The complexity of the local and remote infrastructure and cloud services blurred the enterprise perimeter. It resulted in the emergence of the Zero Trust approach to developing a new security model to address the issue. Which of the following statements about Zero Trust is not true?
A. Zero Trust security assumes remote users are less trustworthy than internal users.
B. Zero Trust security controls access to resources in a dynamic and granular fashion.
C. Zero Trust is a set of guiding principles for workflow, system design, and operations.
D. Zero Trust implementations are in favor of a hybrid Zero Trust/perimeter-based mode.

Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.

My suggested answer is A. Zero Trust security assumes remote users are less trustworthy than internal users.

Zero Trust as Concepts and Ideas

An operative definition of zero trust and zero trust architecture is as follows:

• Zero trust (ZT) provides a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as compromised.
• Zero trust architecture (ZTA) is an enterprise’s cybersecurity plan that utilizes zero trust concepts and encompasses component relationships, workflow planning, and access policies.
• Therefore, a zero trust enterprise is the network infrastructure (physical and virtual) and operational policies that are in place for an enterprise as a product of a zero trust architecture plan.

Source: NIST SP 800-207

Zero Trust as Access Control Mechanism

Zero Trust is all about access control, or specifically, authentication and authorization. A subject must be authenticated and authorized at a level as granular as possible on the need-to-know and least-privilege basis.

To ultimately grant or deny access to a resource, the trust algorithm (TA) typically considers inputs in terms of the access request, subject database, asset database (and observable status), resource requirements (requirements for access to the resource), threat intelligence, etc.

Zero Trust is technology agnostic; however, XACML contributes much to Zero Trust in terms of policy decision and policy enforcement.Zero Trust as No Implied Trustworthiness

Zero Trust doesn’t mean No Trust at all, but trust must be explicitly earned or no “implicit” trust (aka implied trustworthiness or implied trust ).

An enterprise should not “rely on implied trustworthiness wherein if the subject has met a base authentication level (e.g., logging into an asset), all subsequent resource requests are assumed to be equally valid.”

Source: NIST SP 800-207

Perimeter-based Network

For example, the perimeter-based network is a typical security model that operates under the implicit trust wherein remote and internal users assume different levels of trust. In contrast, Zero Trust controls access on the per-transaction basis regardless of network locations.

Trust but Verify

“Trust but verify” is not enough because it conveys implied trustworthiness as well. Trust is given first, and verification is applied afterward. When it comes to cloud services, the cloud services provider try to win trust from customers by being compliant with industrial standards, e.g., SOC, PCI-DSS, ISO 27001, CSA, and so on. Customers are not allowed to conduct on-site audit in data centers; third-party auditor assess or verify effectiveness of security controls for customers.

Transition to Zero Trust

Implementing a pure Zero Trust architecture is possible for greenfields (building a new one from scratch). However, this is rarely viable in practice because most organizations are brownfields (with the burden of existing systems). As a result, it’s more common for organizations to adopt a hybrid approach: transition to Zero Trust from perimeter-based architecture.

Reference

• Zero Trust
• Trust and Application Security, v. 1.0
• When “Trust but Verify” Isn’t Enough: Life in a Zero Trust World
• Zero-Trust Architecture in a Nutshell
• In a World of Multi-tenant Platforms, Trust, but Verify
• Trust, but verify: A modified Zero Trust standard applied to your personnel
• Cloud provider assurance: Trust but verify
• 8 criteria to ensure you select the right cloud service provider
• Top 10 Cloud Service Providers In 2020

本地和遠程基礎架構以及雲服務的複雜性模糊了企業的邊界範圍。這導致了零信任(Zero Trust)方法的出現，以開發新的安全模型來解決該問題。 下列有關零信任的陳述，哪些不正確？
A. 零信任安全性假定遠程用戶不如內部用戶可信。
B. 零信任安全性以動態和精細的方式控制對資源的訪問。
C. 零信任是工作流、系統設計和日常維運的一套指導原則。
D. 零信任的實現通常偏好採用零信任/基於邊界的混合模式。