Zero trust is a security methodology built on the principle of never trusting and always verifying, using continuous policy-driven checks to ensure devices and users remain compliant throughout their session. It replaces traditional perimeter-based security with adaptive identity assessment and ongoing access control.
Zero Trust Security
Zero trust is both a methodology and there are technologies that help us implement zero trust.
The first thing to understand about zero trust is that it's a principle that we implement on our networks. There are also technologies that help support those principles, and we have to architect things in a way to support those principles. So realize that when we say zero trust, we could mean that this is just a principle that we follow, or it could mean how we architect things and the technologies we put into place.
So what is the zero trust principle? It just means never trust, always verify.
Traditional networks are like the bouncer at the front door. What they're doing is checking to make sure you're of the right age, that you should be at that club, that you're on the list, or you've paid, or whatever the case may be, before you ever get into the doors. But as soon as you're in the doors, then supposedly you're okay, and there's usually not as much security inside of a club. That's mainly on the outside of the club. So this would be traditional networks, where we tried to protect the perimeter.
Now, even though 802.1X and NAC grant us access into this club or network, what it really is doing is just the initial preliminary checks. For the most part, what we're doing is verifying by username and password, or some sort of other credentials, that this machine or user can connect to the network. But there's not a continuous check that happens on this machine.
Zero trust networks say that we're going to continually check, because once this machine is connected into the network, things could change, things could go out of date. And when they go out of date, we need to make sure that they fix those patches, that they get rid of that virus, or whatever the case may be, that they fix whatever issues come up. So zero trust means that they're constantly going to verify that this machine is in compliance.
One example is when Juan logs onto a computer. In some traditional networks, what happens is that they get the keys to wherever they need access to. So maybe Juan has access to sales, but let's say he gets promoted and now he needs to be switched and work in management. What happens is that he got the initial credentials when he first logged onto the system, so he still has access to sales. Even though on the back end, maybe it's some sort of LDAP servers, they've changed and now say, well, he has access to management now and doesn't have access to sales, that change doesn't take effect until he logs off the system and logs back on.
Zero trust says that you're continually going to check. So when we make a change on the back end system like this, it immediately takes place for Juan, so that when he tries to reconnect to one of these services it will understand that this change has occurred.
We call zero trust policy-driven access control. Policy-driven because we set up policies, criteria for what it is that we are going to check to make sure that they are going to be allowed onto the system, and then we grant access control based off of what we find on there.
Zero trust has something called adaptive identity. Identity, thinking of the valid user, but also other aspects of risk of this particular device or this subject that's trying to enter in or connect to a resource. So I like to think of adaptive identity as being continuous assessment, because that's essentially what's happening: we're continually assessing the identity. We're adapting to what is changing on this particular user or subject and then allowing or denying them access to resources based off of that.
Network access control could be part of the solution of a zero trust network and a zero trust architecture. What that means is that the network access control is checking to see, is it a valid machine? Is it a valid user? Is the OS patched? Do we have antivirus patched? Do we have a recent antivirus scan? And so on and so forth, whatever stipulation we have, whatever criteria we have.
So implementing zero trust into this just means that it's not going to check initially, but it's going to check every so often to make sure that this machine is still in compliance. This all results in less risk, because when they go out of compliance, they're no longer connected to our network. We call this a threat scope reduction. The threat scope is reduced, and so it's a threat scope reduction.
There are times when we want to implicitly trust something. That means we don't necessarily want to jump through all the hoops to trust this device or not.
Let me give you a good example. Let's say we go through all the trouble of setting up our policies on whether a machine is trusted or not, and then suddenly we lock everybody out of a network because we have zero trust and nothing complies to this policy. So now somehow we need to still have access to things in that scenario. A good example of this is maybe we have some sort of management network or something where we have access to other resources. So not all devices have access into this network, but from this network we have the access to all other networks.
What we call this example right here is an implicit trust zone. Any devices that connect to any other zones, they have to go through all of the hoops of making sure that they're allowed onto the network and going through all the verification steps. But if you connect to this one network right here, now you have full access. And then we'd want to safeguard that area. But this gives us an implicit trust zone that we have access to other networks from.
Another example of an implicit trust zone might be a guest network. This could be even a network that, if they don't get access to other networks, then they can jump on this guest network, do the updates, do whatever they need to do to be able to qualify and get onto one of these other networks. So that would be another example of an implicit trust zone.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →