In this lesson, we're going to cover
the concept of Zero Trust.
In our current digital age,
we are constantly being bombarded with digital threats
that are more sophisticated than ever
and this continually is putting
our traditional cybersecurity strategies to the test.
Now, traditional cybersecurity strategies
have always focused on using a strong perimeter defense,
much like an old castle has strong walls
and a moat around the castle to keep threat actors at bay.
Now, the problem with these old school strategies though,
while they were effective in the past,
is that they are no match for our modern networks.
After all, castles were the pinnacle of security
about 1,000 years ago, but these days,
I could simply fly over them with a drone or a helicopter
and now I can attack anybody inside the castle
and those castle walls and that moat
aren't doing anything to stop me.
Well, this is exactly how most computer networks
were secured over the past few decades.
Cybersecurity experts had configured networks
with strong external defenses
by using things like firewalls,
intrusion protection systems, and other perimeter defenses.
But these days, many of our network devices
are pretty much deperimeterized.
Now instead, we must protect all of our systems and data
using multiple levels of encryption, secure protocols,
data level authentication,
and other host-based protection mechanisms
because using a perimeter only structure
is not going to keep us safe.
Now, from an operational perspective,
most people love deperimeterization
because it allows us to reduce our costs,
conduct business to business transactions
from anywhere in the world, and has become increasingly
more agile for us as organizations to use
this type of deperimeterization.
The move to the cloud, when combined with
the rise of work from home, has really increased our ability
to conduct secure operations
within a deperimeterization architecture.
Now, deperimeterization has occurred due the migration
into the cloud, the increase in remote work,
people embracing mobile technologies
along with the rapid adoption and use of wireless networks,
as well as larger movements
towards outsourcing and contracting.
But this whole deperimeterization movement
does really introduce a lot of risks
to our organizations too, if we're not careful.
So to protect these deperimeterized networks,
we can't simply rely on boundary or perimeter defenses.
And instead, we need to implement a best practice
which is now known as Zero Trust.
Zero Trust is used to ensure the security
of your corporate network and your corporate data.
Now, when we look at our traditional networks,
we used to believe that our networks
and our users were trusted
because we gave them access to those systems.
But under a Zero Trust model, that is simply not the case
and that is considered a good thing in our modern world.
You may have heard the old saying, trust but verify,
which was made famous by President Ronald Reagan
back in the 1980s.
But as cybersecurity professionals,
we actually take this a step further.
When we implement Zero Trust,
we want to quote our favorite mantra,
which is trust nothing and verify everything.
And that really does sum up the entire architecture concept
behind Zero Trust systems.
With Zero Trust, we demand that verification happens
for every device, every user,
and every transaction within our network
regardless of where it came from.
This means that whether a user is attempting to access
a system from within our organization's physical office
or from over the internet, because they're doing it
from home remotely, their identity and permissions
are always going to be verified.
This methodology also addresses the changing nature of work
and the digital landscape that has moved
to a deperimeterization while acknowledging that threats
can emerge from both inside or outside of your networks.
Now, in order to create a Zero Trust architecture,
we're going to use two different planes.
These are called the control plane and the data plane.
Now, the control plane refers to the overarching framework
and set of components that are responsible for defining,
managing, and enforcing the policies related to user
and system access within an organization.
It provides a centralized way to dictate and control
how, when, and where access is going to be granted
to ensure that only authenticated and authorized entities
can access specific resources.
The control plane typically encompasses
several key elements, including adaptive identity,
threat scope reduction, policy-driven access control,
and secured zones.
First, we have adaptive identity.
In Zero Trust, we assume that static one-time verifications
are not sufficient, so we must use adaptive identities
that relies on real-time validation
that takes into account the user's behavior, their device,
their location, and other factors like that.
By continually assessing these variables,
our user identities are constantly adjusting
and adapting to the environment in order to grant
or restrict access to them as required.
Second, we have threat scope reduction.
Now in Zero Trust, we want to limit our users' access
to only what they need for their work task
because this drastically reduces
the network's potential attack surface.
This approach is focused on minimizing the blast radius
that could occur in the event of a breach,
and ensures that the compromised credentials
will not allow attackers to have unimpeded access
throughout your entire network or system.
Third, we have policy-driven access control.
Now the policy-driven access control is going to develop,
manage, and enforce user access policies
based on their roles and responsibilities.
By defining clear policies, organizations can ensure
that users only have access to data that is pertinent
to their role in order to reduce the potential
for successful data breaches against your organization.
Fourth, we have secured zones.
Now, secured zones are isolated environments
within a network that are designed to house sensitive data.
Only users with the appropriate permissions
can access these zones and this creates
a further layer of protection.
Now, in addition to the control plane,
we also have something known as the data plane
that we have to use to properly implement Zero Trust.
While the control plane lays out the policies
and procedures, the data plane is going to ensure
those policies are being properly executed.
The data plane is going to consist of the subject/system,
the policy engine, the policy administrator,
and the policy enforcement point.
First, we have the subject system.
The subject/system refers to the individual
or entity attempting to gain access.
This could be an employee, a workstation,
or even a software application.
The primary objective is to verify the authenticity
of the subject or system before granting access to them
to be able to access your sensitive data or systems.
Second, we have the policy engine.
Once the subject's identity is verified,
the policy engine cross-references the access request
with its predefined policies.
Think about it like a rule book that determines
whether the request aligns with the subject's permissions.
Third, we have the policy administrator.
Now the policy administrator is an essential part
of the Zero Trust model that's going to be used
to establish and manage the access policies.
This is the entity that dictates who gets access to what,
and ensures that the policies align with the organization's
security protocols and business objectives.
Fourth, we have the policy enforcement point.
The policy enforcement point is the final step
in the process, and this is where the decision to grant
or deny access is actually going to be executed.
Based on the verification from the subject or system
and the policy engine's determination,
the policy enforcement point will then allow
or restrict access and it will effectively act
as a gatekeeper to the sensitive areas
of your systems or networks.
So remember, Zero Trust is a cybersecurity approach
that assumes no user or system is trusted by default
and it requires continuous verification for access
to your organization's resources regardless of
the location or origin of your network request.
Zero Trust is more than just a security trend though.
It really is the acknowledgement
from the cybersecurity community
that we're facing an ever evolving digital landscape
where threats can come from outside
or inside of your network.
While traditional perimeter-based defenses
still hold value and they should be used,
they're increasingly going to be insufficient
on their own to protect your system
solely by using the perimeter.
So as we navigate an age of remote work, cloud computing,
and ever increasing array of devices,
Zero Trust principles do offer us a roadmap
to creating a more robust and adaptable security posture.
By integrating the Zero Trust strategies
and using our control planes and data planes,
organizations can proactively defend against threats
by recognizing that trust is a commodity
that must be earned, verified, and continuously reassessed
at every enforcement point within your systems and networks.