Academy
TermDefence

Zero trust

A security approach that grants no trust based on location in the network and verifies each access request separately by identity, device and context.

Flow

  1. 1Identity is verified
  2. 2The device is assessed
  3. 3Least privilege is granted
Related families
—
MITRE ATT&CK
—
Sources
4 sources
01

Overview

According to NIST SP 800-207, zero trust moves defences from the network perimeter to users, assets and resources; a user or device is not trusted solely because of its location on the network. NIST

CISA’s maturity model addresses the approach in five pillars: identity, devices, networks, applications and workloads, and data. CISA

02

How it works

  1. 1

    Identity is verified

    On every request, with a phishing-resistant method. NIST

  2. 2

    The device is assessed

    The device’s state feeds into the access decision. CISA

  3. 3

    Least privilege is granted

    Only to the resource needed, for the time needed. NIST

03

Real-world examples

Snowflake: a single factor was not enough

According to Mandiant, the compromised accounts had no multi-factor authentication and access was not restricted to trusted locations. Google Cloud (Mandiant)

04

How to detect it

  • Access requests from devices in a non-compliant state or from unexpected locations. CISA
05

What to do

  • Make multi-factor authentication mandatory and shorten session lifetimes. MITRE ATT&CK
06

Related terms

07

Sources

  1. 1SP 800-207: Zero Trust Architecture · NIST, 2020-08
  2. 2Zero Trust Maturity Model · CISA
  3. 3UNC5537 targets Snowflake customer instances · Google Cloud (Mandiant), 2024
  4. 4Multi-factor Authentication (M1032) · MITRE ATT&CK