What Is Zero Trust Architecture?

Zero Trust Architecture (ZTA) builds on the foundational principles of zero trust security as defined by the National Institute of Standards and Technology (NIST) in publication 800-207. NIST recommends a focus on users, assets, and resources rather than traditional network boundary defenses.

At the most basic level, it consists of a design philosophy where nothing and no one is trusted solely based on location. In order to formulate an answer to the question “What is Zero Trust Architecture?” we must first understand the components of a secure design.

Zero Trust Network Architecture

As one of the key pillars of Zero Trust Network Architecture (ZTNA), the concept of least privilege security assigns access credentials to key network resources at the least privilege level required to accomplish the desired task. Identifying critical corporate information and how a user gains access to that information must be taken into consideration when evaluating alternative solutions.

Privileged Access Management (PAM), also known as Privileged Identity Management (PIM), can be implemented using corporate directory products such as Microsoft’s Active Directory. Microsoft has recently introduced a product named Microsoft Entra to address identity and access issues in a multicloud environment. Other vendors in the PAM/PMI category include Jumpcloud, IBM, Okta, and Sailpoint.

Very few corporate networks today operate in an isolated environment. To answer the “What is Zero Trust Architecture?” question completely we must include a discussion on how external users will be allowed to connect to internal corporate resources. This has traditionally been facilitated using a Virtual Private Network (VPN) requiring the proper credentials to establish the connection. Adding additional layers such as two-factor authentication and network isolation can help to minimize potential threats that could be introduced by an external source.

Secure Management and Administration

Automation is essential in the management and administration of complex networks. Properly securing all management functions must be a top priority in a Zero Trust Architecture. This can be achieved in a variety of ways. Some years ago, Microsoft introduced the concept of Just in Time (JIT) administration and Just Enough Administration (JEA) using the PowerShell scripting language. This idea builds on the concept of least privilege and adds time-bound credentials.

Another Microsoft PowerShell capability, called Desired State Configuration (DSC), leverages the Windows Management Framework to both configure and monitor network resources. DSC supports on-premises networks and in Microsoft’s Azure cloud environment. Once a configuration has been implemented an automatic service called the Local Configuration Manager (LCM) validates the local system against a reference file located on a separate DSC server. Any discrepancies are logged and alerted for further action by system administrators.

Similar capabilities exist for Linux-based platforms in the form of Open Source Software (OSS) projects like Ansible, Chef, Puppet, and SaltStack. All these tools offer similar functionality to Microsoft’s offerings to implement least-privilege administration and configuration monitoring. Knowing the state of your infrastructure and ensuring it adheres to a predefined configuration will go a long way in the battle to implement a Zero Trust Architecture. Treating infrastructure configuration in the same way you would software development adheres to the infrastructure as code concept as well.

Persistent Network Monitoring

Protecting critical assets and resources requires continuous monitoring and validation of credentials. While this is traditionally accomplished at the network edge with firewalls and intrusion detection, it must cover the internal network as well. From a Zero Trust Architecture perspective, it is assumed that bad actors have access to the internal network and must be kept out of critical resources.

Implementing robust edge security remains a key component of any defensive strategy. While this starts with a firewall it must also include provisions for external connections such as an application or circuit-level gateway. These products provide a pathway for external communications beyond just user access. The latest generation of firewall products implements stateful packet inspection (SPI) to permit or block packets based on very specific rule sets.

Protecting internal resources requires a totally different set of capabilities. Companies like Crowdstrike offer products that cover the entire spectrum of detecting and protecting endpoints within a corporate network. This would include everything from antivirus and antimalware to abnormal network activity monitoring. Microsoft, Trend Micro, and SentinelOne offer similar capabilities and made Gartner’s upper quadrant in their 2021 Endpoint Protection report.

Wrap up Zero Trust Architecture

The real answer to the question of what is zero trust architecture depends on your most important corporate assets. Any network design should also include consideration of the humans with access to those critical assets. Trust but verify applies to corporate employees as well as geopolitical relationships.

Choosing the right vendors and partners to meet your specific objectives will help you implement a solid Zero Trust Architecture. Once implemented it comes down to diligence and persistence. New threats pop up regularly and must be met with an adaptive security posture. Those who don’t adapt and change will be doomed to failure.