Zero Trust Security

Chapter 2 Zero Trust

Zero Trust is not a project, but a new way of thinking about information security. – John Kindervag, author of the founding Zero Trust paper, “No More Chewy Centers”

The essential paper that started the Zero Trust idea was John Kindervag’s ‘No More Chewy Centers: Introducing The Zero Trust Model of Information Security’. It was an unfortunate name, because how can you run a network if you do not trust anything or anybody? That was not what Kindervag met with the word Zero Trust. The concept is based on how the military thinks about protecting secrets. Everything requires a ‘need to know’ basis. If you don’t require the information to do your job, you shouldn’t have access to it. That’s all there is to Zero Trust ‘if you do not need it to do your job, you shouldn’t have access to it’. This idea of only granting access to what is required should apply to users, servers, network equipment and applications. We grant users access only to what they explicitly need for their work. That’s whole idea of Zero Trust. This way, we can reduce the attack surface of our environment by limiting access to services and data.

When it comes to implementing Zero Trust, there is no product that can make you ‘Zero Trust’, no matter how much marketing tells you otherwise. Zero Trust is a philosophy, a strategy and a new way of thinking about security. The goal is to evaluate your environment’s security state continually. There will never be a presentation saying, ‘We have achieved ...