How to Implement a Zero Trust Security Model
Looking to implement zero trust in your organization but don’t know where to start? Keep reading to find the best way to get a zero-trust model up and running.
What is zero trust? Zero trust is a security strategy that requires continual authentication through every step of access in that no user is given implicit trust.
What Is Zero-Trust Architecture?
Zero-trust architecture is an approach to security that presupposes that no user, resource, or application is considered inherently trusted by the system. In an age of seamless app integration and simplified user experiences through shared resources, zero trust attempts to close the security gaps introduced by such approaches.
Why Zero Trust is Important
This approach is critical when we consider that modern computing is essentially cloud computing–that is, most agencies, enterprises, and end users are engaging in some way with shared cloud-hosted computing resources. This has led to several notorious security issues over the past 5-10 years, and in industries where security is paramount (industrial industries, government services, etc.), those issues must be avoided.
The National Institute of Standards and Technology (NIST) published Special Publication 800-207, “Zero Trust Architecture,” to address this specific issue. This special publication lists seven core tenets of an accurate zero-trust system:
- All data and services are resources. Any component of a digital system, from apps to data and network connections, is considered a resource that can be exploited, corrupted, or stolen. As such, they must all fall under the designation of a resource for security purposes.
- All communication is secured. All network communications must be secured through perimeter security and encryption, whether external or internal to the organization.
- Access is on a per-session basis. Access is only granted per resource, with the least privileges needed to complete a given task.
- Access policies should be dynamic. Policies around user or app access should be determined by the evolving contexts of the system, including time and date, location, versions of applications, client or user identity, behavioral biometrics, and more.
- Ongoing monitoring should measure the integrity of security. An organization must continually monitor resources to ensure they have not been compromised. No resource is inherently considered trustworthy to avoid threats from APTs and advanced attacks.
- Authentication and authorization are strictly enforced. An enterprise must use ongoing authentication and authorization, Identity, Credential, and Access Management (ICAM) and Multi-Factor Authentication (MFA) to determine identity and re-authenticate and reauthorize users based on ZTA policy.
- Data gathering and improvements are ongoing projects. The organization must maintain continuous monitoring and data gathering to fuel ongoing improvements to security measures implemented.
With these core principles in mind, several models of zero trust are in use:
- Zero Trust Network Access (ZTNA): The most common form of zero trust, ZTNA includes perimeter-based security, perimeter authentication and authorization, segmentation of network resources, and secure access from external networks. This does not, however, impact application use or other select areas of security.
- Zero Trust Application Access (ZTAA): Using zero trust principles, ZTAA assumes that all apps and resources are inherently untrusted and blocks access to and from these resources until proper authentication is provided.
- Zero Trust Access (ZTA): ZTA combines ZTNA and ZTAA to protect networks and application access points. This is generally considered “end-to-end” zero trust and is the most comprehensive, but can require a fundamental adjustment in how your organization thinks about its IT infrastructure.
How to Implement Zero-Trust Principles
One of the most challenging components of a zero-trust security framework is its implementation. Such implementation requires that all appropriate systems and networks fall under such principles, a deep, complicated, and thorough standard to meet.
However, there are specific things that your team can do to start implementing such an architecture:
- Understand All Attack Surfaces: While this might seem common sense in the world of compliance, it states that pursuing zero-trust architecture means understanding all the potential attack surfaces you maintain. Namely, all resources, network connections, APIs, applications, etc.
- Implement Ongoing Logging and Monitoring: Ongoing monitoring and audit logging is necessary, not an option. Not only is this practice critical for ensuring that resources are trustworthy (a key and continuous process in zero-trust systems), but it also informs the equally necessary practice of maintaining secure, upgraded, and optimized infrastructure.
- Implement Strong Encryption for Internal Communications: All communications, from apps to internal and external network communications, must be protected. This means shrinking perimeter guards closer to the resources they protect and encrypt any and all data that moves through protected networks.
- Use Strict Multi-Factor Authentication and Access Management Controls: Authentication must be strong enough to ensure a user is who they are, which by default means MFA is equipped with something like advanced biometrics or secure delivery of OTPs.
This also means implementing strict least-privilege access controls based on a dynamic set of features, namely role, system and hardware state, software state, and user behavior.
- Update All Devices and Applications: All devices must be safely and regularly updated to meet minimum security requirements. More specifically, this means ensuring that security patches are deployed and implemented as soon as possible.
- Have Strict Governance Policies in Place: Zero trust is not an ad hoc process. Your organization must have clear, documented, and distributed data and IT governance policies that align with zero trust issues. This includes defining a hierarchy of roles, accountability, and responsibilities for all affected positions.
What Are the Benefits and Challenges of Zero Trust?
Like any other technology or security approach, zero trust comes with several challenges and benefits that impact how it is used. Each organization may run into unique challenges and benefits, but there are some broad considerations to consider.
Some of the benefits of zero trust include:
- Security: Approaching IT with zero trust principles is remarkably secure. They do not allow trusted access to resources and require incessant authorization before such access is granted. Likewise, it’s an approach to trust for internal resources that drives users always to ensure that their IT infrastructure isn’t compromised.
- Compliance: With the release of the Executive Order on Cybersecurity, government and infrastructural cybersecurity are quickly undergoing an overhaul of security guidelines–namely, that they all meet zero trust principles. If you’re working with these industries or adjacent industries, zero trust is a genuine concern that you’ll want to meet.
- Trust: Approaching security via zero trust means that anyone accessing resources is who they say they are once you’ve laid out the proper security and monitoring procedures.
Likewise, there are several challenges to implementing zero-trust architectures:
- Complexity: Zero trust is complicated and can touch on every interlocked system in your IT infrastructure. If you’re looking at full ZTA implementation, it could require a complete revision of how you approach IT adoption, organization, and security.
- Cost: As you approach such a massive overhaul, costs in time and money grow. Once some of the components are in place, there is a leveling off, but the onboarding and maintenance cost is still significant.
- Flexibility: Zero trust is strict and doesn’t broach any breaks in the trust cycle for scalability or usability. If you want a more streamlined app that doesn’t fit into ZTA, then you simply aren’t using that app and staying in line with its principles.
Implement Strong Authentication for Zero Trust with 1Kosmos
The cornerstone of zero-trust architecture is the implementation of secure and accurate authentication. With the right authentication controls in place, you can control access to resources effectively at the point of entry and during any additional movement through a system.
1Kosmos provides robust multi-factor authentication, passwordless authentication, and compliant identity assurance and anti-spoofing measures in a single, user-friendly application. With 1Kosmos, you can use the following features:
- SIM Binding: The BlockID application uses SMS verification, identity proofing, and SIM card authentication to create solid, robust, and secure device authentication from any employee’s phone.
- Identity-Based Authentication: We push biometrics and authentication into a new “who you are” paradigm. BlockID uses biometrics to identify individuals, not devices, through credential triangulation and identity verification.
- Cloud-Native Architecture: Flexible and scalable cloud architecture makes it simple to build applications using our standard API and SDK.
- Identity Proofing: BlockID verifies identity anywhere, anytime and on any device with over 99% accuracy.
- Privacy by Design: Embedding privacy into the design of our ecosystem is a core principle of 1Kosmos. We protect personally identifiable information in a distributed identity architecture and the encrypted data is only accessible by the user.
- Private and Permissioned Blockchain: 1Kosmos protects personally identifiable information in a private and permissioned blockchain, encrypts digital identities, and is only accessible by the user. The distributed properties ensure no databases to breach or honeypots for hackers to target.
- Interoperability: BlockID can readily integrate with existing infrastructure through its 50+ out-of-the-box integrations or via API/SDK.
To learn more about 1Kosmos and zero-trust architecture, read our whitepaper on Zero Trust.
