In this article, we'll explore what zero trust security means in a business context and why it's a useful tool.
What does zero trust security mean?
Zero trust means that no person or device is trusted inside a network by default. The term was coined by Stephen Paul Marsh in his 1994 doctoral thesis(new window), and later referenced by John Kindervag in 2009 when he posited the idea of a zero trust model in his work for Forrester(new window).
In a zero trust environment, a user will be granted minimal access canada phone number data to a system after they verify their identity. A system will never 'trust' that a user is who they say they are: it will always verify.
When you use zero trust security, everyone accessing your business network has their identity verified before they can access systems, apps, and data. Access is granted on a one-time basis for each session.
Why is zero trust architecture necessary?
To understand the concept of zero trust, we need to first understand perimeter security.
To protect your business networks, you set up perimeter security. Picture your network as a walled city. The wall ensures that every visitor can be granted access through a checkpoint manned by a security team. That perimeter could be a firewall, or an intrusion detection system that monitors your network traffic. Historically, that checkpoint is often a static password.
With the concept of zero trust security, Marsh and Kindervag addressed the growing issue of insufficient network protections. Business network environments used to be configured with a single perimeter, which didn't protect them against insider threats. If a malicious actor was able to gain access to a business network via malware(new window)or ransomware , few measures were able to detect and prevent them.
Today, it is also not sufficient to grant access to all business networks with a single perimeter. Many business networks work in the cloud, on local devices, or some mix of the two. Employees might be accessing business networks from different locations or personal devices. A single barrier isn't sufficient protection for a large and varied infrastructure like those used by businesses of all sizes today. The focus must be shifted from a single perimeter protecting business networks to an access-based consideration of every user and every login attempt.