'Trust but verify' is so last year
Connecting state and local government leaders
Zero trust considers all network traffic, wherever it originates, as suspect. Every packet on the network has to be inspected and analyzed in real time.
Is this the year of zero trust? It sounds like the concept for a spy novel, but in fact it’s a framework for a new approach to security that its proponents say is not only much more effective than traditional security models but is needed if cloud computing is to be widely adopted.
Most security models in play now assume a protected border, with a trusted network inside. But with security breaches of government and commercial networks in the daily news, the flaws of that model are becoming more obvious every day.
Zero trust, as the name suggests, replaces the catchy but ultimately wrong credo of “trust but verify” with one that considers all network traffic, wherever it originates, as suspect. In sum, every packet on the network has to be inspected and analyzed in real time.
“We’ve been indoctrinated with the ‘trust but verify’ thing for so long, without understanding that it originated as a joke,” said John Kindervag, a principal analyst at Forrester Research. “Looking at that was the genesis for zero trust, since we found that it has actually been a fundamental problem for security for so long.”
Forrester first proposed a security framework based on zero trust in 2010. Since then, the idea has become a hotly debated topic in security circles.
Richard Stiennon, founder and chief research analyst of IT-Harvest, thinks zero trust is “fundamental” to the way security has to be implemented. The industry has been moving in that direction for a while, he said, and it’s why the issue of access management in security has gained traction in the past few years. But, after Snowden, it’s not clear who can be trusted. “That’s had a huge impact, particularly in the cloud arena because that’s seen as the next big revolution in computing and it was launched without a zero trust model,” Stiennon said.
If they are not to suffer potentially billions of dollars in lost business the carriers will need to adopt zero trust to convince customers their data is secure, he said.
The core of Forrester’s model is what it calls a “network segmentation gateway” that supports multiple 10 gigabit/sec interfaces, provides quality of service or packet shaping to maintain network performance and defines global policies for the network. It’s essentially a beefed-up, next-generation firewall, Kindervag said, that has a lot more insight into the data packet all the way up to network Layer 7, the application layer.
“But the real difference is where you place this,” he said. “Traditionally you put these kinds of firewalls at the center of the network rather than at the edge, and that really helps a lot.”
How it works
A zero trust network is divided into microcode and perimeter (MCAP) switching zones, each of which is attached to one of the interfaces on the segmentation gateway. A perimeter is formed around the resources that inhabit each of the MCAPs, and security policies are enforced through the gateway. All of which is made much easier with the development of such things as virtual network infrastructure and software-defined networks, Kindervag said.
While zero trust is designed to co-exist with existing networks and allows for an evolution from legacy environments — “it’s not a rip-and-replace thing.” Kindervag said it will probably require some investment by government organizations, either in next-generation firewalls for those that don’t already have them or for reconfiguration of devices for those who do.
And, while the National Institute of Standards and Technology has not yet adopted zero trust as part of its security guidelines, Kindervag said it maps well to the security controls detailed in NIST’s SP 800-53.
When zero trust will become an applied rather than a theoretical approach to security is unclear. Stiennon, for example, believes the “threat actor” that will move organizations to consider zero trust is now completely visible, and people are realizing all of their data can be captured. That should push changes, though he expects zero trust to appear first in new projects and then wend its way into legacy environments. That process could “easily take five to 10 years,” he said.
On the other hand, Kindervag said he’s already designing zero trust networks for his clients, and has early adopters in industry and government. These are the “not very chatty” kind who don’t want to talk about what they are doing with security. However, he said, zero trust is becoming a much more widely discussed enterprise topic. “2014 will be the year of zero trust,” he said.