Zero Trust Security Model: Zero Trust Concept & Access Control

Zero trust is a cybersecurity approach built on the concept of always verifying and never trusting any user, device, application, or content communications. In this approach, validation is required before network access is granted to devices, applications, and users and before documents are sent, shared, received, or stored. Zero trust be a critical component in the security risk management strategy of any organization today.

Zero-trust Security

Enterprise assets covered by a zero-trust architectural approach include:

Users
Networks
Applications
Devices
Infrastructure
Data

Zero trust replaced the older approach of perimeter security, which had significant challenges—including being defenseless from threats emanating from internal actors. Deficiencies of legacy security models enabled malicious actors to penetrate the network perimeter and access applications or sensitive content. Legacy security approaches also are defenseless from threats emanating from internal actors.

In response to these challenges, John Kindervag, who worked at Forrester Research at the time, developed the Zero Trust Security Model. Soon enough, it was adopted across industry sectors and for all aspects of cybersecurity risk management. This impact extended to elements such as third-party risk management.

The following provides organizations with an overview of zero trust, including core principles, benefits, and how you can implement zero trust in your organization.

What Is the Zero Trust Security Model?

Just as the name suggests, zero-trust security is based on the notion that organizations should not trust anyone or anything, whether they are outside or inside their systems/networks.

The default security posture is to deny access to the network and all assets. Everybody and everything trying to gain access should be authenticated, authorized, and continually verified.

This concept assumes maximum and eternal vigilance and requires strict identification and verification without exception. The legacy network security model trusted people and devices once they were inside the network. The same applied to applications and sensitive content communications.

Digital transformation, the proliferation of hybrid networks, remote work, and adoption of cloud solutions, combined with the ever-evolving risks from rogue nation-states and malicious threat actors, are some of the primary reasons why zero-trust security is a required cybersecurity strategy.

Core Principles of Zero-trust Security

To adequately deploy a zero-trust security architecture, one must first understand the underlying principles behind the security posture and ensure those are integrated into your security risk management strategy.

Continuous monitoring and validation

Continuous monitoring and validation of users, devices, applications, and sensitive content communications is one of the most robust principles of zero trust. Connection timeouts and verification of user identity are at the core of any zero-trust policy. It also mandates inbound and outbound privacy and compliance governance of sensitive content communications.

Least privileged access

This simply means that users are granted access to only what they need to accomplish their tasks. All users, devices, and applications are untrusted by default and least privileged access is enforced. For instance, a user who doesn’t need an admin account to do her job should never have access to one. User access privileges must be clearly defined and enforced; this includes defined content policies from those who are administrators of content to those who can simply view it.

Additionally, zero trust assumes a breach is inevitable or has likely occurred. The principle of least privileged control ensures that compromised accounts cannot access high-value targets—whether the network, devices, applications, or content.

Device access control

This is an important principle that helps detect and prevent attacks. It requires continuous monitoring of devices attempting to access the network and those already in the network. With zero trust, any device poses a threat and hence should be authorized, verified, and re-verified if any suspicious traffic is detected.

Microsegmentation

This is one of the significant changes that a zero-trust policy introduces to an existing IT infrastructure. Legacy security consists, in most instances, of numerous elements that are largely not integrated and incur substantial resources and time to manage.

Zero trust encourages the microsegmentation of an extensive network into smaller networks working independently of each other. This means that if one network zone is compromised, the threat is limited to that network. Most of the biggest security breaches made use of lateral flow movement, where cybercriminals gain access and progressively move deeper into a network, application, or storage repository, searching for valuable and sensitive data and high-value assets. Microsegmentation aims to limit the scale of such attacks.

Multi-factor authentication (MFA)

This core principle must always be observed in a zero-trust security approach. MFA requires a user to provide more than one credential to gain access to any resources in the network, applications, as well as content.

Popular MFA methods include using a password and a code sent to a mobile phone. This ensures that if a password is compromised, access will not be possible without the code sent to a mobile phone. A robust zero-trust security infrastructure incorporates these core principles of integrated risk management in its design.

Content-defined zero trust

The same applies to applications and sensitive content sends, shares, receives, and stores. A zero-trust sensitive content communications model continuously monitors and controls who accesses content, who can send and share it, and to whom content is sent and shared. Least-privileged access is enforced—administrators, owners, managers, collaborators, viewers, downloaders, and so forth. This is especially important for third-party risk management (TPRM). Additionally, security governance is applied for both inbound and outbound communications with integrated and embedded comprehensive security monitoring using anti-malware, antivirus, antispam, advanced threat protection, data loss protection, and security information and event management (SIEM).

How to Implement Zero Trust

Unlike many other security risk management strategies, zero trust isn’t one thing you’ll do. Rather, it is a thought process or a mindset that should exist within your organization. Additionally, implementation is a journey, not something an organization can deploy overnight.

The upside is that zero-trust implementation doesn’t require a complete overhaul of your current cybersecurity architecture. Many organizations use one or two of the aforementioned core principles, even if they don’t have a zero-trust security strategy in place. Once an organization has a zero-trust security strategy in place, finding, vetting, and implementing the right supporting technologies used for governance, security, and compliance is critical.

Zero-trust Environment Design

For organizations seeking to tackle the implementation of a zero-trust approach, the following are focus areas within the network and infrastructure that need to be addressed.

Identity security

This involves a system where each user who accesses the network is identified through a unique set of attributes. To make identity security even more robust, access to high-value assets should have an additional layer of biometric features unique to specific users.

Endpoint security

Just like all users are identified, authenticated, and verified, so too should all devices within the network. Endpoint devices are one of the most common routes through which cybercriminals gain access to a network. They take advantage of often weak security around peripheral endpoints to move in and start gaining their way through the network. However, in a zero-trust environment, all devices and users are logged and monitored. A record is kept of all endpoints, activity, and health.

Endpoint security must also extend to include Internet-of-Things (IoT) devices.

Antivirus and antispam capabilities must be built into sensitive content communications, checking to ensure that incoming content—whether sent or shared—does not contain malicious code and requests. As such, in the case of a zero-trust private content network approach, endpoint security must be integrated into the communication tools that are employed. This aspect of zero trust must be part of any organization’s third-party risk management approach.

Application security

Applications in a zero-trust infrastructure should be continuously monitored to detect any unauthorized applications or activity from applications within the network. Even applications in a zero-trust environment must be continuously verified to monitor for potential breaches.

Data security

Confidential data is at the center of all cybersecurity strategies. It’s a high-value asset that threat actors always seek upon entering your network. Data breaches where confidential data was lost increased by 33% in 2021, with the average cost of a breach growing to $424 million. Rogue nation-states and cybercriminals target it in motion and at rest, inside and outside the network.

Beyond cyber threats, organizations must comply with applicable data privacy laws and regulatory compliance in jurisdictions where they operate. Specifically, data protection laws such as the Federal Information Security Management Act (FISMA), Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and Data Protection Act (DPA) 2018 all specify how you must handle confidential data.

Executive Order 14028 and Zero Trust

The U.S. federal government recognizes the importance of zero trust. Executive Order 14028 serves as the impetus driving adoption—creating a mandate for federal agencies and their contractors to move from legacy security perimeter approaches to a zero-trust model. One of the factors behind EO 14028 is supply chain risk and the need to continuously monitor and manage third-party risk to federal agencies. Every user, application, and device must be verified to comply with zero-trust principles. The executive order also requires the protection of sensitive data through encryption, categorization, and segregation of data, including the ability to automatically detect and block unauthorized access.

Federal agencies are mandated to set zero-trust security goals by the end of fiscal year 2024. There are five pillars:

Develop a Data Security Strategy
Automate Security Responses
Audit Access to Sensitive Data
Govern Access to Logging and Information Security
Data Security.

Zero Trust and Sensitive Content Communications

Much greater attention is paid historically to network and workload access than to content. When content goes outside of the network and applications, privacy and compliance risks increase dramatically. Failure to employ a content-defined zero-trust model can put an organization at risk of regulatory noncompliance, IP theft, and brand damage. As many organizations lack a comprehensive zero-trust approach across their content communications channels, they are at serious risk. Kiteworks’ 2022 Sensitive Content Communications Privacy and Compliance Report found that fewer than half of organizations apply zero-trust principles across all their content communication channels—email, file sharing, file transfer, managed file transfer, web forms, and application programming interfaces (APIs).

Kiteworks enables organizations to deploy private content networks that unify, track, control, and secure sensitive content communications. Leveraging the Kiteworks platform, organizations can define, apply, and manage consistent zero-trust security policies across each communications channel. The centralized metadata also enables organizations to respond to privacy and compliance threats in virtual real time.

Back to Risk & Compliance Glossary