Zero trust
Also called zero trust architecture, never trust, always verify
Zero trust is a security model that grants no implicit trust to any user, device or network location. Every request to reach data or a system is authenticated, authorised and checked against policy, with access limited to what the task needs. It replaces the idea of a trusted internal network behind a perimeter firewall.
How it works
In a zero trust architecture, a policy engine decides each access request using signals such as the user's identity, the health of the device, the sensitivity of the resource and unusual behaviour. A policy enforcement point then allows or blocks the connection. Access is granted per session and kept to least privilege, so a stolen password or compromised laptop gives an attacker far less room to move.
Firms build zero trust in stages across identity, devices, networks, applications and data. Typical steps include phishing-resistant multi-factor authentication, an inventory of devices, micro-segmentation of networks, encryption of traffic inside the network and continuous logging. Zero trust is an approach, not a product or legal duty, but it supports the access control, segmentation and monitoring that regulations such as DORA require in an ICT risk management framework.
The rules
Defines zero trust, its core tenets and the logical components of a zero trust architecture, including the policy engine and policy enforcement point.
US federal agencies, and used as a reference by private firmsSet a federal zero trust strategy requiring agencies to meet specific identity, device, network, application and data security goals by the end of fiscal year 2024.
US federal agenciesSets out five pillars, identity, devices, networks, applications and workloads, and data, with maturity stages for each.
US federal agencies, and used as a reference by private firmsRequires an ICT risk management framework with access controls, network segmentation and detection; it does not mandate zero trust by name.
EU financial entitiesCommon questions
Is zero trust a legal requirement?
Not for private firms. US federal agencies must follow OMB M-22-09. Financial regulators set outcomes such as strong access control and segmentation, and many firms use zero trust to meet them.
Is zero trust a product?
No. It is an architecture and set of principles. Firms combine identity management, device management, network segmentation and monitoring tools to put it in place, usually over several years.
How does zero trust help against ransomware?
Ransomware spreads by moving through a network with stolen credentials. Zero trust checks every request and limits each user to what they need, so attackers find it harder to reach and encrypt critical systems.
