The fundamentals of implementing a zero trust security policy

What exactly does it entail to enforce a zero trust security policy? A lot.

Image by lovephoto via Freepik

Zero trust isn’t a product.

Rather, zero trust essentially serves as a security framework. It refers to a comprehensive, strategic approach to security that makes sure every user and device that is given access to a company’s resources is who or what they claim to be.

There is an old adage: “If you can’t trust anyone, trust no one.” That’s zero trust in a nutshell. No actor may be trusted in an environment until they have been appropriately, and continually, validated.

Here’s a quick primer on zero trust, outlining the basics, such as what it is and how to implement it.

Why is zero trust relevant today?

The traditional security perimeter is almost nonexistent and continues to vanish by the minute. Data is currently dispersed across an almost infinite number of services, devices, apps and individuals, and this number will continue to grow.

Zero trust assumes that the conventional network edge does not exist. Networks in the modern enterprise can be local, on the cloud or a part of a hybrid architecture. Workers who have access to resources can be located anywhere, as can the resources themselves.

If a company continues to use an outdated perimeter security model, its digital assets are at risk of being lost. If this sounds familiar, it’s time to think about making a change.

Even federal government agencies are currently transitioning to zero trust. In fact, that is a major factor in why this methodology has drawn so much attention in the past 12 months.

The Biden administration mandated that federal agencies transition to a zero trust security architecture in May 2021 with the release of its Executive Order on Improving the Nation’s Cybersecurity. It then followed up with the federal zero trust architecture strategy earlier this year, which defines the precise steps federal agencies must take to embrace zero trust architecture over the coming years.

While many public and private companies don’t have to switch to zero trust, they do so because they believe it will lower risk and improve digital transformation security.

Best practices for zero trust security

What exactly does it entail to enforce a zero trust security policy? A lot. It calls for the implementation of a variety of security best practices — ones that, given the nature of the current cybersecurity threat landscape, merely make good economic sense.

For instance, an organization that has embraced a zero trust paradigm must put into operation procedures like:

Utilizing multi-factor authentication to confirm each user’s identity (MFA).
Ensuring regular patch management and software updates keeps all devices current and functional.
Comprehensive observation and monitoring to gather the most useful information to guide access control implementation.
Restricting access to specific assets, data, applications and resources rather than the entire network.

Step 1: Figure out what you need to safeguard the most

What exactly is the first step in establishing zero trust, aside from making the decision to proceed? Outlining the “protect surface” — or what is most valuable to your company — is the first step. To keep the business operating regularly, what data, applications, assets and services (DAAS) does the organization need to protect?

Instead of trying to identify and defend the full attack surface or concentrating simply on the perimeter (which we already know is ineffective), an organization may strategically focus its resources on defending what really matters to the business by defining the protect surface. Additionally, protection is made simpler because the protect surface is considerably smaller than the attack surface or the perimeter.

Step 2: Identify every crack and crevice in your network

Once the protect surface is defined, it’s crucial to sketch out the network topology of the company when creating a zero trust architecture so you know where your assets are. The objective is to understand who your users are, what devices they use and what services and data they are accessing.

Any components that use the network should be handled with extra caution. Any network, private or public, must be considered hostile under zero trust. Consider any existing services that were not built for a zero trust architecture because they may not be

able to protect themselves under the new, stricter methodology.

The next step is to identify how your systems operate after the network topology has been mapped. In order to confirm that a user or entity satisfies the necessary requirements for getting access to protected areas, you will be better able to identify the locations where access controls are required. Additionally, by implementing these restrictions, security administrators will be able to ensure that no user-to-application communication takes place.

Step 3: Continuous Validation

To be clear, when a company chooses to take a zero trust security approach, it decides to demand that all users, whether they are inside or outside the organization’s network, be authenticated, authorized and continuously validated for security configuration and posture before they are given access to applications and data — or allowed to maintain access to those resources.

The truth is that zero trust is a journey, just like the digital revolution itself. Zero trust security can take years to implement, and as networks change, maintaining an effective architecture will be a continuous effort.

Additional guidance on zero trust security framework

Despite the efforts of many security vendors to define zero trust, there are standards from reputable organizations that can help businesses transition. For instance, the Identity, Device, Network, Application Workload and Data Zero Trust Maturity Model is provided by the Cybersecurity and Infrastructure Security Agency (CISA) and is meant to facilitate an organization’s zero trust journey.

All in all, the zero trust framework specifically tackles the security issues that the majority of modern enterprises are confronted with, including safeguarding remote workers and hybrid cloud systems as well as defending against disruptive, expensive cyber threats like ransomware.

By following these steps and understanding the fundamentals of zero trust, enterprises can implement a zero trust security strategy that keeps networks protected, secured and resilient.

Looking for a reprint of this article?
From high-res PDFs to custom plaques, order your copy today!

Patrick Beggs is Chief Information Security Officer at ConnectWise. He is a cybersecurity executive focused on leading global cyber operations and has more than 20 years of operational duties in information security, spanning the commercial, federal civilian, defense, law enforcement, and intelligence communities. Most recently, Beggs served as Cognizant Technology’s Global Cyber Operations Executive, where he led a team of more than 150 personnel operating across five countries. Prior to Cognizant, he led cyber operations for AIG, Booz Allen Hamilton, Amazon Web Services, and Bank of America. In the public sector, he served as the first Deputy Director/Director of Operations at the Department of Homeland Security’s (DHS) National Cybersecurity and Communications Integration Center (NCCIC).

Beggs is a former Army Infantry Non-Commissioned Officer and holds a B.S. in Political Science from Radford University. He also holds a patent for his work developing a new method of leveraging AI models for improving network security.