Zero Trust.

What is zero trust?

Zero trust is a way of designing security. NIST SP 800-207 calls it an evolving set of cybersecurity paradigms. These paradigms move defenses away from static, network-based perimeters. They focus on users, assets and resources instead.

CISA describes zero trust as designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions. Least privilege means giving a user or system only the access it needs. CISA also describes a move from traditional perimeter-based security to an approach that emphasizes data protection and granular controls across users, systems and assets.

How does zero trust work?

The core idea in NIST SP 800-207 is that no implicit trust is granted to assets or user accounts based only on their physical or network location. Trust is also not granted just because an organization owns the asset.

NIST says authentication and authorization, for both the subject and the device, are separate functions. They are performed before a session to an enterprise resource is established. Authentication means proving who or what is asking. Authorization means deciding what that requester may do. The focus is on protecting resources such as assets, services, workflows and network accounts, not network segments.

Why did zero trust appear?

NIST links the approach to trends in modern enterprises. These include remote work, bring-your-own-device policies, and cloud-based assets that sit outside the traditional enterprise network boundary.

What is a zero trust architecture?

A zero trust architecture (ZTA) is, in plain terms, a plan that applies zero trust ideas. NIST SP 800-207 is titled Zero Trust Architecture. Zero trust is the idea. The architecture is the plan that applies it.

What is the CISA Zero Trust Maturity Model?

CISA publishes a Zero Trust Maturity Model to help agencies build zero trust strategies and implementation plans. Version 2.0 has five pillars and three cross-cutting capabilities. For each pillar, it gives examples across four stages: Traditional, Initial, Advanced and Optimal.

CISA calls the model one of many roadmaps that agencies can use as they move towards a zero trust architecture.

A simple illustration

This is a generic illustration only. In a perimeter-based design, a device that is already inside the network may be trusted by default. Under zero trust, that device would still have to be authenticated and authorized before it could reach a given resource.

Is zero trust a product you can buy?

The sources describe zero trust as a set of paradigms and an approach to access decisions. NIST describes it as a set of paradigms. Neither source describes it as a single tool.

Is zero trust the same as zero trust architecture?

Not exactly. Zero trust is the set of ideas. A zero trust architecture is what you get when an organization applies those ideas to its infrastructure planning.

How does zero trust relate to nearby terms?

Related terms are multi-factor authentication and cloud security. NIST names cloud-based assets as one reason the approach emerged.