Dial the Trust Down to Zero

The way to make security work

Dialing the Trust Level Down to Zero

By R. Colin Johnson, Commissioned by CACM Staff, September 23, 2021

Twenty-first century cybersecurity has been steadily moving away from the "perimeter" mentality—authenticating users with passwords, then giving them free access to a computer system's resources at their security level. Stolen passwords, especially those with high levels of access, have resulted in catastrophic releases of vast swaths of personal information (like credit card numbers), government secrets (witness WikiLeaks' releases of classified information), and related crimes (including ransomware).

Now the trust bestowed on authenticated users is being rescinded. The perimeter defense architecture is being superseded by the Zero Trust Architecture (ZTA), which authenticates each user action before it is executed. The U.S. government mandated ZTA and other measures in the May 12, 2021 Executive Order on Improving the Nation's Cybersecurity, which reads, in part: "The Federal Government must adopt security best practices; advance toward Zero Trust Architecture; accelerate movement to secure cloud services, including Software as a Service (SaaS)…and invest in both technology and personnel to match these modernization goals."

The Executive Order also charged the National Institute of Standards and Technology (NIST) with detailing these best practices in a Zero Trust Architecture report.

Said Steve Turner, an analyst at Forrester Research, "Public policy has finally acknowledged that the current model of cybersecurity is broken and outdated, mandating that the model of Zero Trust Architecture become the default method for implementing cybersecurity. With the relentless destructive attacks on computer systems, such as ransomware, there's been a collective realization that Zero Trust should be the de facto standard to secure organizations."

At the same time, the computer hardware itself must be adapted to the ZTA, starting with end-to-end encryption of all data before, after, and ideally even while it is inside the processor. Ubiquitous encryption is just the start. Today, any component—from wireless routers to individual server chips—can offer unauthorized access to intruders. Firmware—from unauthorized swapping of solid state disks (SSDs) in the datacenter, to thumb-drives plugged into user-access devices—are especially vulnerable. Even hardware components without firmware can become dispensers of malware via, for instance, hidden hardware Trojan horses that are impossible to detect by visually inspecting chips. As a result, hardware Roots-of-Trust with certifiable validation followed by chain of custody verification also are being incorporated into the ZTA—starting from the hardware for an initial computer installation, and continuing unabated through firmware and hardware updates, until its eventual retirement.  ... '