BlogThe simplified explanation of zero trust is that nothing, even within the perimeter, is to be trusted and everything must be verified. As John Kindervag, known as the creator of zero trust, defined it in his foundational paper on the topic:
There is a simple philosophy at the core of zero trust: Security professionals must stop trusting packets as if they were people. Instead, they must eliminate the idea of a trusted network (usually the internal network) and an untrusted network (external networks). In zero trust, all network traffic is untrusted.
In this episode of CyberWire-X, Kindervag discussed implementation in the real world. He was joined by Tom Clavel of ExtraHop and Kapil Raina of CrowdStrike to talk about zero trust—and how security solutions can support it.
Zero trust has come into the spotlight in the wake of sophisticated attacks like SUNBURST—and was discussed extensively in the recent cybersecurity Executive Order in the US. And as factors like cloud and IoT increase the sprawl of the network, de-perimeterization has become a topic of much conversation.
What Is De-Perimeterization?
De-perimeterization is a security strategy that works under the assumption that there is no clear boundary between the internal and external, which has been a subject of security conversations since as far back as 2004. While a company network may have seemed hyper-connected with the outside world back then, they ain't got nothing on 2021.
Instead of a virtual castle wall, de-perimeterization uses a combination of security tactics like:
- Encryption
- Security protocols and policies
- Data-level authentication
Zeroing in on Zero Trust
With all this attention, many are considering how they might adopt this security model in their own environments.
Listen to CyberWire-X, Episode 14 wherever you get your podcasts to learn more about zero trust implementation and the integration of EDR and NDR.
