Zero Trust

Why It Matters

The traditional castle-and-moat security model assumed strong perimeters around trusted internal networks. That assumption collapsed under the pressures of cloud adoption, remote work, BYOD, mobile access, and supply chain integration. Once attackers cross the perimeter, often through phishing or stolen credentials, lateral movement to high-value targets becomes trivial.

Zero Trust addresses this by treating every request as untrusted. Major breaches like SolarWinds, the Microsoft Storm-0558 incident, and countless ransomware events demonstrate how identity-based and lateral-movement attacks bypass perimeter defenses. Zero Trust is now a core directive in US Federal cybersecurity (OMB M-22-09) and a recommended approach across industries.

Core Tenets (NIST SP 800-207)

1. All data sources and computing services are considered resources.
2. All communication is secured regardless of network location.
3. Access is granted per-session, not persistently.
4. Access is determined by dynamic policy including identity, device, behavior.
5. The enterprise monitors integrity and security posture of all assets.
6. Authentication and authorization are dynamic and strictly enforced before access.
7. Telemetry is collected and used to improve security posture.

Reference Architecture

Pillars of Zero Trust

CISA's maturity model defines five pillars:

1. Identity: phishing-resistant MFA, IAM modernization, just-in-time access
2. Devices: posture validation, MDM, EDR coverage, compliance gates
3. Networks: micro-segmentation, encrypted internal traffic, DNS security
4. Applications and Workloads: secure dev, runtime protection, mTLS
5. Data: classification, encryption, DLP, rights management

Cross-cutting capabilities: visibility and analytics, automation and orchestration, governance.

ZTNA vs VPN

Legacy VPN:
- Grants broad network access after auth
- Single point of failure
- Lateral movement risk after compromise
- Often unaware of device posture

Zero Trust Network Access:
- Application-level access only
- Continuous policy evaluation
- Device posture and identity required per session
- Default-deny with explicit allows

Implementation Roadmap

A pragmatic Zero Trust journey:

1. Inventory: assets, identities, applications, data flows
2. Identity foundation: SSO, MFA everywhere, conditional access
3. Device trust: enforce managed/compliant devices for sensitive apps
4. Application access: deploy ZTNA in front of high-risk apps
5. Micro-segmentation: limit east-west traffic in data centers and clouds
6. Data protection: classification and policy-based encryption
7. Telemetry and analytics: feed SIEM/XDR for continuous monitoring
8. Iterate: expand coverage, tighten policies, automate response

Common Misconceptions

Related Concepts

• Identity and Access Management
• Cloud Security
• Security Framework
• Multi-Factor Authentication