English
Menu

What is Zero trust?

A security approach that grants no implicit trust based on network location (inside or outside the company) and, for each request to access a resource, checks the user's authentication, the state of the device and the content of the request before allowing only the minimum access needed. It is summed up as "never trust, always verify". The US NIST set out its principles and components, such as the policy decision point and the policy enforcement point, in SP 800-207, published in 2020. With the spread of cloud services and remote work, it has been adopted as a way of thinking that complements perimeter defense.

Japanese name: ゼロトラスト

Zero trust appears in 4 practice questions across 2 topics, including Cyber Attacks and Defense in Practice, Applied Cryptography.

Field: Cyber Attacks and Defense in Practice

How it differs from perimeter defense

Traditional perimeter defense treats the internal network as a trusted inside and uses firewalls to keep intruders out. Once an attacker gets inside, for example through phishing, they can move freely within. Zero trust does not decide trust by inside or outside and applies the same checks to access from within the company, which limits how far damage spreads after an intrusion.

Components

SP 800-207 separates the policy decision point (PDP), which decides whether to allow access, from the policy enforcement point (PEP), which carries out the decision between the user and the resource. The decision uses information such as identity management and multi-factor authentication, the management state of the device, threat information and log analysis. Implementations combine ZTNA (zero trust network access), micro-segmentation and identity-centric access control.

How to introduce it

Zero trust is not achieved by buying a single product; it is an effort of identifying what to protect (data, applications and assets), understanding the traffic flows and gradually tightening the policies. It is usually introduced step by step, starting with consistent multi-factor authentication and device management, then moving important applications to ZTNA.

Try it: questions about Zero trust

Which of the following correctly describes access control based on the idea of zero trust?

  1. AIt does not trust anyone just for being on the internal network; for each request it checks the user and the device state and allows only the minimum access needed
  2. BIt regards the inside of the internal network as safe and lets traffic flow freely there, using the perimeter firewall and VPN only to keep out intruders from outside
  3. COnce a user and a device have logged in successfully, they are trusted and can afterwards access all systems freely without further checks
Show answer and explanation

Answer: A. It does not trust anyone just for being on the internal network; for each request it checks the user and the device state and allows only the minimum access needed

Traditional perimeter defense regarded the internal network as a trusted inside and kept intruders out at the perimeter. As cloud use and remote work spread what must be protected beyond the company, and because an attacker who gets inside the perimeter can move freely, the idea of zero trust, which grants no trust based on network location, has spread. In SP 800-207, published in 2020, the US NIST set out principles such as not trusting implicitly based on network location, granting access to resources per request and deciding by dynamic policies based on factors such as the state of users and devices. It is summed up as "never trust, always verify".

The zero trust architecture of NIST SP 800-207 separates the "policy decision point (PDP)", which decides whether to allow access, from the "policy enforcement point (PEP)", which carries out the decision. Which of the following correctly describes how the two work when an employee accesses a business application?

  1. AThe PEP decides whether to allow access based on the user's authentication and the device state, and the PDP runs on the user's PC to encrypt the traffic to the application
  2. BThe PDP decides by checking the authentication result and the device state against the policy, and the PEP between the user and the application lets connections through or cuts them off according to that decision
  3. CThe PDP and the PEP are two names for the same device, and once a connection is allowed, the decision is in principle not revisited until the session ends
Show answer and explanation

Answer: B. The PDP decides by checking the authentication result and the device state against the policy, and the PEP between the user and the application lets connections through or cuts them off according to that decision

In SP 800-207 the PDP, made up of the policy engine and the policy administrator, decides whether to allow access by checking the user's authentication result, the state of the device, the importance of the resource being accessed, threat information and so on against the policy. The PEP sits on the path between the user and the resource and enables, monitors and terminates connections according to the PDP's decision. Separating decision and enforcement lets the policy be managed in one place while being applied in the same way at the entrances of many applications. Also, if the state of the device or other factors changes, the decision can be revisited even during a connection and the access stopped.

FAQ

Does adopting zero trust make firewalls and VPNs unnecessary?

Not immediately. Zero trust is the idea of not trusting on the basis of network location alone, and perimeter defenses remain useful as a layer that reduces attacks. For remote access, however, there is a trend to move from VPNs to ZTNA, which grants access per application.

If "nobody is trusted", won't it be harder for employees to work?

What is not trusted is the network location; access that is needed is allowed after checking. Single sign-on and passkeys keep the checks unobtrusive, and extra verification is requested only for unusual situations such as a new device or an unfamiliar location, balancing security with usability.

Zero trust in the explanations

Questions that mention Zero trust (4)

  1. Which of the following correctly describes access control based on the idea of zero trust?
  2. The zero trust architecture of NIST SP 800-207 separates the "policy decision point (PDP)", which decides whether to allow access, from the "policy enforcement point (PEP)", which carries out the decision. Which of the following correctly describes how the two work when an employee accesses a business application?
  3. Which of the following correctly compares a traditional remote-access VPN with ZTNA (zero trust network access) as ways for remote employees to use internal systems?
  4. Which of the following correctly describes mutual TLS (mTLS)?

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

Comparisons that include this term

Related terms

TLS Cyber Kill Chain Digital forensics EDR (endpoint detection and response) Incident response Indicator of compromise (IoC) Intrusion detection system (IDS) Lateral movement MITRE ATT&CK Penetration testing

Back to the glossary