Assume Breach
This final piece of the zero-trust model stresses that the design of the network, security, and other access controls should treat every attempt as hostile. As an administrator or architect approaching security with this design philosophy, you may choose to segment your network and application resources, require specific device or network configurations, and ensure that devices and identities pass multiple stages of verification. Once identities and devices are verified, data should be encrypted to safeguard against over-the-air or other methods of snooping on traffic, and sensors should be deployed to detect anomalous activity and isolate risky devices.
Now that you are aware of the zero-trust model and its principles, the next section will look at areas (or pillars) a zero-trust defense strategy should protect.
Zero Trust Pillars
Organizational assets can generally be broken into six categories (or pillars, as Microsoft refers to them):
- Identity
- Endpoints
- Apps
- Data
- Infrastructure
- Network
Over the next few sections, you will explore each of these areas and explore ways to reduce surface attack areas and improve organizational security.
Identity
Cloud services pose new security and access challenges. Traditionally, users have done the following:
- Only access the organization’s resources inside the organization’s network perimeter
- Only access the organization’s services that are hosted on the organization’s hardware
With cloud services, enterprise mobility, BYOD objectives, and the consumerization of IT, organizations cannot depend on the traditional way of security and access. Users are now accessing a variety of services from a multitude of vendors from both company-owned and personal devices. Identity is the new security perimeter for companies since it is the ultimate key to access.
From a cloud service perspective, identity defines the users, the permissions they have, and what they can do with those permissions. With that defined, organizations need to plan how to protect users wherever they may be.
