14,932
edits
Changes
→Advantages & Complications
# Protect resources (assets, services, workflows, and network accounts), not network segments.
# Protect resources (assets, services, workflows, and network accounts), not network segments.
# Trust is a vulnerability.
# Trust is a vulnerability.
# least privilege<ref>[https://www.beyondtrust.com/blog/entry/what-is-least-privilege What is least privilege, Beyond Trust]</ref>
==History==
==History==
Zero Trust was created by [[John Kindervag]], while he was vice president and principal analyst at [[Forrester Research]].<ref>[https://www.paloaltonetworks.com/cyberpedia/what-is-a-zero-trust-architecture What is a Zero Trust Architecture, Palo Alto Networks]</ref>
Zero Trust was created by [[John Kindervag]], while he was vice president and principal analyst at [[Forrester Research]].<ref>[https://www.paloaltonetworks.com/cyberpedia/what-is-a-zero-trust-architecture What is a Zero Trust Architecture, Palo Alto Networks]</ref> The COVID-19 Pandemic expedited the development and deployment of zero trust architectures.<ref>[https://finance.yahoo.com/news/zero-trust-security-market-size-113000164.html Zero Trust Security Market, Yahoo Finance]</ref>
==Zero Trust Architecture==
==Zero Trust Architecture==
====Automation & Orchestration====
====Automation & Orchestration====
Enterprises needed to automate manual security processes to take policy-based actions fast and at scale.
Enterprises needed to automate manual security processes to take policy-based actions fast and at scale.
===Difference between Layers 3 & 7===
{| class="wikitable"
! Layer 3 !! Layer 7<ref>[https://www.paloaltonetworks.com/blog/2019/05/network-layers-not-created-equal/ All Layers Are Not Created Equal, Palo Alto Networks]</ref>
|-
| The layer where information is evaluated based only on IP address, port or protocol. || This layer is much more specific. Information is evaluated based on the application being used.
|-
| It is limited by the lack of information that can be seen. IP addresses can be spoofed. Simple port scans uncover all open ports. Thus, attackers can encapsulate stolen data and exfiltrate them across the open port. The protocol is a metadata tag to help the administrator understand the type of traffic that is supposed to be traversing a specific port. || The 4th step in the Forrester five-step methodology to a Zero Trust network is to write policy rules for the segmentation gateway based on the expected behavior of the data and the user or applications that interact with that data.
|-
| Adversaries know how to bypass Layer 3 controls || Due to the granularity of the policy, it can only be done at Layer 7.
|}
==Advantages & Complications==
==Advantages & Complications==
|-
|-
| Improved monitoring || Dependence on the policy decision point
| Improved monitoring || Dependence on the policy decision point
|-
| || Technical Debt (Redesigning, recoding, and redeploying internal applications can be costly and potentially disruptive)
|-
| || Legacy applications, infrastructure, and operating systems have no concept of least privilege, lateral movement, or dynamic, context-based authentication models
|-
| || Peer-to-peer (P2P)/mesh network technologies (used in Windows 10, for instance) do not work with access and microperimeter controls.
|-
| || Large deployments of a zero-trust model, such as that needed for [[Cloud Computing|Cloud]], DevOps, and [[IoT]], are going to be cost-prohibitive.<ref>[https://www.beyondtrust.com/blog/entry/why-zero-trust-is-an-unrealistic-security-model Why Zero Trust is an Unrealistic Security Model, Beyond Trust]</ref>
|}
|}
==Addressing Misconceptions==
Kindervag is very concerned with correcting vendors and the public's misunderstandings about Zero trust. He argues,<ref>[https://www.helpnetsecurity.com/2021/04/06/john-kindervag-zero-trust/ Zero Trust creator talks about implementation, misconceptions, strategy HelpNetSecurity]</ref>
# zero trust does not make a system trusted;
# it is much more than identity and multi-factor authentication;
# there is no such thing as a zero trust product
==References==
==References==
[[Category:Cybersecurity]]
[[Category:Cybersecurity]]