Zero Trust: Difference between revisions
| Line 2: | Line 2: | ||
==Principles== | ==Principles== | ||
# | # Never trust, always verify. | ||
# No assumptions about assets or user accounts based solely on their physical or network location or asset ownership. | # No assumptions about assets or user accounts based solely on their physical or network location or asset ownership. | ||
# Protect resources (assets, services, workflows, and network accounts), not network segments. | # Protect resources (assets, services, workflows, and network accounts), not network segments. | ||
# Trust is a vulnerability. | |||
==History== | ==History== | ||
Revision as of 14:46, 10 August 2021
Zero Trust (ZT) is a set of cybersecurity paradigms that focuses on users, assets, and resources instead of static perimeters. Zero trust is a response to trends such as including remote users, bringing one's own device, and cloud-based assets not within an enterprise-owned network boundary. The network location is no longer the prime component of a resource's security.[1]
Principles
- Never trust, always verify.
- No assumptions about assets or user accounts based solely on their physical or network location or asset ownership.
- Protect resources (assets, services, workflows, and network accounts), not network segments.
- Trust is a vulnerability.
History
Zero Trust was created by John Kindervag, while he was vice president and principal analyst at Forrester Research.[2]
Zero Trust Architecture
Zero Trust Architecture (ZTA) uses zero trust principles to guide industrial and enterprise infrastructure and workflow. Authentication and authorization are discrete functions performed before a session to an enterprise resource is established.