Never Trust, Always Verify - What Matters In Zero Trust

Zero Trust (ZT) Architecture, also referred as ZT Security (ZTS) has been widely accepted across industries and nations globally as a better approach to protect & respond from the increasing sophisticated cyberattacks that have the potential to paralyze the economies and impact common man’s life.

ZT Architecture (ZTA) is neither standalone product nor a turnkey solution. It’s a set of principles and cybersecurity model (and processes) to be applied across entire digital assets and value chain for it to be effective. At its core, as per NIST ZTA publication:

Overall, most of the Security Professionals understand the importance and how it can help their organizations. Aiding the cause, numerous good resources including recommendations and specs are available from leading standards organizations such as NIST, CISA, DoD and industry forums such as Cloud Security Alliance (CSA) and DSCI.

Despite this, there have been significant discussions and arguments in the industry / Cybersecurity community with significantly different viewpoints in the core architectural models. Add to this mix, usage of solution names and keywords such as SDP, ZTNA and ZT Security, Micro-segmentation for overlapping concepts is unsettling among Cybersecurity practitioners and delaying their ZTA implementation plans for the sake of better clarity

Here, we've attempted to look at ZTA from a customer & use cases point of view and tried to connect a few dots on existing recommendations.

Zero Trust Architecture Pillars

In simple terms, ZTA is about a superior approach of securing & protecting the five digital pillars.  While all the pillars are important, few pillars play a critical & sensitive role based on organizational context.  Reference diagrams from CISA and DoD ZT given below:

Key Use Cases and Deployment Scenarios

Use cases are key starting points for arriving at what works best for the organization.  Here are a few well documented use cases for reference:

ZTA Challenges

It’s already reported that there are organizational hurdles in adopting ZTA considering:

• Rethinking overall IT design especially considering legacy systems
  
• Continuous Monitoring and Mangement considering that least privilege access likely to disturb regular Operations
  
• Technical Debt considering the ZTA’s larger scope and complexity.
  

Given the above challenges, a wider variety of ZTA use cases and the scope of each of the ZTA pillars, it would be a daunting task for a CIO/CISO and Cybersecurity teams to navigate the ZTA journey given that product/solution providers bringing out products with varying architectural and deployment models. The challenges are:

• Mapping the scope of the ZTA implementations, pillar-wise and phase-wise.
  
• Choosing Architectural approach considering the organization’s use cases and security context
  
• Selecting suitable Product/Solution Deployment models