Few phrases in security have been stretched as far as Zero Trust. It appears everywhere, from packaging to board meetings, with little agreement on what it means and is often portrayed as a final product that can be bolted on. Zero Trust is not a product or a service; rather, it is a philosophy and a framework, and beneath all the marketing and hype it is a foundational guiding principle, one that mid-sized organizations can adopt step by step, one piece at a time to fit within their specific budget and tolerance for disruption. The trick is separating what is fact from what is marketing.

What Zero Trust Means

John Kindervag created the concept of Zero Trust in 2010 while working at Forrester as an analyst. At the time, it was not uncommon for wide-open access to be available on company networks, and the old approach was one of perimeters. Everything outside the perimeter, usually anything outside on the public internet, was considered hostile and anything inside connected to the network was considered friendly. The fundamental issue with this approach is what happens when something inside the perimeter is also hostile? This was a question almost never asked because the IT of the day was so focused on protecting the perimeter they developed a blind spot to trouble brewing right under their noses.

Then 2013 brought CryptoLocker, and the chinks in the old armor started to appear. These ransomware trojans would make it inside the network, and due to the unrestricted access all the network devices have, the damage extended to servers, network attached storage (NAS), and even the backup services ostensibly there to protect against the devastation of this very thing. Wave after wave of ransomware came and the industry quickly began to realize the inferiority of this assumption and began implementing similar concepts sporadically and unfortunately often only after an incident had occurred. I remember once I was proposing a series of security measures and I was asked “Which are the most important?” to which I responded “Well, wait until you get breached and then I can tell you which you should have done”, and that was the prevailing attitude of the time, what is the least I can get away with, paired with “well that only happens to large companies, we are too small and it’ll never happen to us”.

Then in 2018 the federal Government began formally drafting guidance, with it being adopted in 2020 and was enforced in 2021 by executive order, after which John Kindervag authored the NSTAC Zero Trust report that was given to the president when John was serving on the U.S. President’s National Security Telecommunications Advisory Committee (NSTAC) Zero Trust Sub-Committee, making a it an enforced, formal part of our nations cyber security framework.

But what does it mean? The framework rests on protecting five pillars, which are Devices, Networks, Identity, Applications and Workloads, and Data, and fundamentally it means the opposite of the legacy attitude of trust everything, hence the name. Nothing is to be trusted, every new encounter does not assume that just because during the last encounter the device was non-hostile, that it is this time too. Everything must be verified and reverified, and if that seems like overkill consider the following: every time a server that got ransomware saw the workstation that did it, it was friendly, until it wasn’t. A Zero Trust architecture makes access decisions for specific resources using identity, device posture, policy, and context, not the simplistic inside or outside, or something I’ve seen before or something I haven’t. In addition, it includes the idea of least privilege. Users, accounts, workstations, devices, services, and any other person or thing in your environment only have access to the specific things they need to perform their job or function, and nothing else. All of this works together to limit what we call the blast radius, i.e. how far can this reach and how much damage can it cause if it gets compromised.

Why the Term Attracts Hype

The term gets bandied about by vendors and clients alike for a couple of simple reasons. One, it sounds like a great idea (and it is), and two, the current security landscape scares people (and it should). The problem is that you can’t shove a framework in a box or slap a sticker on philosophy, so all the purported Zero Trust solutions are portrayed as the final install, the whole package, the last purchase, when in fact, by the very nature of Zero Trust, it is only a little piece of the puzzle. That won’t stop them from trying to sell it to you, though.

A Practical Path

For a mid-sized organization, Zero Trust is best pursued incrementally, beginning with the steps that yield the most protection for the least disruption. Strong identity control is foundational, which means implementing Multifactor Authentication (MFA) comprehensively and consistently managing who has access to what. From there, making sure all devices have encryption and Endpoint Detection and Response (EDR, another philosophy sold as a product, but that is a story for another day), implementing least-privilege access, and network segmentation, all of which help reduce the blast radius. Lastly, logging and monitoring all of it, ideally with a real-time Managed Detection and Response (MDR), MCR, or Security Operations Center (SOC) service.

What It Is Not

Zero Trust is not a package, a product, an install, or a purchase. It also isn’t a magic spell or protective circle, having the philosophy implemented even very thoroughly is not a guarantee that you are safe (however disregarding it all but guarantees that you are not).

Deciding How Far to Go

How much of a Zero Trust architecture to adopt, and over what period, is a business decision shaped by the sensitivity of the infrastructure and its data, existing investments, and disruption tolerance. Each business and its people are unique, with a different environment and culture, and each requires careful planning and implementation to achieve high-quality outcomes. If you are interested in learning more or mapping out a Zero Trust path for your organization, please reach out to your Sandbox Technologies Engineer, Consulting CIO, or Account Manager.