What Is Zero Trust Security?
Whether your organization adopts language and actions around zero trust, zero trust security framework or architecture, or perimeter-less security, the overarching premise of each term remains the same. Each refers to a security strategy and framework for IT that requires users – both in and outside of the organizational network – to continuously be authenticated, authorized, and validated to get and keep their access to applications and data. Zero trust embeds security throughout the architecture to prevent malicious entities from accessing your most critical assets.
Recent research revealed that 44% of enterprises were considering a zero trust network access or software-defined perimeter to keep the organization secure. This shift to operating with a zero trust framework comes with the growing recognition that there is no longer a traditional “edge” to the network. Rather, organizations are increasingly working with perimeter-less security needs and threats.
The Zero Trust Security Framework: A Mindset Combined with Technical Solutions
Enforcing a zero trust security mindset at an organization requires continual education and proactive reinforcement to help the model be effective. Zero trust principles aren’t about not trusting employees; rather, they are a way to help organizations securely take advantage of operating in any location – on-premises, via the cloud, or as a hybrid situation. This is a win-win for employees now working around the world and not just “at the office.”
Key Zero Trust Framework Concept
The mantra behind zero trust, “Never trust, always verify” is the primary concept behind this security model and essentially means that the many users, interconnected devices, applications, and systems in play each day shouldn’t be considered or trusted as secure by default. Adopting this premise requires both a shift in philosophy as well as the layering of security solutions around each of its users, connections, and devices every day, with every transaction.
And this mindset applies even if connected to the corporate LAN, or VPN, or if previously verified as secure. With zero trust in place, organizations can help ensure that users, along with the devices and processes they use to store, manipulate, and send data, are identified and authenticated no matter where they are, or when they were first authorized. Zero trust recognizes that breaches will likely continue to occur, but that the damage from one can be contained, and remediation following a breach can be more effective and efficient with the appropriate cybersecurity model in play.
Related Content: How and Why to Implement Zero Trust Architecture Via Layered Security
How to Apply a Zero Trust Security Framework
Putting a zero trust security framework in place as a cybersecurity strategy involves applying security measures based on context. Unlike traditional security measures such as network-based solutions and firewalls designed to prevent unauthorized users from going in and out of the network, today’s cybersecurity strategies need to also address context in hybrid and cloud environments as well.
This framework is more important than ever, with the growing employee movement to working from home, where the environment is inherently more vulnerable. Whether your organization is still wholly on-premises, your offices are emptying out in favor of a work-from-home model, or somewhere in between, control and visibility into the environment need to be enabled for a zero trust security framework. Only then can you monitor and verify any movement of data within and outside the organization.
Surprisingly to organizations first digging into zero trust architecture, the network itself is not the biggest cybersecurity risk. Today’s organizations are typically more perimeter-less, or without a network edge. Rather, the cybersecurity risk addressed by zero trust is the risk to the data itself, whether on premises, stored in a data center, or existing in a cloud or multi-cloud environment.
Access Controls Form Base of Zero Trust Security Frameworks
A key tenet of the zero trust security framework is applying least-privileged access controls to help remove the risks taken with assumed trust, through strict user authentication. When incorporating least-privileged access policies, users receive only the minimal level of access as defined by their job-specific responsibilities. This helps narrow movement and unauthorized access and delineates access by the user’s role, the data needed, location, and devices being used. Any inappropriate access to data, or movement of files or data throughout the organization, can be automatically blocked.
With zero trust, protection zones are created to provide visibility and IT mechanisms designed to secure, manage, and monitor every user, device, network, application, or data packet both at the perimeter and within a network environment.
One way to affirm zero trust is to assume everything coming into or out of your network and everything already in the perimeter is a threat by default – and set up the layers of security with that thought in mind. Ensuring that communication is blocked unless validated by established attributes or policies is key. Multi-factor authentication, identity-based attributes, one-time codes, etc., all deliver strong security that can travel alongside the data being communicated, even across varied network environments.
Extending with Adaptive Trust
Access controls are a key tenet of the zero-trust framework. However, bad actors are sophisticated enough to masquerade as authenticated users. This is where adaptive trust plays a key role. Adaptive trust is the principle where a trusted user is monitored for activity that increases risk to the organization. A baseline is created for each user and any anomalous activity triggers an action. The action may be an alert, or it may be changing to a more restrictive policy. Behavior analytics is used to create a baseline of normal activity consisting of several data points, including the time of day logged in, sites visited, and data handled. Any deviations from this activity trigger the action or set of actions.
A Stepped, Simplified Approach to Adapting a Zero Trust Security Framework
The process of moving towards a zero trust framework can be overwhelming, and an incremental approach to zero trust can help move the cybersecurity stance forward over time. John Grancarich, Executive Vice President, Fortra, outlines a management process to achieve progress towards zero trust:
Principles of the Zero Trust Security Framework
By adhering to three key principles, organizations can build their zero trust model knowing they are following the rigid standards laid out in 2021 for U.S. federal agencies to adhere to NIST 800-207 as a required step for zero trust implementation. The standard went through extensive validation and input from various agencies, vendors, and commercial partners, and serves as a baseline for private organizations to follow. The three principles are:
Terminate all connections
Traditional firewall technologies inspect files as they enter the network. Often, by the time an intrusive or malicious file is detected, it is too late. With zero trust solutions applied, every connection is terminated, and all traffic, even encrypted traffic, is inspected in real time. This pre-destination inspection can help prevent ransomware, malware, and other external threats.
Apply automated, continuous context-based policies to protect data
Rather than default to a trust relationship for access, zero trust policies require access requests to be verified. Any rights granted are based on context, type of content, user identification, the device used, location, and what application use is being requested. Continual evaluation of these user access privileges helps ensure context is applied with every transaction.
Eliminate the attack surface to reduce risk
Users connect directly to the applications and data they need, not to networks, with a zero trust architecture. This direct approach to connections helps eliminate lateral movement risk and stops any compromised devices from infecting other resources should a breach occur.
Why Choose a Zero Trust Security Framework?
If you’re trying to determine if a zero trust security framework makes sense for your organization’s cybersecurity needs consider how cybercrime has ramped up, especially as more business is conducted in a cloud environment. Can you risk having your data stolen or destroyed or even held for ransom? Can you weather the PR storm of your customers’ personally identifiable information (PII) or other sensitive data such as financial or health information being stolen or exposed?
Data breaches and cybersecurity risks will continue to be a factor in the near and distant future. Adopting zero trust, however, is an effective strategy to use to help minimize those risks. By reducing the attack surface, should a breach occur, the overall impact, cost, and drain on resources can be mitigated.
Zero Trust Security Framework Use Cases
Compliance requirement support
If your organization must adhere to industry compliance standards such as the federal government’s NIST 800-207, the payment card industry’s PCI DSS, or the healthcare industry’s HIPAA and HITECH requirements, the closed connection tenant of zero trust helps prevent exposure or exploitation of sensitive or private data. With zero trust you can set up controls to segment data that is regulated from non-regulated data, providing more visibility for audit purposes, as well as mitigation of a data breach.
Related Content: Key Takeaways from Biden's Sweeping Executive Order on Cybersecurity
If your organization must adhere to industry compliance standards such as the federal government’s NIST 800-207, the payment card industry’s PCI DSS, or the healthcare industry’s HIPAA and HITECH requirements, the closed connection tenant of zero trust helps prevent exposure or exploitation of sensitive or private data. With zero trust you can set up controls to segment data that is regulated from non-regulated data, providing more visibility for audit purposes, as well as mitigation of a data breach.
Related Content: Key Takeaways from Biden's Sweeping Executive Order on Cybersecurity
Overall risk reduction
The “never trust, always verify” approach to zero trust prevents applications and services from communicating until verified by predefined trust principles such as authentication and authorization specifications. By providing insight into what is on the network and how those assets communicate, zero trust reduces risk. And this strategy can also provide continuous confirmation of the acceptability of all communicating assets to reduce the risk of overprovisioned software and services.
The “never trust, always verify” approach to zero trust prevents applications and services from communicating until verified by predefined trust principles such as authentication and authorization specifications. By providing insight into what is on the network and how those assets communicate, zero trust reduces risk. And this strategy can also provide continuous confirmation of the acceptability of all communicating assets to reduce the risk of overprovisioned software and services.
Better cloud environment access control
If you’ve moved workloads to the cloud, or are operating in a hybrid environment, the fear of losing control and visibility is not unfounded. With a zero trust security framework in place, however, you can apply security policies to validate identities of communicating workloads.
This helps to keep your security tied to the assets most in need of protection and it does not reply upon network security elements such as IP addresses, protocols, or ports. With zero trust solutions, the protection gained is attached to the workload and even if the environment is changed, the security remains.
If you’ve moved workloads to the cloud, or are operating in a hybrid environment, the fear of losing control and visibility is not unfounded. With a zero trust security framework in place, however, you can apply security policies to validate identities of communicating workloads.
This helps to keep your security tied to the assets most in need of protection and it does not reply upon network security elements such as IP addresses, protocols, or ports. With zero trust solutions, the protection gained is attached to the workload and even if the environment is changed, the security remains.
Data breach risk reduction
As cybersecurity pros express, a data breach is not a question of “if” but “when.” With zero trust’s least privilege access, that assumes all entities are hostile. Organizations can gain more peace-of-mind knowing all transactions, users, and their devices are inspected and authenticated before “trust” is granted. And this validation is under continuous assessment to account for changes in the users’ devices, locations, or data requests.
Should an attacker still breach your network or cloud environment, with zero trust principles and tactics applied, their ability to steal or access your sensitive data is stopped as the model creates segmentation, so no lateral moves are possible.
As cybersecurity pros express, a data breach is not a question of “if” but “when.” With zero trust’s least privilege access, that assumes all entities are hostile. Organizations can gain more peace-of-mind knowing all transactions, users, and their devices are inspected and authenticated before “trust” is granted. And this validation is under continuous assessment to account for changes in the users’ devices, locations, or data requests.
Should an attacker still breach your network or cloud environment, with zero trust principles and tactics applied, their ability to steal or access your sensitive data is stopped as the model creates segmentation, so no lateral moves are possible.
How Fortra Helps Support a Zero Trust Security Framework
When it comes to supporting a zero trust environment, Fortra delivers trusted, best-in-class solutions to help ensure security for your most valued asset – your business-critical data.
Zero Trust File Transfer
A zero trust environment is one that ensures documents are secure both while in transfer and at rest. Secure file transfer (SFT) solutions such as GoAnywhere MFT can do the heavy lifting of securely moving files. When bundled with the Clearswift Secure ICAP Gateway and Digital Guardian Secure Collaboration, the protection surrounding data is taken further. With secure collaboration applied to MFT transactions, you gain both control and protection, as access controls over encrypted files travel with the files and can be revoked at any time – a key tenet of zero trust.
Other Solutions from Fortra
Zero trust is about more than network segmentation. Fortra can help you encrypt and securely share data with authorized individuals while protecting it from viruses and malware.
How Fortra Supports the Zero Trust Journey
Fortra works with customers across every industry on their zero trust journeys. Rather than solve every piece of the zero trust puzzle, we serve as an ally and partner in the process, helping first identify the problems you need to solve and then determining what controls will fit your problem set. View the datasheet for more information.
