Zero Trust, the model 

In its simplest form, Zero Trust refers to a model of not trusting anything and verifying everything. The traditional remote working strategy, employed in the past, was to extend the local network by VPN. If a user logged in successfully, they would have the same permissions a local user would have. This opens the network up to a single breach exposing the entire network.

Zero Trust is a model that can be employed in various operation flows and is not limited to remote work. How to achieve this is done in various ways.

Discussing this in relation to a remote work strategy, here are some of the methods in achieving Zero Trust compliance. 

•  Segment network and application into individual areas of access.  
•  When logging in remotely, put the user in a network that requires them to cross a gateway/firewall to reach their destination.  
•  Limit by user the access allowed and deny everything by default.
•  Validate the user at any network transit and application access point.
•  Put in place time of day policies.
•  Put in place MFA policies to validate the user past a simple username and password authentication method.
•  Monitor and report, all the way up to layer 7 level, with alerting on out of the norm.
•  Design the network and application layer in such a way that makes it impossible to use a node to gain access to other nodes.

Although this discussion refers primarily to remote work strategies, the Zero Trust model extends to local and client-facing mechanisms. Local devices being compromised is just as much a risk as remote log-in compromises. 

Zero Trust, the marketing term 

With our background in large WAN design, we were in the middle of “The great MPLS hype”. It started as a technology that had an important role in networking, to something that was being used by Sales people to sell WANs. All of a sudden, we were seeing MPLS employed in designs it had no place being and in fact, made the solution worst. This is when the Sales team drives design, instead of logic.  

With Zero Trust being a model, instead of a technology, we are now seeing providers incorrectly labelling their solutions as Zero Trust. The fact that the Zero Trust extends past the remote working part of the solution, from the application layer all the way to the end-user device, is completely ignored.  

For this reason, it is important to understand, unless your service provider, controls the entire architecture relied upon by your staff and clients, the model is not truly in place until you can verify each phase of access. The only person that can truly label your environment as Zero Trust compliant is you. Be aware to not fall for the marketing hype when implementing a solution. 

Next week we will finally discuss Software a Hybrid solution, before finally discussing VPN technologies.