Instead of the “inside” and “outside” notion of traditional firewalls and perimeter defense technologies, the Zero Trust Network notion has its origins in Cloud+Mobile first world where the person carrying a mobile device can be anywhere inside/outside the enterprise and is connected securely to the services s/he needs access to.
The essential idea appears to be device authentication coupled with a second factor in the shape of an easy to remember password, with backend security smarts to identify the accessing device. More importantly, every service that is access externally needs to be authenticated, instead of some services being treated as internal services and being less protected.
Some properties of zero trust networks:
- Network locality based access control is insufficient
- Every device, user and service is authenticated
- Policies are dynamic – they gather and utilize data inputs for making access control decisions
- Attacks from trusted insiders are mitigated against
This is a big change from many networks which have network based defense at the core (for good reason, as it was very cost effective). To create such a network, from an existing network, one way to start is to identify, enumerate and sequence all network flows.
I attended a talk by Centrify on this topic, which resonated with experiences in cloud, mobile and fog systems.