynamic authorization, restricting network access through micro-segmentation, and application safe listing. Naturally, all of this has to be done while not introducing a new host of vulnerabilities in the abstraction layer or making the IT job harder for troubleshooting, support, and improvement projects.

Key Tenants of Zero Trust

• All data sources and computing services are considered resources.
• All communication is secured regardless of network location.
• All resource authentication and authorization are dynamic and strictly enforced before access is allowed.
• The enterprise monitors and measures the integrity and security posture of all owned and associated assets.
• Access to individual enterprise resources is granted on a per-session basis.
• Access to resources is determined by dynamic policy—including the observable state of client identity, application/service, and the requesting asset—and may include other behavioral and environmental attributes.
• The enterprise collects as much information as possible about the current state of assets, network infrastructure, and communications and uses it to improve its security posture.

Zero Trust: What’s Under the Hood?

If Zero Trust is the vehicle by which organizations are going to modernize their defenses to meet the challenges of today’s sophisticated adversaries, it’s imperative that defenders take a look at what lies under the hood. Not all shiny vehicles come with an engine powerful enough to get you across the finish line, let alone win the race. The real question isn’t how one gets to Zero Trust but rather how one makes meaningful progress toward it now, not in a deferred view of perfection. To paraphrase Voltaire, perfect is the enemy of the good.

At Cybereason, we’ve supported Zero Trust since our inception, and our vision for how to secure against advanced, modern attacks like nation state malicious operations, supply chain compromises, and ransomware relies on trusting nothing in the environment. The old adage of trust but verify says that we allow things to operate and then we continuously verify behavior with an ability to revoke privileges. Because of our experience, we know that there are certain components that every successful Zero Trust solution requires.