The complexity of the local and remote infrastructure and cloud services blurred the enterprise perimeter. It resulted in the emergence of the Zero Trust approach to developing a new security model to address the issue. Which of the following statements about Zero Trust is not true?
A. Zero Trust security assumes remote users are less trustworthy than internal users.
B. Zero Trust security controls access to resources in a dynamic and granular fashion.
C. Zero Trust is a set of guiding principles for workflow, system design, and operations.
D. Zero Trust implementations are in favor of a hybrid Zero Trust/perimeter-based mode.
Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.
My suggested answer is A. Zero Trust security assumes remote users are less trustworthy than internal users.
Zero Trust as Concepts and Ideas
An operative definition of zero trust and zero trust architecture is as follows:
- Zero trust (ZT) provides a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as compromised.
- Zero trust architecture (ZTA) is an enterprise’s cybersecurity plan that utilizes zero trust concepts and encompasses component relationships, workflow planning, and access policies.
- Therefore, a zero trust enterprise is the network infrastructure (physical and virtual) and operational policies that are in place for an enterprise as a product of a zero trust architecture plan.
Source: NIST SP 800-207
Zero Trust as Access Control Mechanism
Zero Trust is all about access control, or specifically, authentication and authorization. A subject must be authenticated and authorized at a level as granular as possible on the need-to-know and least-privilege basis.
To ultimately grant or deny access to a resource, the trust algorithm (TA) typically considers inputs in terms of the access request, subject database, asset database (and observable status), resource requirements (requirements for access to the resource), threat intelligence, etc.
Zero Trust is technology agnostic; however, XACML contributes much to Zero Trust in terms of policy decision and policy enforcement.Zero Trust as No Implied Trustworthiness
Zero Trust doesn’t mean No Trust at all, but trust must be explicitly earned or no “implicit” trust (aka implied trustworthiness or implied trust ).
An enterprise should not “rely on implied trustworthiness wherein if the subject has met a base authentication level (e.g., logging into an asset), all subsequent resource requests are assumed to be equally valid.”
Source: NIST SP 800-207
For example, the perimeter-based network is a typical security model that operates under the implicit trust wherein remote and internal users assume different levels of trust. In contrast, Zero Trust controls access on the per-transaction basis regardless of network locations.
Trust but Verify
“Trust but verify” is not enough because it conveys implied trustworthiness as well. Trust is given first, and verification is applied afterward. When it comes to cloud services, the cloud services provider try to win trust from customers by being compliant with industrial standards, e.g., SOC, PCI-DSS, ISO 27001, CSA, and so on. Customers are not allowed to conduct on-site audit in data centers; third-party auditor assess or verify effectiveness of security controls for customers.
Transition to Zero Trust
Implementing a pure Zero Trust architecture is possible for greenfields (building a new one from scratch). However, this is rarely viable in practice because most organizations are brownfields (with the burden of existing systems). As a result, it’s more common for organizations to adopt a hybrid approach: transition to Zero Trust from perimeter-based architecture.
- Zero Trust
- Trust and Application Security, v. 1.0
- When “Trust but Verify” Isn’t Enough: Life in a Zero Trust World
- Zero-Trust Architecture in a Nutshell
- In a World of Multi-tenant Platforms, Trust, but Verify
- Trust, but verify: A modified Zero Trust standard applied to your personnel
- Cloud provider assurance: Trust but verify
- 8 criteria to ensure you select the right cloud service provider
- Top 10 Cloud Service Providers In 2020
A BLUEPRINT FOR YOUR SUCCESS IN CISSP
My new book, The Effective CISSP: Security and Risk Management, helps CISSP aspirants build a solid conceptual security model. It is not only a tutorial for information security but also a study guide for the CISSP exam and informative reference for security professionals.
本地和遠程基礎架構以及雲服務的複雜性模糊了企業的邊界範圍。這導致了零信任(Zero Trust)方法的出現，以開發新的安全模型來解決該問題。 下列有關零信任的陳述，哪些不正確？