Zero Trust Architecture

Zero trust architecture (ZRA) is an information security emerging model that is mainly based on the idea that an organization should never automatically trust anything within the organization or activities from external actors. Rather, the organization must verify anything and everything that tries to connect to its information and information systems before granting access to critical assets. And it is a relatively new security concepts in which nothing inside and/or outside the organization is automatically trusted to access organizational assets. This architecture assumes each activity is coming from an unknown and untrusted destination until proved otherwise.

Zero trust architecture overrides the old “trust, but verify” security concept through considering the breach assumption principle. Besides, this paradigm shift requires microsegmentation and strict adherence to the least privilege principle before gaining access to sensitive and critical organizational assets. The whole purpose of zero trust architecture is to ensure that every access is authenticated, identified, authorized and encrypted before accessing secure assets. This principle disrupts the notion that everything on the inside is trusted while everything on the outside world of the organization is untrusted. Moreover, this is mostly due to the proliferation of endpoint devices through which users interact with the resources or assets of the organization.

Zero trust architecture is realized through a wide range of security controls such as multifactor authentication (MFA), identity and access management (IAM) systems, next generation firewalls, and network access controls (NAC).