What is Zero Trust architecture?

To understand Zero Trust architecture, first think about traditional security architecture: after someone signs in at work, they can access the entire corporate network. This only protects an organization’s perimeter and is tied to the physical office premises. This model doesn’t support remote work and exposes the organization to risk, because if someone steals a password, they can access everything.

Instead of only guarding an organization’s perimeter, Zero Trust architecture protects each file, email, and network by authenticating every identity and device. (That’s why it’s also called “perimeterless security.”) Rather than just securing one network, Zero Trust architecture also helps secure remote access, personal devices, and third-party apps.

The principles of Zero Trust are:
 

Verify explicitly
 

Consider every data point before authenticating someone’s access, including their identity, location, and device, as well as how the resource is classified and if there’s anything unusual that might be a red flag.
 

Use least privileged access
 

Limit the amount of information and length of time people can access something, instead of providing access to all company resources indefinitely.
 

Assume breach
 

Segment networks so if someone does get unauthorized access, the damage is contained. Require end-to-end encryption.

Here’s how to deploy and use Zero Trust for your organization’s identities, devices, networks, apps, data, and infrastructure.

1. Create strong identity verification
 

Start authenticating access to every app, service, and resource that your organization uses, starting with the most sensitive. Give admins tools to assess risk and respond in real time if an identity has warning signs, like too many failed login attempts.

2. Manage access to devices and networks
 

Make sure all endpoints, whether personal or corporate, are in compliance with your organization’s security requirements. Encrypt networks and ensure all connections are secure, including remote and on-site. Segment networks to limit unauthorized access.

3. Improve visibility into apps
 

“Shadow IT” is any unauthorized application or system that employees use, and it can introduce threats. Investigate which apps people have installed so you can make sure they’re in compliance, set permissions, and monitor them for any warning signs.

4. Set data permissions
 

Assign classification levels to your organization’s data, from documents to emails. Encrypt sensitive data and provide least-privileged access.

5. Monitor your infrastructure
 

Assess, update, and configure every piece of infrastructure, like servers and virtual machines, to limit unnecessary access. Track metrics so it’s easy to identify suspicious behavior.

Zero Trust is a comprehensive security model, not a single product or step to take. Businesses need to reevaluate their entire security approach to meet today’s challenges and cyberthreats. Zero Trust provides a roadmap for security, and when implemented, can not only make organizations more secure but also help them scale safely and be prepared for the next evolution of cyberthreats.

Businesses interested in adopting Zero Trust architecture should look for solutions that:

• Authenticate each access point, verify every identity, and limit access.
• Encrypt data end-to-end, including emails and documents.
• Provide visibility and real-time analytics to monitor and detect threats.
• Automate threat responses to save time.