What Is Zero Trust?

Access to resources driven by evaluation not location.

So, now we have that approach, the ZT strategy, which is planned as an architecture. To boil it down ZT is not allowing any peer to be trusted until it demonstrates it can be, period. For what it's worth that's the ideal state. Assume everything not evaluated as trusted is compromised. This is done without respect to any proximal assumptions about controls. That is to say just because it's in my network, behind my firewall, and it looks like my laptop doesn't mean I should trust it. Implicit trust should be reduced to as few cases as possible. The development of this thinking is couched in the evolved understanding of protection inside the network that includes new and expansive implementation of technologies that are not tethered within the boundaries that we control. There needs to be some other way to establish that trust.

This means also that any trust must be evaluated continually and not just once or based on past relationships. The evaluation should also be carried out for everything from the person to the infrastructure. To do this ZT access is governed by authentication and authorization as implemented through a policy. The policy sets up the parameters that make up the trust decision and then that decision is enforced and either accepts or denies the access to resources. This is called the Policy Decision/Policy Enforcement Point (PDP/PEP) gateway. Also, by that abstraction there can be established the smallest possible "implicit trust zone."

Behind the rope line 

Think about it like a club. Do you have ID? Wearing a jacket, shirt, shoes? Those are the rules. No one gets pass that first bouncer without those things, in proper order and at the right time. Everyone gets checked. Once you are pass the first bouncer you are in a zone where all of that which was used to let you in can be assumed to be true about everyone in the club. If you want to go to the VIP room, there's another bouncer (another PDP/PEP) and you're checked for your black card. Is it expired? Does it match your ID? etc., if you've got what's required you get into the party, and so on. This strategy can be implemented in a plethora of modes that defend the access to resources based on predetermined criteria.

The Bottom Line

It should be understood that this is not a new thing but a new way of thinking about things. I tend to say "Internet has always been of things." The reason being that many concepts have been around for quite some time. Zero Trust is another one of those things that has now been codified via a trusted source at NIST. Think about it the next time you get table service at an exclusive club. Engineering is sexy.