Basic Concepts of Zero Trust Architecture

Already there is a lot of content on the Internet explaining "Zero Trust Architecture" but here is my attempt to present the same concept in simpler words.

In order to understand Zero Trust Architecture (ZTA), first we need to define what is Zero Trust (ZT) ?

Zero Trust is a collection of concepts and ideas designed to minimize uncertainty by enforcing accurate and least privilege access decisions.

In this definition, we have stated minimize uncertainty because of the fact that is cannot be completely eliminated. This concept is analogous to risk management which implies risk cannot be completely eliminated but can only be reduced down to a certain level.

Now that we know what is Zero Trust, let us define Zero Trust Architecture.

Zero Trust Architecture (ZTA) is an enterprise's cyber security plan that utilizes Zero Trust concepts and encompasses relationship between different components, workflows and access policies.

Zero Trust Architecture focuses on resource protection and the main concept that trust is never granted implicitly. Zero Trust Architecture is based on Zero Trust principles and designed to prevent data breaches and limit lateral movement. It emphasizes on moving away from implied trust based on network location and is focused on evaluating trust on per transaction basis. Crux of the concept is to prevent unauthorized access to data and services by making access control enforcement as granular as possible.

Unauthorized lateral movement within the environment is one of the biggest challenge faced by organizations these days. Internal lateral movement or simply lateral movement means hackers or attackers move deeper into a network after gaining initial access of the victim. This technique is used to search for sensitive data / assets and cause more harm to the target.

Consider an example of a network segment hosting 40 servers. This network segment is guarded by a network firewall having access control rules. If an attacker gains access to any one of the servers within this network segment, it is easy for him to move within this network segment as he has already circumvented the firewall securing the 40 servers which are hosted in this segment.

To understand this concept in detail, we need to go through a couple of more terms; PDP / PEP and Implicit Zone.

PDP (Policy Decision Point) / PEP (Policy Enforcement Point) is the entity which performs proper judgement to allow subject access to the desired resource

So practically, it is the PDP / PEP that applies a set of controls so that all traffic beyond it has a common level of trust.

Implicit trust zone or simply an Implicit Zone is an area where all the entities are trusted to at least the level of the last PDP / PEP gateway

To allow the PDP/PEP to be as specific as possible, the implicit zone must be as small as possible. This means PDP/PEP should be closer to the object which is accessed by the subject.

More articles on Zero Trust Architecture are in the pipeline. Please keep following to know more about this concept.