Zero Trust Architecture Definition

The term zero trust (ZT) refers to an adaptive set of best practices for cybersecurity that focus on users, assets, and resources rather than static, network-based perimeters. Although there is no firm definition of zero trust architecture, any such architecture helps agencies build zero trust principles into enterprise and industrial workflows and infrastructure.

ZT assumes the least privilege possible and grants no implicit trust to users, their accounts, or assets based solely on physical or network location or asset ownership. Authentication and authorization of both device and user are discrete functions that take place before access to enterprise resources is established. ZT protects resources (assets, network accounts, services, workflows, etc.) in place of network segments, which are no longer the primary locations for the security posture of resources.

Zero Trust Architecture FAQs

How Does Zero Trust Architecture Work?

The fundamental principle of zero trust is to authenticate and authorize every access request based on multiple factors before granting access. These factors typically include user identity, device information, location, time of access, and the overall security posture presented together by the user and device. Thus, zero trust minimizes unauthorized access and potential lateral movement of threats within a network.

Zero trust architecture is an approach to cybersecurity that maintains strict access controls and verifies every user and device attempting to connect to a network or resource, regardless of whether they are inside or outside the network perimeter. It assumes no default trust for any user or device, even if they are within the internal network.

Zero trust is a comprehensive security framework rather than a specific set of minimum requirements, yet certain fundamental elements serve as a starting point for when implementing a zero trust architecture in support of zero trust principles:

Identity and access management (IAM). Manage user access rights and permissions with strong authentication such as two factor authentication (2FA) or multi-factor authentication (MFA) and centralized IAM solutions.

Micro-segmentation. Divide the network into segments and enforce strict access controls between them to limit attackers that gain access to the network.

Network visibility and analytics. Deploy advanced monitoring tools with real-time alerts on anomalies and security threats that offer visibility into network traffic, user behavior, and device posture.

Continuous monitoring. Identify and respond to potential security incidents rapidly by monitoring ongoing user activities, application usage, and network behavior.

Least privilege. Grant users the minimum access privileges required to perform their tasks and review and adjust access rights regularly.

Secure access. Implement secure remote access technologies, such as virtual private networks (VPNs), secure web gateways, and secure access service edge (SASE) solutions, to ensure users outside and inside the corporate network are subject to the same access controls.

Policy-based controls. Enforce access policies based on predefined rules, context, and risk assessment. The policies may include factors such as user roles, device posture, location, and other attributes to determine access permissions dynamically.

Zero trust architecture meaning or structure will vary depending on the organization’s size, industry, risk profile, and existing infrastructure. These basic requirements provide a foundational starting point which organizations should use to help define zero trust architecture in a way that is best-suited to their unique business needs and risks.

Modern Zero Trust Architecture Explained

The zero trust approach differs from the classic castle and moat or perimeter-based security models in several key ways:

Assumption of trust. In the castle and moat approach, once users or devices are inside the network perimeter, they are often granted significant trust and broad access privileges. This poses a risk for any attacker that gains unauthorized access. In contrast, zero trust architecture offers a never trust always verify approach that assumes no user or device should be trusted by default, regardless of location.

Network perimeter. The castle and moat approach relies heavily on securing the network perimeter with firewalls, intrusion detection systems (IDS), and other boundary defenses, while ZT architecture focuses on strict access controls and verification at every step inside the network, securing individual resources and segments.

Access control. The castle and moat approach authenticates once at the border, while zero trust implements access controls at a granular level, considering multiple factors like user identity, device posture, location, and other contextual attributes. Each access request is individually verified and authorized, regardless of the user’s location.

Lateral movement. The traditional approach assumes that threats are primarily external, but zero trust architecture sees the potential of internal threats, preventing lateral movement.

Monitoring and analytics. Traditional approaches to monitoring focus on network traffic at the perimeter to detect potential threats. Zero trust emphasizes real-time monitoring, visibility, and analytics across the network, homing in on anomalies and unusual user behavior.

Benefits of Zero Trust Architecture

The Executive Order on Improving the Nation’s Cybersecurity (EO), issued by the U.S. government in May 2021, explicitly emphasizes the adoption of zero trust architecture and mandates that federal agencies develop plans for implementing zero trust principles within their networks. The order recognizes the importance of zero trust architecture and the insufficiency of the traditional perimeter-based security model in the face of evolving cyber threats.

The EO further emphasizes the importance of implementing multi-factor authentication (MFA), encryption, continuous monitoring, and secure remote access, all of which are key components of Zero Trust architecture. It also highlights some key zero trust architecture benefits and how they relate to improving the nation’s cybersecurity:

Enhanced security. Zero trust architecture provides a proactive, robust security approach. Enforcing strict access controls, continuously verifying user identities, and implementing granular segmentation significantly shrinks the attack surface and minimizes the risk of data breaches, unauthorized access, and lateral in-network movement of threats.

Protection of critical assets. Zero trust architecture grants access based on the principle of least privilege, reducing the risk of data exfiltration or compromise.

Improved visibility and monitoring. Zero trust architecture emphasizes real-time monitoring, visibility, and analytics across the network. This provides comprehensive insights into network traffic, user behavior, and potential security incidents, enabling faster detection of anomalies, threats, and prompt risk mitigation.

Secure remote access. Zero trust architecture is central to securing remote access for remote work and cloud-based services. Organizations can apply zero trust architecture principles to remote access technologies to ensure that users connecting inside and outside the network are subject to the same strict access controls.

Compliance and regulatory alignment. Zero trust architecture aligns with various regulations and best practices, such as the Payment Card Industry Data Security Standard (PCI DSS), General Data Protection Regulation (GDPR), and National Institute of Standards and Technology (NIST) 800-207 guidelines (find the NIST zero trust architecture model guidelines here).

Zero Trust Architecture Use Cases

There are a number of zero trust architecture examples across different industries and organizations. Here are some common use cases where zero trust principles are particularly beneficial:

Remote workforce. Zero trust architecture ensures secure remote access to corporate resources without compromising overall network security by verifying user identities, device posture, and implementing strict access controls.

Cloud environments. Cloud zero trust architecture provides a robust security framework for protecting cloud-based services, resources, infrastructure, and data. It enforces strict access controls, implements encryption, and monitors cloud activity to mitigate potential security risks.

Third-party access. Zero trust principles securely grant third-party access to vendors, contractors, or partners who require access to internal systems or sensitive data by applying strict authentication, authorization, and access controls, ensuring that only authorized individuals can reach relevant resources.

Privileged access management. Granular access controls and other zero trust principles applied to privileged accounts which have elevated access rights within an organization’s network help mitigate the risk of unauthorized access or misuse of privileged credentials.

Internet of Things (IoT). IoT devices introduce security challenges that zero trust architectures are uniquely suited to tackle by implementing device authentication, segmenting network traffic, and monitoring device behavior to detect anomalies or potential threats.

Compliance and data protection. Organizations that need to comply with industry regulations and protect sensitive data to meet requirements under guidelines such as GDPR, HIPAA, or PCI DSS can benefit from zero trust architecture.

Supply chain management. Create unique identities and access controls for each user, device, or entity involved in the supply chain, with limited information and resources required for each specific role. Use 2FA/MFA to verify users and devices, and strong authentication and encryption to safeguard sensitive information and prevent unauthorized access or tampering throughout the entire supply chain.

Hybrid and multi-cloud environments. Leverage zero trust principles to ensure consistent security across different cloud environments. Zero trust architecture provides a unified approach to access controls, monitoring, and security policies, regardless of the cloud provider.

Zero Trust Architecture Best Practices

When implementing a zero trust security model, it’s important to consider various best practices.

Adopt industry frameworks and standards. Leverage established industry frameworks and standards that align with Zero Trust principles. Examples include zero trust architecture NIST Special Publication 800-207, the Forrester research-based Zero Trust eXtended (ZTX) framework, the Cybersecurity & Infrastructure Security Agency (CISA) Zero Trust Maturity Model, and the Cloud Security Alliance (CSA) zero trust architecture.

Implement strong authentication. Use 2FA or MFA and require factors such as Yubikeys, biometrics, tokens, or smart cards in place of one-time texts or passwords to verify identity.

Apply least privilege access. Grant users the minimum access required to perform their tasks. Regularly review and update access rights based on user roles, responsibilities, and needs.

Micro-segmentation and segmentation. Divide the network into the smallest possible segments to enforce strict access controls. Apply network segmentation based on user roles, device attributes, and sensitivity of resources.

Continuous monitoring and analytics. Implement real-time monitoring to gain insight into network traffic, user behavior, and system events. Analytics and machine learning tools can detect and reveal anomalies, potential security threats, and suspicious behavior.

Implement encryption. Encryption can protect data at rest, in transit, and in use. Strong encryption protocols and algorithms should safeguard sensitive information.

Establish an incident response plan. A comprehensive incident response plan should define roles, responsibilities, and escalation procedures to address security incidents promptly and effectively and ensure a coordinated response.

Regular security assessments and audits. Conduct regular security assessments and audits to evaluate the zero trust architecture and identify vulnerabilities, gaps, and areas for improvement.

User education and awareness. Promote a zero trust culture through ongoing user education and awareness programs about potential risks, best practices, and the user’s role in maintaining a secure environment.

Vendor selection and collaboration. Choose technology solutions that integrate well within zero trust architecture and align with zero trust principles. Collaborate with vendors to ensure proper implementation and ongoing support.

How to Implement Zero Trust Architecture

There are three principles of a Zero Trust Model that offer a framework for zero trust architecture implementation:

Verify. A robust zero trust architecture model continuously authenticates and verifies the identity of users and devices attempting to access resources with strong authentication like 2FA or MFA and device certificates to establish trust.

Least privilege. Grants users the minimum access privileges required to perform their tasks on a need-to-know and need-to-access basis, reducing the risk of unauthorized access to sensitive data or resources.

Zero Trust Network Access (ZTNA). ZTNA offers secure access to resources based on zero trust principles regardless of the user’s location or network connection.

There are also eight pillars that provide guidance and structure for zero trust architecture implementation:

Identity. Establish strong user identity management, ensure accurate identification and authentication of users, and apply access controls based on identity attributes.

Device. Verify the security posture of devices attempting to connect to the network by implementing device health checks, ensuring devices are up to date with security patches, and detecting any anomalies that may indicate compromise.

Infrastructure. Secure components of underlying infrastructure, such as servers, databases, and network devices, with tools such as strict access controls and regular monitoring.

Network. Micro-segmentation and segmentation enable the enforcement of strict access controls between segments and resources and the restriction of lateral movement.

Data. Encryption, data classification, data loss prevention (DLP) mechanisms protect sensitive data and ensure data access is granted based on strict controls and policies only.

Applications. Implement strong authentication, access controls, and application-level encryption and monitor application behavior for anomalies and potential security issues.

Visibility. Gain comprehensive visibility into the network and identify potential security incidents via real time monitoring, logging, and analysis of network traffic, user activities, and system events.

Automation. Automation and orchestration allow organizations to streamline and enforce security policies, enable rapid response to security events, and automate security-related tasks—reducing manual errors and improving efficiency.

Together, these principles and pillars provide a starting framework for organizations to design and implement a zero trust architecture tailored to their specific needs, ensuring strong security controls, continuous verification, and protection of critical resources and data.

Does Yubico Support Zero Trust Architecture?

Yes. Yubico offers a range of strong authentication keys that serve as zero trust architecture tools. By validating a user using strong authentication, organizations can offer secure access to information, networks, applications, and services.

Learn more about Yubico’s Zero Trust Architecture here.

Get started