As we have seen, zero trust is an emerging security approach that does not rely on pre-defined levels of security to classify users or devices. Rather than looking at past behavior as predictors for future actions, this policy framework looks instead at whether or not you know what someone has done before to make determinations about their trustworthiness.

This shift in thinking about who can access your data comes with its own set of challenges, though. For one, it can be difficult to determine if someone knows your secrets unless they’ve already acted upon them.

Zero trust also raises questions about what types of technology are necessary to protect our data, since there aren’t always clear cut boundaries between who is trustworthy and who isn’t.

Fortunately, experts are offering some helpful insights into how zero trust can be implemented effectively in both practical applications and academic research. Below, we will look closer at one such implementation model called “architecture.

Threat model

With zero trust, there is no longer an implicit trust given to any device or person coming into contact with your organization’s data. All devices must be authenticated before being allowed access to your organization’s resources- that means mobile phones, laptops, tablets, desktop computers, and even televisions.

With this new threat model, you have to consider how malicious software might already exist on a device when it comes to accessing your organizational data.

Threat actors often times go undetected while carrying out their criminal activities because they don’t need privileged accounts for most of what they want to do. By not requiring users with external accounts to prove their identity through multi-factor authentication (2FA), malware can easily masquerade as authentic user content or apps.

This isn’t just limited to low quality 2FA solutions like google auth where hackers can gain direct access to your account, but also higher quality ones like apple pay where they can bypass that layer completely. Because of this, many organizations are now looking at using federated identities instead to grant access.

What are federated identities?

A federated ID is an identifier used by one entity to authenticate another. For example, if I work at Company A, then my company can create me an individualized username and password called ‘CompanyA_MyUserNamePassword�’ which I can use somewhere else, such as Google or Amazon.

Threat actors

As we mentioned earlier, one of the major components of zero trust is understanding who your threats are. You will have to do this not only for internal users but also for external users as well as third party apps you use.

Threats come in many forms like malicious advertisements or malware that try to steal information or perform fraudulent activities. Or perhaps someone outside the company sends messages with bad intentions.

There can be several reasons why an attacker would want access to your data so they can either profit from it directly or provide it to other parties for money.

For example, hackers may blackmail you by threatening to distribute sensitive information unless you pay them off. They could even go as far as exposing illegal activity if you’re rich enough!

Given all of these potential threats, how does an organization prevent attackers from accessing their systems? The first step is limiting what software an employee can install onto their device. This is called Device and Application Management (DAM).

Next, employees need to understand the risks associated with using certain applications and services. For instance, there should be adequate warnings about suspicious apps before letting people use them.

Employees also need to know which apps have remote access tools and whether those tools have been disabled. Only allow essential apps to connect to cloud storage accounts and ensure that security protocols such as 2-factor authentication are set up properly.

Attack surfaces

As we mentioned before, not every part of your organization is completely trustworthy. Some departments in your company can’t be trusted to handle someone else’s personal information or money responsibly.

Even if you have the most secure internal network, software, and processes, there are always ways to breach security.

Attack vectors include: physical access, malware, hacking tools, disgruntled employees, etc. The best way to mitigate risk is by limiting what these individuals can do within your organization and minimizing their opportunities to spread malicious content.

Zero trust goes one step further, however. It eliminates the concept of “internal” and “external” users entirely!

Instead of having separate accounts for people inside and outside your organization, with zero trust everything is considered either internal or external. This includes user names and passwords, files, emails, and even browser profiles!

Because nothing is clearly defined as internal or external, it makes protecting data more difficult. For example, if an employee leaves your company they still have access to all of their information because it isn’t marked as internal or external property.

Also, since there are no longer clear-cut boundaries between who is allowed to look at which resources, anyone can see anything – including things that should be restricted to only authenticated users.

Patch management

One of the biggest weaknesses of traditional web applications is their reliance on third-party sites for patching. These apps often use external websites or software as part facilities that they need to run. By offering free services, these companies incentivize your app to link to them, thus creating dependency.

In order to keep running, your app needs to be connected to this third party site, which means it must have access to all its files, databases, and tools. This is why most apps require you to connect to Facebook, Twitter, YouTube, and other similar sites directly - so that can’t be restricted.

Zero trust solutions don’t depend on any outside resources for functionality. They may not even include browser plugins like Flash! That way, your app can’t use anything beyond our trusted internal APIs and functions.

These types of apps are built with specific requirements and limitations, making it difficult to use them at times.

Staff training

As mentioned earlier, one of the first things that an organization with zero trust architecture needs to do is educate and train your staff. This should be done very clearly across all departments and levels within the company.

This includes educating them about what their responsibilities are in terms of privacy and cybersecurity, as well as how to recognize potential threats or risks.

It also means teaching them how to protect themselves from malicious activity both at work and outside of it. For example, they must know how to manage their personal accounts effectively (keep passwords safe) and how to avoid falling victim to phishing scams.

At the end of this process, you will have trained individuals who understand their roles within the company and are aware of basic security practices, which is half of your job done.