The Zero Trust Starter Pack

This is a project I have had in the works for a little while now and have been chipping away at in my spare time. I know, spending time going over zero trust sounds like a great way to relax, but if you’ve been keeping up to date with the cyber security industry, I’m sure you’ll have at some point come across this beautiful buzzword called ‘Zero Trust’. But it’s more than just a buzzword…

Given the accelerated rise in remote working largely thanks to the ongoing pandemic and the nature of evolving cyber threats, I think it is quite timely to discuss zero trust in some depth and look at some logical ways that organisations can begin to shift towards this security-focused access model.

So in this article, I’m going to attempt to break Zero Trust down and simplify this topic into some easily understandable terms and provide a conceptual guide to how you can get started on moving towards a more secure ‘Zero Trust’ environment. Let’s get started!

Zero Trust – What is it?

“Zero Trust” is a phrase first coined by John Kindervag, an industry analyst, in 2010 based on the realisation that traditional security models operate on the outdated assumption that everything inside an organisation’s network should be trusted and to describe the need to move to a model that relies on continuous verification of trust across every device, user and application.

While the idea of Zero Trust has evolved since then from being network-centric to a more comprehensive security model, at its crux, zero trust is about recognising trust as a vulnerability and eliminating any implicit trust from digital security systems.

Why Should We Do It?

The short answer; a Zero Trust security model dramatically reduces the likelihood of organisations falling victim to cyber-attacks.

Today, we continue to see increasingly sophisticated cyber threats worldwide. A Zero Trust strategy is a comprehensive way to protect valuable systems and information and helps position organisations to be better prepared for the future.

How Do We Do It?

We begin the Zero Trust journey by pivoting from prior “trust but verify” paradigms to newer “never trust, always verify” ones. The Zero Trust model is built on the following six foundational assertions.

1. The network is always assumed to be hostile, and all communication is secured regardless of network location.

2. External and internal threats exist on the network, and network locality is not sufficient for deciding trust in a network. Any person or device cannot be trusted just because they are part of the company or connecting from inside it. Assume you are already dealing with both outside adversaries and malicious insiders.

3. All data sources and computing services are considered resources that need to be protected.

4. Every device, user, network and data flow is authenticated and authorised. The former means positive confirmation that an entity confirms who/what they say they are; the latter means the entity has the need, rights and reasons to do what they’re doing.

5. Any access to resources is granted on a per-session basis.

6. All security policies are dynamic and incorporate as many contextual data sources as possible.

Implementing and executing the transition towards a Zero Trust security strategy is a significant task that requires in-depth planning, collaboration, and resources. When looking at the sheer scale of a Zero Trust solution, it is crucial to managing the complexity by placing the above foundations at the centre of the transformation.

Zero Trust Building Blocks

Before I go into the key components, it is essential to make sure you have accurately captured the needs of the business and correctly assessed the benefits and the risks before performing a transition to a Zero Trust network environment. Here are two ways you can use to do this.

• 01 - Business Requirements

  • The business requirements are the first and most important activity we must work through and define. The business requirements ultimately drive the motivation for Zero Trust and how it can be an effective architectural security model.

    • Example:

      • Business Attributes Profile (BAP):

        • Reliable

        • Accurate

        • Scalable

        • Cost-effective

• 02 - Opportunities and Threats Inventory

  • Creating an opportunities and threats inventory gives us an accurate representation of our motivations and why we are seeking to transform the business to adopt a Zero Trust security model.

  • Justifies business transformation in the form of risks versus rewards.

    • Example:

      • Positive outcomes - e.g. Greatly enhanced security posture. Limited attack surfaces.

      • Adverse outcomes – e.g. Administrative overhead. Widespread change in user experience.

      • SWOT analysis.

Now I will cover some of the core architectural concepts and components that you can use to develop an effective Zero Trust solution. Keep in mind there is no one size fits all (OSFA) when it comes to Zero Trust or any other robust security solution for that matter. Like everything, the solution depends entirely on your unique business requirements, use-cases, budget, and risk appetite.

• ZT.BB.01 - Zero Trust Entities

  • A Zero Trust Entity (ZTE) is anything with a distinct and independent existence. For example, “a person is unique and able to survive on their own”.

  • As we get further down into the nuts and bolts of what a Zero Trust network looks like, we begin by looking at the “who” and “what” is accessing and using our network.

  • Zero Trust Entities form the core components commonly found within your organisation.

    • Example:

      • Identities (Users - human/non-human)

      • Endpoints (Devices - corporate, personal (BYOD))

      • Applications

      • Networks

      • Infrastructure

      • Data

• ZT.BB.02 - Asset Value Rating

  • The Asset Value Rating (AVR) is a logical security classification assigned to a specific entity (asset) to identify the asset's value to the business.

  • The idea behind the asset value rating is that the greater the asset's value to the business, the greater the level of security control is applied to protect the asset. This helps to reduce costs and complexity by only placing strict policies and controls where they are most required.

  • The asset value rating is determined using a combination of business impact (I), Severity (S) and likelihood (L) of a threat being realised against an asset.

  • The calculation and determination of asset value are outside the scope of this article, but you can look at risk management and asset classification techniques to find out more about how this is done.

    • Example:

      • Critical Value Asset (CVA) - E.g. Internal payroll system.

      • High-Value Asset (HVA) - E.g. Production application server.

      • Moderate Value Asset (MVA) - E.g. Internal file server.

      • Low-Value Asset (LVA) - E.g. Development test network.

  • You can use various methods to classify your assets; however, the main goal of this building block is to understand the assets most valuable to the business and focus our security controls around them in the early stages of adopting a Zero Trust solution.

• ZT.BB.03 - Policy Evaluation & Enforcement Point (PE&EP)

  • The system or device that is logically situated between entities where defined security policies are evaluated and enforced based on pre-determined criteria. See NIST’s definition here.

  • In modern practice, the policy enforcement point (PEP) can be a cloud service providers management plane or any platform/device where you are responsible for defining and controlling access to resources.

    • Example:

      • Azure Resource Manager (ARM)

      • AWS Console

      • GCP Compute Engine

      • Perimeter Firewall

      • Centralised Access Control Server (ACS) - Think TACACS+ from back in the day.

• ZT.BB.04 - Security Objectives

  • Security objectives, simply put, are your objectives/goals for how you want to protect the systems within your environment.

  • Ensures the chosen security control is adequately aligned to security objectives.

  • As such, security objectives coincide with the type and level of security controls you choose to adopt.

    • Example:

      • Fault-Tolerant

      • Confidential

      • Monitored

      • Protected

• ZT.BB.05 - Security Controls

  • As mentioned above, the security controls you choose to deploy within your Zero Trust environment will relate directly to your security objectives.

  • Security controls are the tools and technologies you will use to secure your environment and protect your business assets from cyber compromise.

    • Example:

      • Traffic Filtering

      • Strong Authentication (MFA/2FA)

      • Device Compliance

      • Encryption/Cryptography (PKI)

Piecing It All Together

With the above concepts and building blocks mapped out, you should now be in an excellent position to start designing and implementing a functional and secure network architecture that meets the design principles of Zero Trust.

These building blocks are also highly transferrable, and they can (and should) be used in security solution design whenever possible.

Here are a couple of example diagrams I have put together to provide some extra clarity and see these concepts in action.

Example #1 - Zero Trust Building Blocks

Example #2 - Zero Trust Architecture - Logical Design

Lastly, my goal for writing this article on Zero Trust was to introduce the core concepts, principles and to provide the building blocks you can use to construct an effective secure-by-design Zero Trust solution.

I hope this has been an enjoyable and valuable read. Please feel free to reach out to me with any questions or feedback relating to Zero Trust!