Zero trust is an approach to information security that doesn’t rely on trusting other people or systems. It instead focuses on assessing the motives of individuals, not just what they say but also how they act, and then using those assessments in place of formal credentials when determining whether to give them access to sensitive data or resources.

The term “zero trust” was coined by internet safety educator Bob Brockway back in 2011. Since then, it has gathered momentum as an effective way to protect organisations from cyber-attack. A growing number of vendors have implemented zero trust technology within their products.

At its most basic level, zero trust means removing passwords as a requirement for account authentication. Instead, users are given features such as digital signatures (using private keys) or biometrics (for example, facial recognition or voice identification) to confirm who they are.

Zero trust isn’t easy to achieve, though. It requires significant changes to the way we use computers and mobile apps, and potentially rewiring how companies operate. This can be very difficult even during a crisis like a national lockdown.

In this article you will learn about some of the challenges of implementing zero trust, and why it may not be appropriate for your organisation right now. You will also find out some tips on how to maintain at least a degree of online anonymity while still getting the job done.

Who should implement zero trust?

As we have discussed, defining who has access to your organization’s most sensitive data is one of the first steps in implementing a zero-trust approach. You will need to determine which individuals are allowed to access these resources and what privileges they deserve, but beyond that, there isn’t much more you can do to strengthen internal controls.

At this stage, it may be appropriate to look at ways to reduce reliance on legacy technology. Technology such as email, chat apps (like Slack or HipChat), and file sharing services like Dropbox can easily be gated or limited through the use of policies. If someone needs to send an attachment, for example, then they must go through a process where their request is reviewed and approved before it is granted.

It is also worth looking into how digital records are preserved in cases of death or disappearance. A lot of times, when people disappear or die, all traces of them are lost. Technically speaking, this shouldn’t happen because everything gets saved online somewhere, but if possible, make sure to erase any old accounts and memories related to the person being tracked.

There are many free tools that can help you with this, so don’t feel like you have to spend money on expensive software. By simply using Google, you’ll find plenty of information and tips on how to do this.

What are the benefits of zero trust?

One major benefit of zero trust is that it does not require authentication before you can access something online. This removes one of the biggest barriers to using social media sites, for example.

There have been instances where people have posted malicious content or engaged in illegal activity. Because these websites do not require users to be authenticated, they cannot use this as an excuse to keep the site private.

It also means that third-party apps can access the website without being verified first. Some companies will ask for your username and password before giving them limited permissions, but this process can be time consuming especially if you need to check out several products quickly.

With zero trust technology, there is no requirement for login credentials or authentic accounts. This gives app developers greater freedom to create new applications and expand current ones.

What are the weaknesses of zero trust?

The main weakness of zero trust is that it assumes there are no malicious users or apps. Systems with this architecture still rely heavily on online services for functionality, so if an unknown app/user logs onto your system as a trusted user, it can be used to access resources.

By designing systems that don’t depend on specific apps or individual users, we risk limiting how capable our security measures are. We may not be able to use certain features because they require authentication through an external service, but we also lose the ability to verify authenticity of those services.

This isn’t necessarily a bad thing, but it does mean that we need to be more aware than ever before when using digital goods. It also means that we can’t assume things will always work in good ways, we have to think about what functions we give out and who has access to them.

What are some examples of zero trust?

One example is having a website or app that requires you to create an account before using it. While this can be annoying, there’s really no way around it unless you want to use an inferior product.

By requiring an additional step, users will have to take more time to find your application useful so most people won’t! This is why many apps now require only their email address as a login which then allows them to access certain features.

Another example is when someone downloads an app but doesn’t have a user name or password set up yet. Technically they aren’t logged in either, but at least they’ve given permission for the app to connect to all of their accounts.

Yet another example is when an employee leaves his/her job and takes their smartphone with them. They may choose to not log into the company e-mail service using their own username and password, or perhaps even remove all traces of work related information from the device.

What are the steps in a zero-trust architecture?

The first step towards creating a zero trust environment is to evaluate your network layer for risk. This means looking at how connected you are, what kind of apps you use, what software you have installed, and whether you need these apps or not.

If you find yourself constantly having to approve every app before giving it access then there’s something about this app that makes you feel unsafe. It may be because of who owns it, or what they own that can be accessed via the app, or even if it’s just a general feeling that something isn’t right.

You don’t have to completely remove all security from an app or device, but you can reduce the layers of protection put in place. By doing so, however, you should know what resources each app has before granting them access.

What are the different types of zero trust?

The first type is endpoint level or device-level authentication, which requires users to authenticate themselves by confirming their identity at an individual device (computer, phone, TV, etc.). This can be done through using login credentials such as username and passwords, fingerprint scans, facial recognition, and so on.

Device-level authentication is great because it doesn’t require any additional software or apps, but it also has its drawbacks. Because device level authentication depends heavily on each individual user verifying who they say they are, it may not be effective if people don’t use good security practices. For example, someone could easily fake their ID, or even have two IDs – one from social media and one that they manufactured.

The second type of zero trust is domain-level authentication. With this method, instead of requiring individuals to identify themselves individually, only their specific domain levels are verified. An example of this would be checking whether your email address is in our system or not, nothing more than that. It does not verify whether you work for the company or not though, nor do we check to see if you’re authorized to access internal systems.

Domain level authentication is better than device level because it removes some potential points of failure, but it isn’t quite as secure as the first kind. One way around this is having separate accounts with separate domains, but there should be minimal need for this.

What are the different levels of zero trust?

First, there’s what we like to call “zero-level” or “thin” security. This is simply not allowing any permissions for users at all. All access must be fully internal (logged in users can perform actions within your app) with no external logins or OAuth services.

Thin security is great if you're just getting started building apps because it's very easy to implement and test. But unless you have a lot of money to spend, this type of authentication will probably not work when you want to grow beyond a small team size.

At that stage, you'll need more robust ways to protect data and assets.

What are the different components of zero trust?

First, let’s take a look at what all parts of zero trust really are. The term “zero trust” is not clearly defined in the security community. There are several different definitions for it depending on who is using it and why.

Most commonly, people refer to it as a model where instead of requiring users to be authenticated with an existing username and password before accessing resources, you first need to verify that they are someone or something that is allowed access. This removes the requirement of having to create accounts and passwords ahead of time, which can be tricky when there are so many systems out there!

It also means that instead of requiring authentication only from certain locations, types of devices, or specific individuals, it becomes more flexible. You can easily allow anyone to log into any system because their identity has already been verified.

This is closer to how we function in our daily lives. Most of us don’t require strong authentication processes like we do now, unless we enter a professional setting. So, why make things harder than necessary by imposing extra rules and limitations?

By thinking about access control this way, zero trust shifts the burden onto the individual user. A healthy amount of skepticism is needed when dealing with online content and applications. You have to think about whether these apps and websites deserve your attention, energy, and personal information.