The zero trust model of information security assumes there are no trusted interfaces, applications, traffic, networks, or users. It requires that all resources be accessed securely on a need-to-know basis and that systems verify and never trust. The model has shifted from protecting networks from outside attacks to also guarding against inside threats, as the primary attack vector has changed from outside-in to inside-out. Implementing a zero trust model involves deploying technologies like next-generation firewalls, sandboxing, and access control to securely verify all users and protect resources.

1. What is zero trust model of information
security?
The Zero Trust Model of information security simplifies how information security is
conceptualized by assuming there are no longer “trusted” interfaces, applications, traffic,
networks, or users. It takes the old model—“trust but verify”—and inverts it, because recent
breaches have proven that when an organization trusts, it doesn’t verify. (Forrester)
This model was initially developed by John Kindervag of Forrester Research and popularized as
a necessary evolution of traditional overlay security models. It requires that the following rules
be followed:
 All resources must be accessed in a secure manner.
 Access control must be on a need-to-know basis and strictly enforced.
 Systems must verify and never trust.
 All traffic must be inspected, logged, and reviewed.
 Systems must be designed from the inside out instead of the outside in.
The zero trust model has three key concepts:
 Ensure all resources are accessed securely regardless of location.
 Adopt a least privilege strategy and strictly enforce access control.
 Inspect and log all traffic.
“Outside-In” to “Inside-Out” Attacks
According to a Forrester Research report, information security professionals should readjust
some widely held views on how to combat cyber risks. Security professionals emphasize
strengthening the network perimeter, the report states, but evolving threats—such as increasing
misuse of employee passwords and targeted attacks—mean executives need to start buffering
internal networks. In the zero trust security model, companies should also analyze employee
access and internal network traffic. One major recommendation of the Forrester report is for
companies to grant minimal employee access privileges. It also emphasizes the importance of log
analysis; another recommendation is for increased use of tools that inspect the actual content, or
data “packets,” of internal traffic.

2. Teams within enterprises, with and without the support of information technology management,
are embracing new technologies in the constant quest to improve business and personal
effectiveness and efficiency. These technologies include virtualization; cloud computing;
converged data, voice, and video networks; Web 2.0 applications; social networking;
smartphones; and tablets. In addition, the percentage of remote and mobile workers in
organizations continues to increase and reduce the value of physical perimeter controls.
The primary vector of attackers has shifted from “outside-in” to “inside-out.” Formerly, the
primary attack vector was to directly penetrate the enterprise at the network level through open
ports and to exploit operating system vulnerabilities. We call this attack methodology “outside-in.”
In “inside-out” attacks, the user inside the “protected” network reaching out to an external
website can be just as vulnerable as the user accessing the Internet from home.
Zero Trust Recommendations
 Update network security with next-generation firewalls.
 Use a “sandbox” control to detect unknown threats in files.
 Establish protected enclaves to control user access to applications and resources.
 Use a specialized anti-phishing email protection service.
 Use threat intelligence to prioritize vulnerability remediation.
 Analyze logs using advanced machine learning algorithms to detect compromised and
malicious users.
 Implement an incident management system to minimize the impact of individual
incidents.
 Deploy a cloud services manager to discover, analyze, and control shadow IT. (Shadow
IT is hardware or software within an enterprise that is not supported by the organization’s
central IT department.)
 Monitor your partners’ security postures using a cloud-based service.
 Deploy an enterprise key & certificate management (EKCM) system.
 Deploy a backup, cloud-based DDoS mitigation service.
 Deploy a non-signature-based endpoint malware detection control.
Some organizations use virtual local area networks (VLANs) to segment their network, but
VLANs simply isolate network traffic—they are unable to enforce the control of privileged
information. In addition, by itself, a VLAN cannot inspect your traffic for threats. True zero trust
network segmentation requires an enterprise security platform that understands your
applications, users, and content.
Just remember: the zero trust model of information security means “verify and never trust.”
Original article appeared on Kaplan University- School of Information Technology site at
http://216.185.148.183/information-technology/articles/zero-trust-model.
aspx#sthash.6ZLf2qHN.dpuf

3. References
http://www.securitymanagement.com/article/zero-trust-model-007894
http://www.securityweek.com/steps-implementing-zero-trust-network
http://spyders.ca/reduce-risk-by-adopting-a-zero-trust-modelapproach-to-security/
http://www.cymbel.com/zero-trust-recommendations/
http://csrc.nist.gov/cyberframework/rfi_comments/040813_forrester_research.pdf