1) Zero Trust is a security model that does not inherently trust anything inside or outside its perimeter and instead verifies anything and everything trying to connect to its systems before granting access. 2) Traditional security models rely on physical or logical network boundaries to define what is trusted, but this is ineffective as users and devices can no longer be trusted once inside these boundaries. 3) The core tenants of Zero Trust include secure all communication, grant least permission, grant access to single resources at a time, make access policies dynamic, collect and use data to improve security, monitor assets, and periodically re-evaluate trust.

1. Zero Trust
Model
Codecademy
Manipal
Introduction
in association with
hor is licensed under CC BY

2. Agenda
Agenda
What is Zero Trust?
Importance and relevance
Implementation
Questions

3. History
• Coined in, 1994 by Stephen Paul Marsh
• Popularized by John Kindervag, an analyst at Forrester
Research
• Google rolled out BeyondCorp, its implementation of
Zero Trust security model

4. The Traditional Model
Traditional model
Trusted Zone Untrusted Zone

5. Challenges with perimeter-based networks
Challenges

6. Users can't be trusted
Human Error
is inevitable

7. What is it?
Defination

8. Come again?
Key points
Don't trust a user based on their
location inside a perimeter
1
Leverage the trust built to get
access to resources
2
Keep on verifying the device
3

9. Core tenants of Zero Trust
Architecture

10. Zero
Trust
Secure all communication
Access requests coming from within
and without the network meet the same
security requirements.
Grant least permission
Access should also be
granted with the least
privileges needed to
complete a given task.
Grant access to single
resource at a time
Authentication and authorization
to one asset must not grant
access to another resource.
Make access policies dynamic
access requests should evaluate
dynamic attributes such as device
analytics, behavioral analytics or
environmental factors.
Collect and use data to
improve security posture
Machine llearning and data
analytics
Monitor security posture
of assets
No asset should be inherently
trusted. A robust monitoring
and reporting system should
provide actionable data about
the current state of enterprise
resources.
Periodically re-evaluate
trust

11. Applying Zero-Trust
Setup

12. Device Health Conditions
• Determine system integrity and posture
• Integrity Checks
⚬ Drivers
⚬ Kernel
⚬ Firmware
⚬ Peripheral firmware
⚬ Antimalware driver code
• Boot state of machine
• Compliance policy checks

13. Identity conditions
• Check user's level of risk
• Sign-in request state
⚬ Known botnet address?
⚬ Anonymous IP address?
⚬ Unfamiliar location?
• Suspicious sign-in
⚬ High number of failed attempts
⚬ traffic patterns used by
attackers
• Credentials compromised?

14. Real time
evalluation engine
Machine learning
Policies
Conditions Controls
• Employee and Partner
• Trusted device
• Complaint devices
• Physical and virtual location
• Client apps
• Auth method
• Alow or block access
• Limit access
• Require Multi-factor-
authentication
• Force password reset
• Block legacy authentication

15. Benefits
Benefits of Zero Trust Model
Reduce
organizational risk
Reduce risk of
data breach
Supports
compliance
initiatives

16. Dánke
The end of the presentation