What is Zero Trust security?

Zero Trust is an approach to cybersecurity that requires all users, devices and connections to be continuously authenticated before being granted access to data and IT assets.

Zero Trust is an alternative to a “castle-and-moat” strategy that implicitly trusts users and devices connected to the network. Historically, this model has enabled attackers who have successfully penetrated a network perimeter to move freely throughout an IT environment.

A Zero Trust model can stop this lateral movement by ensuring only authenticated users and devices have access to applications. This is achieved in part through least privilege access enforcement, comprehensive security monitoring of user activity and an understanding that everyone is denied access by default.

In the past, network security was focused on creating a solid perimeter within which data and assets could be protected. Any user, device or asset already within the network was considered safe and could be granted broad access.

With the rise of cloud computing and remote workforces, IT environments are increasingly distributed. Users, data and resources may reside anywhere in the world, making the notion of a secure network perimeter obsolete. At the same time, security threats have grown increasingly sophisticated, and the average cost of each data breach now reaches millions of dollars.

The Zero Trust framework was developed to provide superior security by validating users, devices and connections on every transaction, regardless of whether they are inside or outside the organization. Organizations can block and neutralize many common security threats with Zero Trust security. And when attackers successfully breach a network perimeter, Zero Trust security prevents them from dwelling for long periods within the system, moving laterally to exploit high-value targets and sensitive data and applications.

Zero Trust delivers comprehensive visibility of sensitive data across the organization – including visibility of the users and groups accessing that data – and a flat network topology to limit exposure if an area is compromised.

Zero Trust security is built on several fundamental principles and practices.

• Never trust, always verify. Zero Trust requires organizations to curtail permission sprawl for users inside the network. Every user, device and connection must assume to be already compromised and must be re-validated on every request.
• Accept that threats are already in the network. Zero Trust requires security teams to assume that threats are already within the system and to seek to identify and remediate them constantly.
• Practice least privilege. Rather than giving users broad permission to access data and IT resources, a Zero Trust approach gives users as much access as they need for business purposes, minimizing their access to sensitive network parts.
• Continuously monitor. Zero Trust requires security teams to track data as it moves through the network and monitor the actions of users who interact with it. This allows IT teams to validate that users are whom they say they are and that resources are not being misused.
• Deploy microsegmentation. To better protect an IT environment, a Zero Trust approach protects IT networks with microsegmentation. Rather than drawing a perimeter around an entire IT ecosystem or large sections, microsegmentation creates many more security perimeters, even protecting individual assets. This prevents threat actors from successfully penetrating the network from having unfettered access to high-value targets by moving laterally through the network.
• Implement device control. By requiring strict controls on device access, Zero Trust security systems can monitor all the devices trying to access the network and ensure that each device is authorized and has not been compromised.
• Rely on multifactor authentication (MFA). When authenticating a user, MFA solutions require users to present two or more pieces of evidence, or factors, to verify their identity. Factors may include personal passwords, one-time passwords pushed to a mobile phone, a fingerprint scan or facial recognition, a security fob or other items that the user knows, has or is.

Zero Trust Network Access (ZTNA) is a product for providing secure remote access to the IT resources within an organization based on clearly defined access control policies. ZTNA solutions have become an essential part of the technology stack as workforces have become more mobile and more users work from home.

ZTNA implements the principles of Zero Trust security and is a pillar of the Secure Access Service Edge (SASE) security model. The model includes products like Software-Defined Wide Area Networking (SD-WAN), Cloud Access Security Brokers (CASBs) and Secure Web Gateways (SWGs).

Unlike VPNs, which provide users with access to entire the entire network, ZTNA grants access only to specific services or applications, limiting a user’s access to IT resources for which they are not authorized. ZTNA uses a secure, encrypted tunnel to grant access to specific applications. It uses identity-based access control policies to prevent unwanted or compromised devices from accessing IT resources.

ZTNA supports the hybrid workforce by giving organizations an easy and secure way to connect users, applications and data that may be distributed worldwide. Identity-based access control policies allow users to access the resources they need from their own devices (BYOD).

ZTNA improves the user experience by not requiring traffic to be backhauled through a data center, reducing latency. With the ability to scale easily, ZTNA technologies provide more agility for organizations as they accommodate new business requirements and exploit new business opportunities. To achieve this, organizations must use a ZTNA built on a hyper-scaler network that can provide hundreds of Points of Presence. Any fewer, and they will make the same mistake of bottlenecking traffic as VPNs do.

As a company dedicated to proactively safeguarding critical data and IP with comprehensive security solutions, Forcepoint offers multiple products for organizations seeking to implement a Zero Trust framework. These include:

Data Loss Prevention
Forcepoint’s Solutions Data Loss Prevention (DLP) solutions provide tools and functionalities to help prevent data from being lost, accessed by unauthorized users, or accidentally or purposefully leaked. By monitoring data flowing in and out of the organization, DLP technology uses security policy to detect sensitive information and block it from leaving the organization’s domain. Many companies, utilize Microsoft’s Purview Data Loss Prevention tool; however, Office 365 tools are not robust enough to fully cover a company from the broad array of consequences that can result from leaked data.

Zero Trust CDR
Forcepoint Zero Trust CDR (Content Disarm & Reconstruction) helps to stop known and unknown threats, zero-day attacks and malware. Rather than solely relying on malware detection, Zero Trust CDR assumes that nothing can be trusted and that every file, email and document is already compromised. When users receive or request access to an IT asset, Zero Trust CDR extracts the valid business information from the file, verifies that the information is well structured, and then builds a new and fully functional file. Zero Trust CDR renders incoming files and data safe, preventing attacks while reducing the cost of detecting, analyzing and responding to cybersecurity incidents caused by malware concealed in incoming files.

Zero Trust Web Access
Comprised of Secure Web Gateway (SWG), and Remote Browser Isolation (RBI), Zero Trust Web Access lets users securely isolate a specific browser session. This ensures that even if there is a potential threat within the content being viewed, it can’t infiltrate the machine that accessed it. Forcepoint’s solutions take an additional step to remove that threat once it’s found. CDR, in combination with RBI, reroutes any risky traffic and reviews the on-page content and recreates a clean file that’s scrubbed of any malware.