Zero trust is a security model designed to compartmentalize and minimize access and cybersecurity risk. The key tenets of a zero trust architecture include: Strong Authentication: Zero trust is identity-centric, with permissions being assigned to a particular user. This makes strong user authentication - using multi-factor authentication (MFA) and similar tools - essential to ensuring that access to resources is only granted when appropriate. Least Privilege: The principle of least privilege states that a user, application, or system should only be granted the access and privileges needed to perform their role. By minimizing access, least privilege constrains cybersecurity risk. Take Advantage of Context: Every user request comes with environmental data, such as the time of date, system used, request source, and more. Zero trust access controls should leverage this context to restrict access to only legitimate use of a resource. Validate Everything: Zero trust is built on the principle of performing validation before providing access to anything or everything. All resources - including systems, files, applications, etc. - should have access controls in place. Minimize Access: Validation requirements should be as granular as possible - i.e. individual applications or files rather than at the system level - and provide minimal access time - i.e. allowing access for a single session. By minimizing access, zero trust limits cybersecurity risk. Assume Breach: Unlike perimeter-based security models, zero trust assumes that threats and risks are present within an organization’s systems. Zero trust works to compartmentalize access and risk to minimize the risk to the organization. Consistent Enforcement: Zero trust is only effective if it is enforced consistently across an organization’s entire environment, including on-premises, mobile, cloud, and IoT. Inconsistent enforcement can create loopholes that an attacker can exploit to bypass zero trust restrictions. Monitor and Log Everything: Data collection is essential to effective zero trust security and incident response. Log data can help to tune and improve zero trust access policies, and, if a cybersecurity incident is detected, to inform incident response and remediation.