This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
Zero Trust
Zero Trust

Version management

Difference between version and

At line 1 added 68 lines
!!! Overview
[{$pagename}] is a [data-centric] [architecture] and [Access Control Models] that puts micro-perimeters around specific [data] or [resources] so that more-granular [Access Control Policy] rules can be enforced and implemented. [{$pagename}] model, or ZT was first in [2010|Year 2010] by John Kindervag of [Forrester] Research in the document No More Chewy Centers: Introducing The Zero Trust Model Of Information Security[{$pagename}] core principle is to not allow any [access] to network [resources], internal [IP Address], or [servers] until the [entity] properly [authenticated] and their [Access Request] to the specified [resource] is [authorized].
Digitally [Trust] is a [Binary] [True] or [False] decision. [{$pagename}] implies there is no [Trust].
!! Never [Trust], Always [Verify|Verification] [1] [2]
* Never trust the [client]
* Never [Trust] the [server]
* Never [Trust] the [network]
[NIST.SP.800-207] [{$pagename}] Model clearly states that the goal of [{$pagename}] is to focus security on a small group of [resources] (zones) in lieu of wide network perimeters or environments with large quantities of [resources] interacting "freely". This is a strategy where there is no implicit [trust] granted to systems based on their physical or network location ([Local Area Networks], [Wide Area Networks], and the [Cloud]), but rather access is granted by a trusted source for either a [UserId] or [application] (i.e. [Digital Identity]).
!! [BeyondCorp]
[BeyondCorp] is an implementation by [Google] for a [{$pagename}] [Architecture].
The Zero Trust [Architecture] is simple: [cybersecurity] professionals must stop trusting [packets] as if they were [people|persons]. Instead, they must eliminate the idea of a [trusted network] (usually the internal network) and an
[untrusted network] (external networks). In [{$pagename}], all network traffic is __untrusted__.! [Forrester]’s [Zero Trust] Model has three key concepts: [3]
* Ensure all [resources] are accessed securely regardless of location. Assume that all traffic is [threat|Attacker] traffic until your team verifies that the traffic is [authorized], inspected, and secured. In real-world situations, this will often necessitate using [encrypted] tunnels for accessing [data] on both internal and external [networks]. Cybercriminals can easily detect unencrypted [data]; thus, [{$pagename}] demands that security professionals protect internal data from [insider abuse|Internal Attacker] in the same manner as they protect external [data] on the public [Internet].
* Adopt a [Principle of least privilege] strategy and strictly enforce [Access Control]. When we properly implement and enforce [Access Control], by default we help eliminate the [human temptation|Human Limitation] for people to [access] [Protected Resources]. Today, [Role Based Access Control] ([RBAC]) is a standard technology supported by network [Access Control] and infrastructure software, [Identity and Access Management] systems, and many applications. [{$pagename}] does not explicitly define [RBAC] as the preferred access control methodology. Other technologies and methodologies will evolve over time. What is important is the [Principle of least privilege] and strict [Access Control].
* Inspect and perform [logging] all traffic. In [{$pagename}], someone will assert their [Digital Identity] and then we will allow them [access] to a particular [resource] based upon that [assertion]. We will restrict [clients] only to the [resources] they need to perform their job, and instead of trusting [clients] to do the right thing, we verify that they are doing the right thing.
In short, [{$pagename}] flips the mantra "[trust] but verify" into "verify and never [trust]." [{$pagename}] advocates two methods of gaining [network] traffic visibility: [monitoring] and [logging]. Many security professionals do log internal network traffic, but that approach is passive and does not provide the real-time protection capabilities necessary in this new threat environment.
[{$pagename}] promotes the idea that you must be [monitoring] traffic as well as [logging] it. In order to do so, [Network Analysis] and visibility (NAV) tools are required to provide scalable and non-disruptive situational awareness. NAV is not a single tool, but a collection of tools that have similar functionality. These NAV tools include network discovery tools for finding and tracking assets, flow data analysis tools to analyze traffic patterns and user behavior, packet capture and analysis tools that function like a network DVR, network metadata analysis tools to provide streamlined packet analysis, and network forensics tools to assist with incident response and criminal investigations.
[Forrester] says there are only two [Data Classifications] that exist in your organization:
* Data that Someone Wants to Steal ([Item of Interest])
* Everything Else
The first type is sensitive or toxic data, which can be easily identified with the equation 3P + IP = TD.
The three P's stand for
* [Personally Identifiable Information] ([PII])
* [Protected Health Information] ([PHI])
* [Payment Card Industry] ([PCI])
* IP is [Intellectual Property]
* TD is [toxic data|Sensitive Data].
[Forrester] breaks the problem of securing and controlling data down into three areas:
* Defining the data - This involves [Data Discovery] and [Data Classification]. Security and [risk] professionals, together with their counterparts in [legal] and [privacy], should define [Data Classification] levels based on data sensitivity. This allows [security] to protect properly data based on its [Data Classification] once it knows where that [data] is located in the enterprise.
* Dissecting and analyzing the data - This involves data intelligence (extracting information about the data from the data, and using that information to protect the data) and data analytics (analyzing data in near real time to protect proactively toxic data). Look for security information management (SIM) and network analysis and visibility (NAV) solutions to intersect with big data to enhance security decision-making.
* Defending and protecting the data - [Data Protection] is the fundamental purpose of [cybersecurity], and is the area where organizations focus most today. To defend your data, there are only four levers you can pull:
** [Access Control]
** [Data Security Analytics]
** [Data Disposal]
** [encryption] to devalue it in the event that it is stolen.
Zero Trust is:
* applicable across all industries and organizations – It is an easy to implement way to improve safety that any organizations can implement.
* __not__ dependent on a specific technology or vendor – [{$pagename}] is a vendor neutral design philosophy that allows maximum flexibility to create architectures that meet specific demands.
* scalable – Vital information is protected while public facing data travels freely.
* focuses on keeping internal [data] safe and would __not__ result in any foreseeable encroachment on Civil Liberties.
[{$pagename}] promotes [Access Control] around each [resource]
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
----
* [#1] - [The three rules of network security|https://craignicol.wordpress.com/2014/05/27/the-three-rules-of-network-security/|target='_blank'] - based on information obtained 2017-12-02-
* [#2] - [Hack yourself first|https://www.troyhunt.com/hack-yourself-first-how-to-go-on/|target='_blank'] - based on information obtained 2017-12-02-
* [#3] - [The Eight Business And Security Benefits Of Zero Trust|https://www.forrester.com/report/The+Eight+Business+And+Security+Benefits+Of+Zero+Trust/-/E-RES134863|target='_blank'] - based on information obtained 2017-12-02-
* [#4] - [What ZTX means for vendors and users|https://go.forrester.com/blogs/what-ztx-means-for-vendors-and-users/|target='_blank'] - based on information obtained 2018-04-21-
* [#5] - [Zero Trust X: Evolution of the Zero Trust Model (Dr. Cunningham, Forrester), 2018 ICIT Winter Summit|https://www.youtube.com/watch?v=OiXSA0JWH7M|target='_blank'] - based on information obtained 2018-04-21
* [#6] - [Rethink Security with Zero Trust|https://www.centrify.com/zero-trust-security/|target='_blank'] - based on information obtained 2018-04-21-
* [#7] - [Getting Started With a Zero Trust Approach to Network Security|https://cyber-edge.com/wp-content/uploads/2017/01/Palo-Alto-Networks-White-Paper.pdf|target='_blank'] - based on information obtained 2017-12-21
* [#8] - [No More Chewy Centers: Introducing The Zero Trust Model Of Information Security|https://www.ndm.net/firewall/pdf/palo_alto/Forrester-No-More-Chewy-Centers.pdf|target='_blank'] - based on information obtained 2010-09-14
* [#9] - [Five Steps to Perimeter-Less Security: Adopting a Zero-Trust Model for Secure Application Access|https://duo.com/resources/ebooks/five-steps-to-perimeter-less-security-adopting-a-zero-trust-model-for-secure-application-access|target='_blank'] - based on information obtained 2019-09-09
* [#10] - [Zero trust architecture design principles|Zero trust architecture design principles|target='_blank'] - based on information obtained 2019-12-10
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop