NC May-Jun 2022

FEATURE: ZERO TRUST
ZERO TRUST: THE TRUTH IS OUT THERE
THE CONNECTED WORLD IS A CHANGED WORLD, AND ENTERPRISES CAN NO LONGER ASSUME THEY
HAVE FULL CONTROL OVER CLOSED NETWORKS, ACCORDING TO MATTHEW MARGETTS, DIRECTOR OF
SALES AND MARKETING AT SMARTER TECHNOLOGIES
The COVID-19 pandemic further
accelerated the new normal, which shifted
a large proportion of the workforce to
remote working and forced businesses to
increase their use of cloud platforms to support
a variety of devices and networks.
Unfortunately, criminals can take advantage of
this upheaval and attempt to increase network
infiltrations for nefarious gains.
The truth is that legacy security solutions
cannot support a Zero Trust network. In the
legacy model, security measures are reliant on
a closed perimeter security model that assumes
that all users and applications are coming from
the same network location and entry points.
This approach is no longer sufficient, which is
why Zero Trust security is becoming the
preferred network security architecture.
WHAT IS ZERO TRUST SECURITY?
Zero Trust architecture is an approach to IT
system design where inherent trust in the
network is removed. The network is assumed
to be hostile, and each request is verified
based on an access policy. Regardless of the
device, network and user activity, Zero Trust
architecture is built on access management
checks at every level.
The National Cyber Security Centre (NCSC)
says: "In a Zero Trust architecture, inherent trust
is removed from the network. Just because
you're connected to a network doesn't mean
you should be able to access everything on that
network. This is commonly seen in breaches;
an attacker gains a foothold in a network and
is able to move laterally because everything on
the network is trusted. In a Zero Trust
architecture, the network is treated as hostile."
The key concepts of Zero Trust are:
The network is hostile and should be
treated as compromised
Inherent trust is removed from the network
Every request to access data or a service
should be authenticated and authorised
against an access policy
Gain confidence dynamically by
continuously evaluating the trustworthiness
of connections
THE 8 DESIGN PRINCIPLES OF A ZERO
TRUST NETWORK
The NCSC has introduced eight Zero Trust
architecture design principles that are paving
the way for future networks for the government.
These eight principles are intended to help the
public sector and large organisations to
implement a Zero Trust network architecture in
an enterprise environment.
1. Know your architecture, including users,
devices, services and data
2. Know your user, service and device
identities
3. Assess user behaviour, service and device
health
4. Use policies to authorise requests
5. Authenticate and authorise everywhere
6. Focus your monitoring on users, devices
and services
7. Don't trust any network, including your own
8. Choose services that have been designed
for Zero Trust.
Let's take a closer look at the eight
principles' objectives:
1. Know your architecture, including users,
devices, services and data
To get the benefits from Zero Trust, you need to
have a clear understanding about each
component of your architecture so that you
can identify:
Where your key resources are
The main risks to your architecture
How to avoid integrating legacy services
that do not support Zero Trust
2. Know your user, service and device identities
An identity can represent a:
User (human)
Service (Software Process)
Device
Each identity should be uniquely identifiable
in a Zero Trust architecture. This is the most
12 NETWORKcomputing MAY/JUNE 2022 @NCMagAndAwards
WWW.NETWORKCOMPUTING.CO.UK