Identity at the core of Zero Trust

The guiding principles behind zero trust security

• Always verify explicitly – authenticate and authorise often.
• Assume breach – design your security architecture to be resilient in that any intrusion is limited in its reach (limit ‘blast radius’).
• Start from zero trust and build upwards – so as not to assume trust (or retain implicit trust’) but instead dynamically build trust from the ground up.

These guiding principles extend towards every part of the security architecture, across people (identity), devices, app services, server infrastructure, networks, and data. The security controls applied may be familiar (e.g. role-based access control, least privilege, defence in depth, attack surface reduction and hardening, vulnerability management, threat monitoring and response) but over the years have evolved with increasing sophistication in their application. Recognition of the workload and its context has been a significant advance – where security controls only grant access requests that are justified in terms of the authorised workload and requestor, with a just-in-time approach (granted only when needed and then revoked afterwards).

The optimal zero trust security architecture is not static but one where trust is continually evaluated, taking into account known workload patterns so that security controls can ‘open up’ or ‘close in’ as and when required. Another key aspect of this adaptive capability is the ability to facilitate orchestration via web APIs or other means to perform response actions – for example, if suspicious activity is found at an endpoint, action may be taken to isolate the end-point or access to a sensitive database could be temporarily suspended.

Identity is a fundamental building block within a zero trust security architecture. Strong authentication and appropriate access authorisation are required not only for end-users signing in but also for app services and device endpoints. Data storage resources should only be permitted to be accessed by authorised App services. Device end-points should be hardened and have malware protection installed.  Proof of identity of the end-user signing in can be proven at varying strength levels. An example of high proof level might have the end-user engaging in multi-factor authentication with biometric binding to claims belonging to a verified identity. This would typically involve ownership of a mobile device that has cryptographically verified claims on a valid identity (from an authorised issuer), and the face of the person present is verified biometrically matched with that from validated credentials (e.g. passport photo).

The extent of challenges within the user journey should be related to the level of security risk mitigation. While we may not mind the level of user friction in being challenged when making a mortgage application for a house purchase, we expect to see more relaxed security controls for more mundane, everyday transactions. To this end, one might model the concept of user personas – where we might have social media, banking, family and work personas, all requiring varying levels of user identity proof and application of security controls that strikes an appropriate balance between user experience and security risk.

 In summary, the journey for zero trust security architectures over the years has taken it from the basic premise of dispensing with implied trust, applying security controls to people (identity), devices, app services, server infrastructure, networks and data, evolving to a contextually aware, dynamic approach where trust is continually evaluated, and orchestration of responses allow for adaptive security controls. Identity management is present throughout and centre stage to this approach, where there is strong authentication of users, app services and devices. With decentralised digital identity, we have the exciting prospect of bringing identity management into the 21st century, with the potential of providing seamless user experience and convenience whilst maintaining the level of security and privacy that is in harmonisation with the zero trust security architecture approach and GDPR.

*Updated 08/11/2023