The traditional approach of fortifying the network perimeter and implicitly trusting anything inside is dangerous.

Even with outstanding security policies and controls, there is no way to prevent 100% of attackers from gaining access. Once inside, assumed trust allows attackers to move around the network and escalate privileges with relative ease. This leads to substantially worse outcomes.

The NIST Special Publication on Zero Trust Architecture (NIST SP 800-207) puts it like this:

“Traditionally, agencies (and enterprise networks in general) have focused on perimeter defense, and authenticated subjects are given authorized access to a broad collection of resources once on the internal network. As a result, unauthorized lateral movement within the environment has been one of the biggest challenges for federal agencies.”

Organizations need an alternative security approach that reflects the realities of today’s cyber landscape. Some attackers will inevitably gain access to privileged assets or resources, so cybersecurity controls (Read more...)