Review of the publication NIST SP 800-207 "Zero Trust Architecture"

Ruslan Rakhmetov, Security Vision

In today's digital world, cyberthreats are evolving so rapidly and gaining such scale that information security specialists and methodologists are forced to regularly review information protection concepts and paradigms. Periodically, every 2-3 years, a new class of products promising protection against the latest cyber threats appears on the information security market: this was the case with Next Generation Firewall, DLP systems, SIEM systems, and further on with solutions to protect cloud platforms, anomaly detection systems, and cyber intelligence platforms.

Our current publication is about the relatively new concept of ‘Zero Trust Architecture’, which involves thorough continuous verification of all access entities (users, entities, devices) regardless of their location (corporate network, internet, remote working via VPN). This approach is described in NIST SP 800-207, ‘Zero Trust Architecture,’ which describes the concept of creating a zero-trust network architecture and examples of how it can be used to improve enterprise information security.

So, the concept of continuous verification and authentication of all subjects of network access was born quite a long time ago - Cisco company spoke about the correctness of this approach in the early 2000s. Over time, many protection systems have implemented their own variants of this approach, for example, in the form of ‘conditional access’, when in order to authenticate and gain access to corporate resources, it is not enough for an employee to enter a correct login and password: the user's device must meet certain criteria (OS version, installed security updates, working anti-virus), connect from a certain geographical region (for example, from countries in which the company has offices), as well as have no uncovered information security incidents In addition, the time of connection (business or non-business hours), the device's history (how long ago it successfully connected to the corporate network), the presence of a valid second factor of authentication (e.g., the device's digital certificate), and data from cyberintelligence systems (analyses of the external IP address and hashes of running executable files of the connecting device) may also be considered.

NIST SP 800-207 states that in Zero Trust Architecture (abbreviated as ZTA, Zero Trust Architecture), authentication and authorisation of access subjects is performed before establishing a network connection to corporate resources, and ZTA can be used to effectively ensure cybersecurity of IT assets (data, services, accounts, business processes) when working remotely, using BYOD concepts and working with cloud platforms. The concept is in line with the trends of the current state of cyberspace, where there are no longer network perimeters, and users access work resources from different devices and geographical locations. At the same time, access subjects should be granted granular, minimum necessary access rights, and the entire corporate network can be considered inherently untrusted, i.e. probably previously compromised - this assumption helps to build a logical threat model in the ZTA-concept. In other words, for each access entity (users, entities, devices), their authenticity and access rights are continuously checked, only then is a controlled network connection established over a specific port, protocol and to a specific destination IP address within the corporate network.

According to NIST publication SP 800-207, the principles of a zero-trust architecture are as follows:

1. All data sources and computing services are considered IT resources (access objects), including employee personal devices that connect to the corporate network.

2. All communications are protected regardless of their network location: a device cannot be automatically trusted just because it is within the corporate network perimeter. At the same time, all network communications must be protected while maintaining the confidentiality, integrity, authenticity of the source of the network connection.

3. Access to certain corporate resources is granted only within a single network session: the device requesting access must be verified before access is granted, and access must be granted with the minimum rights necessary to fulfil the business task. Authentication and authorisation on one resource should not automatically grant access to another resource.

4. Access to a resource is controlled by a dynamic policy that includes checking the state of the client (access subject) identity, the state of the application or service, the state of the requested resource, and other behavioural attributes and metadata. Access subject (device connecting to the resource) state data may include software data, network location of the device, date and time of the resource access request, behavioural attributes of the device, device credentials, and deviation in device behaviour from a predetermined threshold may also be analysed.

5. The cyber security status of all IT assets is controlled and monitored, there is no ‘default’ trust.

6. All access subject authentication and authorisation procedures are mandatory and dynamic, running continuously throughout the access period.

7. The organisation collects as much information as possible about the current state of assets, network infrastructure, and network communications and uses this data to improve cyber security.

The NIST SP 800-207 document also articulates new cyber risks that emerge when implementing the ZTA framework, such as:

1. Forgery of the authentication and network access decision procedure: a cyber attack or malicious insider action could result in unauthorised network access by a malicious device or entity.

2. denial of service or network failure: authentication and network access decision mechanisms can become a single point of failure in a company's network connectivity.

3. Credential theft can lead to unauthorised network access by a malicious device or entity; multi-factor authentication and behavioural analysis can be used to minimise this cyber risk.

4. Network visibility: if encrypted traffic is transmitted, the company will not be able to adequately analyse the transmitted data and prevent cyber threats; machine learning techniques or SSL/TLS inspection mechanisms can be applied to improve the quality of analysis of such traffic.

5. Storage of network and system information: ZTA architecture components contain a lot of valuable information that can be targeted by hackers.

6. Dependence on specific vendors and solutions: if ZTA hardware fails or if a company changes vendors, it can experience significant network disruption and downtime.

7. The use of service (machine) entities in ZTA administration leads to the threat of unauthorised use of authentication data (e.g. API tokens) of such service entities.

To implement a ZTA architecture, NIST document SP 800-207 recommends the following steps:

1. Identify all access entities (users, entities, devices) that will need to be granted access to IT assets using the ZTA model.

2. Identify the company's IT assets (inventory).

3. Identify key business processes and assess their cyber risks for a phased implementation of ZTA from less critical to more critical processes. 4.

4. Establish authentication and network access decision policies for the selected business processes.

5. Select a suitable technical solution to implement the ZTA approach.

6. Pilot and monitor the ZTA solution for the selected business processes; possibly piloting in audit mode (without blocking).

7. Extend the boundaries of the ZTA implementation project to other business processes.