What is zero trust?
- Term
- Zero trust
- Meaning
- In zero trust, being on the company network earns no trust. Each request is checked for who is asking and from what device, then gets only the access it needs.
Zero trust is a security approach in which being on the company network earns no trust. Each request is checked for who is asking and from what device, and then gets only the access it needs.
What is zero trust?
NIST SP 800-207, “Zero Trust Architecture” (August 2020), defines zero trust in section 2 as a collection of concepts and ideas. They aim to make each access decision accurate and limited to the least privilege needed, on a network that you assume has already been broken into. The abstract adds that zero trust grants no automatic trust to devices or user accounts based only on where they are on the network, or on who owns the device.
CISA’s Zero Trust Maturity Model, Version 2.0 (April 2023), quotes the same definition. It describes the change as a move away from trust based on location, toward checks based on identity, context and data.
How is it different from perimeter security?
| Question | Perimeter security | Zero trust |
|---|---|---|
| Starting assumption | Whatever is inside the network can be trusted | The network may already be compromised |
| What it protects | Network segments | Each resource: devices, services, workflows, accounts |
| Requests from the office network | Trusted | Checked the same way as requests from outside |
NIST explains why the approach arose: people work remotely, use their own devices, and rely on cloud services outside the company’s network. CISA adds that the path is gradual and may take years.
What are NIST’s seven tenets?
Section 2.1 of SP 800-207 lists seven basic tenets, summarized here:
- Treat all data and services as resources to protect. You may count personal devices that reach company resources.
- Secure all communication wherever it comes from. Being on the company network earns no trust.
- Grant access to each resource per session (one period of use), with the least privilege the task needs. Access to one resource doesn’t grant access to another.
- Decide access by dynamic policy, using who is asking, which app, and the state of the device.
- Monitor and measure the security state of every device you own or that connects.
- Check identity and permission strictly before allowing access, and keep re-checking. This includes multi-factor authentication.
- Collect as much as you can about devices, network and traffic, and use it to improve security.
NIST calls these the ideal goal and says not every tenet may be met in its purest form. It also says the tenets try to be independent of any technology: identifying a user could mean a password, a certificate or a one-time code.
What does it mean for account access?
Tenets 3 and 6 apply most directly to cloud app accounts. Each person is checked before use, gets only what the task needs, and signing in to one app doesn’t open another. Tenet 3 also says trust in the requester is evaluated before access is granted. With a shared login whose password five people know, the app can’t tell which of them is asking, so that evaluation has nothing to work with. CISA’s model points the same way for identity. Its stages move from passwords toward phishing-resistant multi-factor authentication that is checked continuously, not only at the first sign-in. What is the principle of least privilege? covers the least-privilege side.
Frequently asked questions
Is zero trust a product?
No. NIST SP 800-207 calls it a collection of concepts and ideas, and says its tenets try to be independent of any technology.
Isn't a device on the office network safe?
Zero trust doesn't treat being on the network as a reason to trust. NIST says requests from inside the office network must meet the same requirements as requests from anywhere else.
What does zero trust change for account access?
Each request is checked and gets only the access the task needs. NIST includes multi-factor authentication, and says access to one resource doesn't carry over to another.
Does zero trust apply to small companies?
CISA wrote its maturity model for federal agencies, but says all organizations should review its approaches. NIST ties zero trust to remote work, personal devices and cloud apps.
How Junify handles this
- Doing this by hand
- Single sign-on and multi-factor authentication don't reach apps that can't connect to your identity provider, or accounts that stay shared. Those are left to manual work, and you have to track for yourself which accounts the tools cover.
- With Junify
- Junify covers one part of sign-in to cloud apps, the apps outside your identity provider and the shared accounts. People confirm who they are on their own phone before they use them, and they can open only the accounts an admin assigned to them. They never get the password, and each use is recorded by person. On a personal computer, only the browser extension is installed.
Sources
- NIST SP 800-207, Zero Trust Architecture (August 2020)
- NIST Computer Security Resource Center: SP 800-207, Zero Trust Architecture
- CISA: Zero Trust Maturity Model, Version 2.0 (April 2023)
-
What's the difference between an audit log and audit evidence?
An audit log is what a system records. Audit evidence is a log you can rely on: tied to a person, protected from change, kept for a set period, and reviewed.
-
What a browser extension can and can't control in access management
An extension works inside the browser it's installed in, on the sites it's allowed to run on. Other apps, other browsers and other devices are out of its reach.
-
What work data stays on a personal computer, and how to keep it off
History, cookies, saved passwords, password manager copies and downloads. Pair company browser settings with logins that don't show people the password.