Zero Trust has been a goal for organizations increasingly since it’s introduction in 2010; TIC 3.0 is a Federal mandate. TIC 1.0 and TIC 2.0 were almost exclusively focused on network access security. TIC 3.0 is primarily focused data and user behavior, reflecting both the evolution of modern threats, as well as the weaknesses inherent in network-only security.
According to the latest NIST guidance published in August 2020 (Zero Trust Architecture (nist.gov), zero trust (ZT) is the term for an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources such as data.
Specifically, zero trust assumes there is no implicit trust granted to assets (like data) or user accounts based only on their physical or network location (i.e., local area networks versus the internet) or based on asset ownership (enterprise or personally owned). Authentication and authorization (both subject and device) are discrete functions performed before a session to an enterprise resource is established. Zero trust is a response to enterprise network trends that include remote users, bring your own device (BYOD), and cloud-based assets that are not located within an enterprise owned network boundary.
Zero trust focuses on protecting resources (assets, services, workflows, network accounts, etc.), not network elements, as the network is now no longer sufficient to ensure security posture of the resource. Below we outline zero trust dimensions, and give general deployment models and use cases where zero trust could improve an enterprise’s overall information technology security posture.
Sara Mosley, strategic architect at the Department of State, said in a recent article that TIC 3.0 and zero trust are dimensions of a new security philosophy accelerated and highlighted by the pandemic.
Learn more about Zero Trust.