Zero Trust Architecture - Revision history

Tom: /* Solutions */

2025-12-12T23:04:06Z

‎Solutions

2025-06-14T21:13:02Z

‎7 Tenets by NIST

2024-08-06T16:48:30Z

‎Solutions

2024-08-06T16:40:15Z

‎Solutions

2023-03-06T01:40:53Z

‎Problems

2023-02-11T23:47:19Z

‎Executive Order

2023-02-11T23:43:14Z

‎Context

2023-02-11T23:41:48Z

‎Full Title or Meme

2022-10-12T14:27:58Z

‎Problems

2022-09-02T00:23:53Z

‎Context

← Older revision		Revision as of 23:04, 12 December 2025
Line 36:		Line 36:
	# Where users are given access to multiple zones of security, ensure that any stored passwords (or password hashes) are not reused between zones.		# Where users are given access to multiple zones of security, ensure that any stored passwords (or password hashes) are not reused between zones.

		+	* 2025-12 [https://www.rsaconference.com/experts/richard-stiennon zero trust networking papers] Richard Stienon
	* 2024-08-06 [https://www.nccoe.nist.gov/projects/implementing-zero-trust-architecture Announcement of ''Implementing a Zero Trust Architecture''] open for comment.		* 2024-08-06 [https://www.nccoe.nist.gov/projects/implementing-zero-trust-architecture Announcement of ''Implementing a Zero Trust Architecture''] open for comment.

@@ Line 55: / Line 55: @@
 # Encrypt All Access - All communication is secured regardless of network location.
 # Monitor All Access  - The enterprise collects as much information as possible about the current state of assets, network infrastructure and communications and uses it to improve its security posture
 ===Planning by US DoD===

@@ Line 35: / Line 35: @@
 # Ensure that all internal access codes, especially for highly privileged users, start out and remain secure in use.
 # Where users are given access to multiple zones of security, ensure that any stored passwords (or password hashes) are not reused between zones.
 ===5 Pillars of CISA===
@@ Line 44: / Line 46: @@
 # Data
 The focus is on control within the enterprise even though most exploits are observed in the open internet. There is no explicit recognition of use of the exploits other than the very slow process of Vulnerability => Exploit => Detection => Report (CVE) => Create Fix => review supply chain => apply fix to each element of supply chain, where attackers have full access during this chain of events.
 ===7 Tenets by NIST===
 These are further described in [https://csrc.nist.gov/publications/detail/sp/800-207/final SP-800-207]

@@ Line 44: / Line 44: @@
 # Data
 The focus is on control within the enterprise even though most exploits are observed in the open internet. There is no explicit recognition of use of the exploits other than the very slow process of Vulnerability => Exploit => Detection => Report (CVE) => Create Fix => review supply chain => apply fix to each element of supply chain, where attackers have full access during this chain of events.
 ===7 Tenets by NIST===

@@ Line 27: / Line 27: @@
 * This technique appears to be little different from [[Role Based Access Control]], which turning into an administrative nightmare.
 * The US NIST is trying to convince people that a [[Zero Trust Architecture]] is possible with a good [[User Experience]].<ref>NIST and NCCoE ''Zero Trust Architecture'' https://www.nccoe.nist.gov/projects/building-blocks/zero-trust-architecture</ref><blockquote> A zero trust architecture leans heavily on components and capabilities for identity management, asset management, application authentication, network segmentation, and threat intelligence. Architecting for zero trust should enhance cybersecurity without sacrificing the user experience. The NCCoE is researching ongoing industry developments in zero trust and its component technologies that support the goals and objectives of a practical, secure, and standards-based zero trust architecture. </blockquote>
 ==Solutions==

@@ Line 21: / Line 21: @@
 The two big bullet points are:
 # Assume that the network is not secure, i.e. that there is no security perimeter
-# A user application only has the [[Least Privilege]] required to accomplish their work task at that time.
+# A user application only has the [[Least Privilege]] required to accomplish their work task at that time and in that place.
 ==Problems==

@@ Line 3: / Line 3: @@
 ==Context==
-* The context here is focused on human user access to enterprise data and resource. All manner of computing devices may be employed by users in all manner of networks.
+* The context here is focused on human user access to network-accessible [[Enterprise]] data and resource. All manner of computing devices may be employed by users in all manner of networks.
 * Traditionally user access was granted at the point where the user entered the network with a protocol like [[Kerberos]] which was developed by Project Athena at MIT to sort the various components of a Research University into buckets that could assign trust at the entry point that followed the user wherever they went inside the MIT network.
 * In [[Zero Trust Architecture]] the user is given full access to the network and then provides such attributes of [[Identity]] and [[Authentication]] as are needed at each [[Resource]] access point; in other words, the Internet.

@@ Line 1: / Line 1: @@
 ==Full Title or Meme==
-[[Zero Trust Architecture]] is a method that starts every interaction with no access and builds up access rights as the user adds proof of [[Identity]] and [[Authentication]] to meet the [[Authorization]] needs of the [[Resource]] sought by the [[User]].
+[[Zero Trust Architecture]] is a methodology that starts every interaction with no access and builds up access rights as the user adds proof of [[Identity]] and [[Authentication]] to meet the [[Authorization]] needs of the [[Resource]] sought by the [[User]].
 ==Context==

@@ Line 11: / Line 11: @@
 * In other words, all existing methods focus on access to [[Resource]]s rather than on [[User Experience]].
 * '''[https://www.nist.gov/publications/zero-trust-architecture NIST page on Zero Trust Architecture]'''
 ===Executive Order===