In today’s digital landscape, where security breaches and cyber threats loom, embracing a robust security framework is crucial. Zero Trust Architecture (ZTA) represents a shift from traditional security models that once trusted users within an organization’s network perimeter. Instead, ZTA assumes no implicit trust is granted to assets or user accounts based solely on their physical or network location. This article dives deep into what zero trust architecture means, its core components, and how it applies to modern IT environments, including insights into zero trust telemetry and zero trust printing.
Zero Trust Architecture (or just Zero Trust) is an overused term across the board in IT. Its meaning is often hard for many people to understand. If you want you can read technical articles like NIST Special Publication 800-207: Zero Trust Architecture, but I’d like to simplify and explain what it means in a TL;DR fashion.
What does Zero Trust really mean?
Zero Trust is a comprehensive approach to network security that influences how security checks are performed. It dismantles the old model of a secured perimeter and shifts focus to secure individual access requests across the environment. This method involves meticulous authentication and authorization procedures to confirm the identity and permissions of each request, ensuring that only legitimate access is allowed.
How Zero Trust works: authorization and authentication
Imagine attending a summer festival, where entry at each tent requires a separate badge scan. Similarly, each request is independently verified in a Zero Trust environment, whether it’s access to a network printer or a database. Authentication determines if a user’s credentials match the ones required for access, while authorization checks if the user can access the resources.
Never miss an update
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Key Tenets of Zero Trust Architecture
Zero Trust Architecture is underpinned by six key tenets that ensure its effectiveness and adaptability across different IT environments:
1. Everything Is a Resource
Every data element, application, and service is considered a resource. Access to any resource, no matter how minor, must be secured.
2. Secured Interactions
Interaction with resources must be secure regardless of location. Whether a user is on the internal network or accessing data remotely, the security scrutiny remains stringent.
3. Per-Session Access Control
Access permissions are granted for each session based on user verification and context. Just like in our festival analogy, leaving a restricted area and trying to re-enter would require a new verification process.
4. Dynamic Policy Enforcement
Policies determining access are dynamically adjusted based on several factors, including the requester’s behaviour, location, and security posture.
5. Implementing Zero Trust Architecture: More Than Just Security
Having the ability to monitor and evaluate the integrity of assets performing requests is a prerequisite of Zero Trust. This requires telemetry on all assets that can assist in building a correct picture of the security of the asset. Like bar staff understanding how to tell if someone is drunk, or requiring people backstage to be visibly wearing their pass at all times.
6. Monitor the Integrity and Security of All Assets
Zero Trust requires robust mechanisms to monitor the security posture of all assets continuously. This includes employing zero trust telemetry to detect anomalies and ensure that only secure devices and users maintain access to resources.
Security you can… trust?
What Zero Trust is not, is a turnkey solution that you can buy. It’s also not just putting all your services on the internet.
What is all this trying to say? Zero Trust is about having a design framework that allows you to govern access to resources based not only on permissions assigned to a subject (user or system) but also taking into account the task being conducted and the current status of the requester.
This in turn creates the requirement to have strong telemetry and asset tracking for IT resources. And the ability to correlate that data into actionable security insights that can be applied dynamically.
It also implicitly understands, that in practice, a modern internal network is less like an ordered, solemn workplace, and a little bit more like a mosh pit.
Are you unsure about your print environment’s security? Let’s talk…
