Zero Trust vs Trust, but Verify

Many of the access control processes developed around the concept of Trust, but verify, in which systems elements would rely upon other core processes to authenticate and authorize users, processes, or devices to be connected to the network.

Once connected, the trustworthiness of these identities and their claims of privileges could be validated by individual systems elements, if their security needs dictated this be done.

The figure illustrates this conceptually and should not be used as a prescription for one's own network architecture). Trust, but verify is often seen in SSO environments in which a single sign-on gets a user onto the organizational LAN (or WAN), from which they have visibility, if not access, to a significantly large fraction of the organization's information systems and assets.

Network segmentation

Network segmentation, typically with firewalls, would be used to internally break the organization's IT infrastructure into security zones. Each attempt by a user process would have to be authenticated and authorized to pass through such a boundary device.

This was generally done with security tokens or similar approaches. In simple terms, since these have a time-to-live associated with them, an unexpired token is assumed to still indicate a valid authorization to proceed.

Zero trust

Zero trust is a design approach, which recognizes that even the most robust access control systems have their weaknesses. In the extreme, it insists that every process or action a user attempts to take must be authenticated and authorized; the window of trust (the time-to-live of a token, so to speak) becomes vanishingly small.

Zero trust networks are often microsegmented networks, with firewalls (next generation or other) at nearly every connecting point. It encapsulates information assets, the services that apply to them, and their security properties.

Zero Trust Architectures

In August 2020, NIST published SP 800207, "Zero Trust Architectures," which provides a strategic view of this concept. NIST and others are using the ZTA acronym more often when discussing such architectures, as shown in the figure.

NIST makes the point that many different strategic, tactical, operational, and technology approaches are necessary to truly make ZTAs deliver on their promise of greater resiliency and security.

It's not just a matter for cables, routers, firewalls, and switches, NIST emphasizes. It takes more than just microsegmentation of networks.

For more information, please take a look at NIST SP 800-207 for additional reference reading.