Zero Trust (ZT) is a set of security principles that treats every component, service and user of a system continuously exposed to and potentially compromised by a malicious adversary • Zero Trust Architecture (ZTA) is an enterprise’s cybersecurity plan that utilises ZT concepts and encompasses component relationships, workflow planning, and access policies • Zero Trust Enterprise (ZTE) is the network infrastructure and operational policies that are in place for an enterprise as a product of zero trust architecture plan
Assume no implicit or explicit trusted zone in network • Identity verification strictly enforced for all connections • Access Control strictly enforced for communication between apps and servers • Risk profiles, generated in realtime are used in resource access control • All sensitive data is encrypted both in transit and at rest • All events are continuously monitored, collected, stored and analysed to assess compliance with security policies • Policy management and distribution is centralised https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity