Zero Trust

Zero trust moves defenses from static, network-based perimeters to users, assets, and resources. In a perimeter model, subjects authenticated on the internal network are given access to a broad collection of resources, and unauthorized lateral movement inside the environment has been one of the biggest challenges. Zero trust responds to remote users, bring your own device, and cloud-based assets that sit outside an enterprise-owned network boundary.

NIST SP 800-207 sets out tenets for a zero trust architecture. All communication is secured regardless of network location. Access to each enterprise resource is granted per session, after trust in the requester is evaluated, and with the least privileges needed to complete the task. Access is determined by dynamic policy that includes the observable state of the client identity, the application or service, and the requesting asset.

In the abstract model, a subject reaches an enterprise resource through a policy decision point (PDP) and a policy enforcement point (PEP). The policy engine within the PDP makes the final decision to grant access, and the PEP enables, monitors, and eventually terminates the connection between the subject and the resource.

Zero trust is not a single architecture but a set of guiding principles, and moving to it cannot be accomplished by a wholesale replacement of technology. NIST SP 800-207 expects most enterprises to operate in a hybrid zero trust and perimeter-based mode, possibly for an indefinite period, migrating one business process at a time.