Zero Trust

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

I like this discussion as it hits the head of the nail: what a "Zero Trust" system, or architect, looks or functions like that it can fend off the attacks as we know. The answer so far seems to be: no one knows. In another words, none of existing system or architect provides the protection that "Zero Trust" is supposed to provide.

We, however, take a different approach to "Zero Trust", and cyber defense in general. Instead of relying on "verification", aka authentication, which we know is not reliable when under attack, we reduce the resources a user can obtain through each "verification".  Here is excerpt from our white paper in a very simplified way.

"For companies and government agencies that are on the path to Zero Trust, data-centric management is the key to preventing data breaches that are profitable for intruders. How can data-centric management protect data in a way that network-centric approaches cannot? First of all, data are encrypted persistently and seamlessly in a data-centric management model. Secondly, every time a user needs to access data, s/he must be authenticated using dynamic data access policies and only then will the data be decrypted for the user to access.

Let's assume that the network has already been breached and a valid user credential is stolen by the attacker. The attacker wants to exfiltrate the files; in a network-centric Zero Trust environment, the attacker could use the stolen credential to make one request to access a device or cloud container and steal the 1000 files stored on it. The cloud data encryption would not stop the breach because the files were retrieved by an authenticated user.

On the other hand, with a data-centric solution in place, the attacker would have to use the stolen credential to make 1000 requests to access the encrypted data, one for each file. The access control process would detect the excessive number of requests from the user that would be a departure from the usual pattern, and an alert would simultaneously be issued while the user's access request is denied. In this case, only a tiny number of files could potentially be breached.  Since the attacker doesn't know the content of each encrypted file before the request to access is granted, s/he cannot select the files to exfiltrate first, minimizing the chances of losing critical data. Implementing more advanced measures including classified data access control can further reduce or eliminate the chance of a data breach."

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

I like this discussion as it hits the head of the nail: what a "Zero Trust" system, or architect, looks or functions like that it can fend off the attacks as we know. The answer so far seems to be: no one knows. In another words, none of existing system or architect provides the protection that "Zero Trust" is supposed to provide.

We, however, take a different approach to "Zero Trust", and cyber defense in general. Instead of relying on "verification", aka authentication, which we know is not reliable when under attack, we reduce the resources a user can obtain through each "verification".  Here is excerpt from our white paper in a very simplified way.

"For companies and government agencies that are on the path to Zero Trust, data-centric management is the key to preventing data breaches that are profitable for intruders. How can data-centric management protect data in a way that network-centric approaches cannot? First of all, data are encrypted persistently and seamlessly in a data-centric management model. Secondly, every time a user needs to access data, s/he must be authenticated using dynamic data access policies and only then will the data be decrypted for the user to access.

Let's assume that the network has already been breached and a valid user credential is stolen by the attacker. The attacker wants to exfiltrate the files; in a network-centric Zero Trust environment, the attacker could use the stolen credential to make one request to access a device or cloud container and steal the 1000 files stored on it. The cloud data encryption would not stop the breach because the files were retrieved by an authenticated user.

On the other hand, with a data-centric solution in place, the attacker would have to use the stolen credential to make 1000 requests to access the encrypted data, one for each file. The access control process would detect the excessive number of requests from the user that would be a departure from the usual pattern, and an alert would simultaneously be issued while the user's access request is denied. In this case, only a tiny number of files could potentially be breached.  Since the attacker doesn't know the content of each encrypted file before the request to access is granted, s/he cannot select the files to exfiltrate first, minimizing the chances of losing critical data. Implementing more advanced measures including classified data access control can further reduce or eliminate the chance of a data breach."

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

I like this discussion as it hits the head of the nail: what a "Zero Trust" system, or architect, looks or functions like that it can fend off the attacks as we know. The answer so far seems to be: no one knows. In another words, none of existing system or architect provides the protection that "Zero Trust" is supposed to provide.

We, however, take a different approach to "Zero Trust", and cyber defense in general. Instead of relying on "verification", aka authentication, which we know is not reliable when under attack, we reduce the resources a user can obtain through each "verification".  Here is excerpt from our white paper in a very simplified way.

"For companies and government agencies that are on the path to Zero Trust, data-centric management is the key to preventing data breaches that are profitable for intruders. How can data-centric management protect data in a way that network-centric approaches cannot? First of all, data are encrypted persistently and seamlessly in a data-centric management model. Secondly, every time a user needs to access data, s/he must be authenticated using dynamic data access policies and only then will the data be decrypted for the user to access.

Let's assume that the network has already been breached and a valid user credential is stolen by the attacker. The attacker wants to exfiltrate the files; in a network-centric Zero Trust environment, the attacker could use the stolen credential to make one request to access a device or cloud container and steal the 1000 files stored on it. The cloud data encryption would not stop the breach because the files were retrieved by an authenticated user.

On the other hand, with a data-centric solution in place, the attacker would have to use the stolen credential to make 1000 requests to access the encrypted data, one for each file. The access control process would detect the excessive number of requests from the user that would be a departure from the usual pattern, and an alert would simultaneously be issued while the user's access request is denied. In this case, only a tiny number of files could potentially be breached.  Since the attacker doesn't know the content of each encrypted file before the request to access is granted, s/he cannot select the files to exfiltrate first, minimizing the chances of losing critical data. Implementing more advanced measures including classified data access control can further reduce or eliminate the chance of a data breach."

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

I like this discussion as it hits the head of the nail: what a "Zero Trust" system, or architect, looks or functions like that it can fend off the attacks as we know. The answer so far seems to be: no one knows. In another words, none of existing system or architect provides the protection that "Zero Trust" is supposed to provide.

We, however, take a different approach to "Zero Trust", and cyber defense in general. Instead of relying on "verification", aka authentication, which we know is not reliable when under attack, we reduce the resources a user can obtain through each "verification".  Here is excerpt from our white paper in a very simplified way.

"For companies and government agencies that are on the path to Zero Trust, data-centric management is the key to preventing data breaches that are profitable for intruders. How can data-centric management protect data in a way that network-centric approaches cannot? First of all, data are encrypted persistently and seamlessly in a data-centric management model. Secondly, every time a user needs to access data, s/he must be authenticated using dynamic data access policies and only then will the data be decrypted for the user to access.

Let's assume that the network has already been breached and a valid user credential is stolen by the attacker. The attacker wants to exfiltrate the files; in a network-centric Zero Trust environment, the attacker could use the stolen credential to make one request to access a device or cloud container and steal the 1000 files stored on it. The cloud data encryption would not stop the breach because the files were retrieved by an authenticated user.

On the other hand, with a data-centric solution in place, the attacker would have to use the stolen credential to make 1000 requests to access the encrypted data, one for each file. The access control process would detect the excessive number of requests from the user that would be a departure from the usual pattern, and an alert would simultaneously be issued while the user's access request is denied. In this case, only a tiny number of files could potentially be breached.  Since the attacker doesn't know the content of each encrypted file before the request to access is granted, s/he cannot select the files to exfiltrate first, minimizing the chances of losing critical data. Implementing more advanced measures including classified data access control can further reduce or eliminate the chance of a data breach."

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

I like this discussion as it hits the head of the nail: what a "Zero Trust" system, or architect, looks or functions like that it can fend off the attacks as we know. The answer so far seems to be: no one knows. In another words, none of existing system or architect provides the protection that "Zero Trust" is supposed to provide.

We, however, take a different approach to "Zero Trust", and cyber defense in general. Instead of relying on "verification", aka authentication, which we know is not reliable when under attack, we reduce the resources a user can obtain through each "verification".  Here is excerpt from our white paper in a very simplified way.

"For companies and government agencies that are on the path to Zero Trust, data-centric management is the key to preventing data breaches that are profitable for intruders. How can data-centric management protect data in a way that network-centric approaches cannot? First of all, data are encrypted persistently and seamlessly in a data-centric management model. Secondly, every time a user needs to access data, s/he must be authenticated using dynamic data access policies and only then will the data be decrypted for the user to access.

Let's assume that the network has already been breached and a valid user credential is stolen by the attacker. The attacker wants to exfiltrate the files; in a network-centric Zero Trust environment, the attacker could use the stolen credential to make one request to access a device or cloud container and steal the 1000 files stored on it. The cloud data encryption would not stop the breach because the files were retrieved by an authenticated user.

On the other hand, with a data-centric solution in place, the attacker would have to use the stolen credential to make 1000 requests to access the encrypted data, one for each file. The access control process would detect the excessive number of requests from the user that would be a departure from the usual pattern, and an alert would simultaneously be issued while the user's access request is denied. In this case, only a tiny number of files could potentially be breached.  Since the attacker doesn't know the content of each encrypted file before the request to access is granted, s/he cannot select the files to exfiltrate first, minimizing the chances of losing critical data. Implementing more advanced measures including classified data access control can further reduce or eliminate the chance of a data breach."

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

I like this discussion as it hits the head of the nail: what a "Zero Trust" system, or architect, looks or functions like that it can fend off the attacks as we know. The answer so far seems to be: no one knows. In another words, none of existing system or architect provides the protection that "Zero Trust" is supposed to provide.

We, however, take a different approach to "Zero Trust", and cyber defense in general. Instead of relying on "verification", aka authentication, which we know is not reliable when under attack, we reduce the resources a user can obtain through each "verification".  Here is excerpt from our white paper in a very simplified way.

"For companies and government agencies that are on the path to Zero Trust, data-centric management is the key to preventing data breaches that are profitable for intruders. How can data-centric management protect data in a way that network-centric approaches cannot? First of all, data are encrypted persistently and seamlessly in a data-centric management model. Secondly, every time a user needs to access data, s/he must be authenticated using dynamic data access policies and only then will the data be decrypted for the user to access.

Let's assume that the network has already been breached and a valid user credential is stolen by the attacker. The attacker wants to exfiltrate the files; in a network-centric Zero Trust environment, the attacker could use the stolen credential to make one request to access a device or cloud container and steal the 1000 files stored on it. The cloud data encryption would not stop the breach because the files were retrieved by an authenticated user.

On the other hand, with a data-centric solution in place, the attacker would have to use the stolen credential to make 1000 requests to access the encrypted data, one for each file. The access control process would detect the excessive number of requests from the user that would be a departure from the usual pattern, and an alert would simultaneously be issued while the user's access request is denied. In this case, only a tiny number of files could potentially be breached.  Since the attacker doesn't know the content of each encrypted file before the request to access is granted, s/he cannot select the files to exfiltrate first, minimizing the chances of losing critical data. Implementing more advanced measures including classified data access control can further reduce or eliminate the chance of a data breach."

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

I like this discussion as it hits the head of the nail: what a "Zero Trust" system, or architect, looks or functions like that it can fend off the attacks as we know. The answer so far seems to be: no one knows. In another words, none of existing system or architect provides the protection that "Zero Trust" is supposed to provide.

We, however, take a different approach to "Zero Trust", and cyber defense in general. Instead of relying on "verification", aka authentication, which we know is not reliable when under attack, we reduce the resources a user can obtain through each "verification".  Here is excerpt from our white paper in a very simplified way.

"For companies and government agencies that are on the path to Zero Trust, data-centric management is the key to preventing data breaches that are profitable for intruders. How can data-centric management protect data in a way that network-centric approaches cannot? First of all, data are encrypted persistently and seamlessly in a data-centric management model. Secondly, every time a user needs to access data, s/he must be authenticated using dynamic data access policies and only then will the data be decrypted for the user to access.

Let's assume that the network has already been breached and a valid user credential is stolen by the attacker. The attacker wants to exfiltrate the files; in a network-centric Zero Trust environment, the attacker could use the stolen credential to make one request to access a device or cloud container and steal the 1000 files stored on it. The cloud data encryption would not stop the breach because the files were retrieved by an authenticated user.

On the other hand, with a data-centric solution in place, the attacker would have to use the stolen credential to make 1000 requests to access the encrypted data, one for each file. The access control process would detect the excessive number of requests from the user that would be a departure from the usual pattern, and an alert would simultaneously be issued while the user's access request is denied. In this case, only a tiny number of files could potentially be breached.  Since the attacker doesn't know the content of each encrypted file before the request to access is granted, s/he cannot select the files to exfiltrate first, minimizing the chances of losing critical data. Implementing more advanced measures including classified data access control can further reduce or eliminate the chance of a data breach."

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

I like this discussion as it hits the head of the nail: what a "Zero Trust" system, or architect, looks or functions like that it can fend off the attacks as we know. The answer so far seems to be: no one knows. In another words, none of existing system or architect provides the protection that "Zero Trust" is supposed to provide.

We, however, take a different approach to "Zero Trust", and cyber defense in general. Instead of relying on "verification", aka authentication, which we know is not reliable when under attack, we reduce the resources a user can obtain through each "verification".  Here is excerpt from our white paper in a very simplified way.

"For companies and government agencies that are on the path to Zero Trust, data-centric management is the key to preventing data breaches that are profitable for intruders. How can data-centric management protect data in a way that network-centric approaches cannot? First of all, data are encrypted persistently and seamlessly in a data-centric management model. Secondly, every time a user needs to access data, s/he must be authenticated using dynamic data access policies and only then will the data be decrypted for the user to access.

Let's assume that the network has already been breached and a valid user credential is stolen by the attacker. The attacker wants to exfiltrate the files; in a network-centric Zero Trust environment, the attacker could use the stolen credential to make one request to access a device or cloud container and steal the 1000 files stored on it. The cloud data encryption would not stop the breach because the files were retrieved by an authenticated user.

On the other hand, with a data-centric solution in place, the attacker would have to use the stolen credential to make 1000 requests to access the encrypted data, one for each file. The access control process would detect the excessive number of requests from the user that would be a departure from the usual pattern, and an alert would simultaneously be issued while the user's access request is denied. In this case, only a tiny number of files could potentially be breached.  Since the attacker doesn't know the content of each encrypted file before the request to access is granted, s/he cannot select the files to exfiltrate first, minimizing the chances of losing critical data. Implementing more advanced measures including classified data access control can further reduce or eliminate the chance of a data breach."

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

@Nya Murray

Thanks for understanding the significance of the data-centric model. I can see it is still not "main stream," even though it is the center point of the DoD Zero Trust Reference Architecture - probably because no one has ever seen a product, yet! It is coming, I promise.  You will be interested to know how classification is being used to enforce real-time access policies.   

@Niels E. Anqvist         

Thanks for the quote from Fuller. We build a new model that works with existing models because we see how each one plays a different role that altogether improves the result. How? For an attacker to break current defense, it requires investment. The data-centric model makes sure that attacks will not get the return they expect. Higher investment and lower return is a proven economic model to drive anyone out of business.  You see, the data-centric solution is quite far from the "network detect response-world," even though I believe they contributes equally to security as whole.

@boris taratine

Thanks for starting the conversation and insisting that Zero Trust is muddy concept which I couldn't agree with more. I am sure when folks at Forrest Research used the term in cybersecurity more than a decade ago, being catchy was more of a reason than being precise. However, as technologists, we interrupted it to the closest practical point as we possibly can. So we turn ZT into a mathematic function:

In essence, ZT is not literally "zero" trust, but the trust that approaches as close to zero as operationally possible. How close to 0 is implementation dependent, which separates the data-centric model from the rest.

That function is the foundation of our data-centric model: reduce the data accessed by each verification to as small of a piece as possible, so when the system reaches the decision that a breach is probably happening and stops the access, the data lost is to be kept at the smallest amount possible, so attackers are not able to get this investment back. We are now down to a single file for every authentication request, and we can detect and stop data loss with less than 100 files being breached. No one can stay in business by stealing less than 100 files with the investment of tens of thousands of dollars.

The data-centric model is independent and so is its decision-making process, user usage pattern creation included. It cannot be "tainted" when any other devices or processes are breached.

I am very interested to see if any known attacks could break this model.  False positives are possible, but a remedy to that is as easy as unlocking accounts after too many failed password attempts.

I like this discussion as it hits the head of the nail: what a "Zero Trust" system, or architect, looks or functions like that it can fend off the attacks as we know. The answer so far seems to be: no one knows. In another words, none of existing system or architect provides the protection that "Zero Trust" is supposed to provide.

We, however, take a different approach to "Zero Trust", and cyber defense in general. Instead of relying on "verification", aka authentication, which we know is not reliable when under attack, we reduce the resources a user can obtain through each "verification".  Here is excerpt from our white paper in a very simplified way.

"For companies and government agencies that are on the path to Zero Trust, data-centric management is the key to preventing data breaches that are profitable for intruders. How can data-centric management protect data in a way that network-centric approaches cannot? First of all, data are encrypted persistently and seamlessly in a data-centric management model. Secondly, every time a user needs to access data, s/he must be authenticated using dynamic data access policies and only then will the data be decrypted for the user to access.

Let's assume that the network has already been breached and a valid user credential is stolen by the attacker. The attacker wants to exfiltrate the files; in a network-centric Zero Trust environment, the attacker could use the stolen credential to make one request to access a device or cloud container and steal the 1000 files stored on it. The cloud data encryption would not stop the breach because the files were retrieved by an authenticated user.

On the other hand, with a data-centric solution in place, the attacker would have to use the stolen credential to make 1000 requests to access the encrypted data, one for each file. The access control process would detect the excessive number of requests from the user that would be a departure from the usual pattern, and an alert would simultaneously be issued while the user's access request is denied. In this case, only a tiny number of files could potentially be breached.  Since the attacker doesn't know the content of each encrypted file before the request to access is granted, s/he cannot select the files to exfiltrate first, minimizing the chances of losing critical data. Implementing more advanced measures including classified data access control can further reduce or eliminate the chance of a data breach."

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

@Nya Murray

Thanks for understanding the significance of the data-centric model. I can see it is still not "main stream," even though it is the center point of the DoD Zero Trust Reference Architecture - probably because no one has ever seen a product, yet! It is coming, I promise.  You will be interested to know how classification is being used to enforce real-time access policies.   

@Niels E. Anqvist         

Thanks for the quote from Fuller. We build a new model that works with existing models because we see how each one plays a different role that altogether improves the result. How? For an attacker to break current defense, it requires investment. The data-centric model makes sure that attacks will not get the return they expect. Higher investment and lower return is a proven economic model to drive anyone out of business.  You see, the data-centric solution is quite far from the "network detect response-world," even though I believe they contributes equally to security as whole.

@boris taratine

Thanks for starting the conversation and insisting that Zero Trust is muddy concept which I couldn't agree with more. I am sure when folks at Forrest Research used the term in cybersecurity more than a decade ago, being catchy was more of a reason than being precise. However, as technologists, we interrupted it to the closest practical point as we possibly can. So we turn ZT into a mathematic function:

In essence, ZT is not literally "zero" trust, but the trust that approaches as close to zero as operationally possible. How close to 0 is implementation dependent, which separates the data-centric model from the rest.

That function is the foundation of our data-centric model: reduce the data accessed by each verification to as small of a piece as possible, so when the system reaches the decision that a breach is probably happening and stops the access, the data lost is to be kept at the smallest amount possible, so attackers are not able to get this investment back. We are now down to a single file for every authentication request, and we can detect and stop data loss with less than 100 files being breached. No one can stay in business by stealing less than 100 files with the investment of tens of thousands of dollars.

The data-centric model is independent and so is its decision-making process, user usage pattern creation included. It cannot be "tainted" when any other devices or processes are breached.

I am very interested to see if any known attacks could break this model.  False positives are possible, but a remedy to that is as easy as unlocking accounts after too many failed password attempts.

I like this discussion as it hits the head of the nail: what a "Zero Trust" system, or architect, looks or functions like that it can fend off the attacks as we know. The answer so far seems to be: no one knows. In another words, none of existing system or architect provides the protection that "Zero Trust" is supposed to provide.

We, however, take a different approach to "Zero Trust", and cyber defense in general. Instead of relying on "verification", aka authentication, which we know is not reliable when under attack, we reduce the resources a user can obtain through each "verification".  Here is excerpt from our white paper in a very simplified way.

"For companies and government agencies that are on the path to Zero Trust, data-centric management is the key to preventing data breaches that are profitable for intruders. How can data-centric management protect data in a way that network-centric approaches cannot? First of all, data are encrypted persistently and seamlessly in a data-centric management model. Secondly, every time a user needs to access data, s/he must be authenticated using dynamic data access policies and only then will the data be decrypted for the user to access.

Let's assume that the network has already been breached and a valid user credential is stolen by the attacker. The attacker wants to exfiltrate the files; in a network-centric Zero Trust environment, the attacker could use the stolen credential to make one request to access a device or cloud container and steal the 1000 files stored on it. The cloud data encryption would not stop the breach because the files were retrieved by an authenticated user.

On the other hand, with a data-centric solution in place, the attacker would have to use the stolen credential to make 1000 requests to access the encrypted data, one for each file. The access control process would detect the excessive number of requests from the user that would be a departure from the usual pattern, and an alert would simultaneously be issued while the user's access request is denied. In this case, only a tiny number of files could potentially be breached.  Since the attacker doesn't know the content of each encrypted file before the request to access is granted, s/he cannot select the files to exfiltrate first, minimizing the chances of losing critical data. Implementing more advanced measures including classified data access control can further reduce or eliminate the chance of a data breach."

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

@Nya Murray

Thanks for understanding the significance of the data-centric model. I can see it is still not "main stream," even though it is the center point of the DoD Zero Trust Reference Architecture - probably because no one has ever seen a product, yet! It is coming, I promise.  You will be interested to know how classification is being used to enforce real-time access policies.   

@Niels E. Anqvist         

Thanks for the quote from Fuller. We build a new model that works with existing models because we see how each one plays a different role that altogether improves the result. How? For an attacker to break current defense, it requires investment. The data-centric model makes sure that attacks will not get the return they expect. Higher investment and lower return is a proven economic model to drive anyone out of business.  You see, the data-centric solution is quite far from the "network detect response-world," even though I believe they contributes equally to security as whole.

@boris taratine

Thanks for starting the conversation and insisting that Zero Trust is muddy concept which I couldn't agree with more. I am sure when folks at Forrest Research used the term in cybersecurity more than a decade ago, being catchy was more of a reason than being precise. However, as technologists, we interrupted it to the closest practical point as we possibly can. So we turn ZT into a mathematic function:

In essence, ZT is not literally "zero" trust, but the trust that approaches as close to zero as operationally possible. How close to 0 is implementation dependent, which separates the data-centric model from the rest.

That function is the foundation of our data-centric model: reduce the data accessed by each verification to as small of a piece as possible, so when the system reaches the decision that a breach is probably happening and stops the access, the data lost is to be kept at the smallest amount possible, so attackers are not able to get this investment back. We are now down to a single file for every authentication request, and we can detect and stop data loss with less than 100 files being breached. No one can stay in business by stealing less than 100 files with the investment of tens of thousands of dollars.

The data-centric model is independent and so is its decision-making process, user usage pattern creation included. It cannot be "tainted" when any other devices or processes are breached.

I am very interested to see if any known attacks could break this model.  False positives are possible, but a remedy to that is as easy as unlocking accounts after too many failed password attempts.

I like this discussion as it hits the head of the nail: what a "Zero Trust" system, or architect, looks or functions like that it can fend off the attacks as we know. The answer so far seems to be: no one knows. In another words, none of existing system or architect provides the protection that "Zero Trust" is supposed to provide.

We, however, take a different approach to "Zero Trust", and cyber defense in general. Instead of relying on "verification", aka authentication, which we know is not reliable when under attack, we reduce the resources a user can obtain through each "verification".  Here is excerpt from our white paper in a very simplified way.

"For companies and government agencies that are on the path to Zero Trust, data-centric management is the key to preventing data breaches that are profitable for intruders. How can data-centric management protect data in a way that network-centric approaches cannot? First of all, data are encrypted persistently and seamlessly in a data-centric management model. Secondly, every time a user needs to access data, s/he must be authenticated using dynamic data access policies and only then will the data be decrypted for the user to access.

Let's assume that the network has already been breached and a valid user credential is stolen by the attacker. The attacker wants to exfiltrate the files; in a network-centric Zero Trust environment, the attacker could use the stolen credential to make one request to access a device or cloud container and steal the 1000 files stored on it. The cloud data encryption would not stop the breach because the files were retrieved by an authenticated user.

On the other hand, with a data-centric solution in place, the attacker would have to use the stolen credential to make 1000 requests to access the encrypted data, one for each file. The access control process would detect the excessive number of requests from the user that would be a departure from the usual pattern, and an alert would simultaneously be issued while the user's access request is denied. In this case, only a tiny number of files could potentially be breached.  Since the attacker doesn't know the content of each encrypted file before the request to access is granted, s/he cannot select the files to exfiltrate first, minimizing the chances of losing critical data. Implementing more advanced measures including classified data access control can further reduce or eliminate the chance of a data breach."

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

@Nya Murray

Thanks for understanding the significance of the data-centric model. I can see it is still not "main stream," even though it is the center point of the DoD Zero Trust Reference Architecture - probably because no one has ever seen a product, yet! It is coming, I promise.  You will be interested to know how classification is being used to enforce real-time access policies.   

@Niels E. Anqvist         

Thanks for the quote from Fuller. We build a new model that works with existing models because we see how each one plays a different role that altogether improves the result. How? For an attacker to break current defense, it requires investment. The data-centric model makes sure that attacks will not get the return they expect. Higher investment and lower return is a proven economic model to drive anyone out of business.  You see, the data-centric solution is quite far from the "network detect response-world," even though I believe they contributes equally to security as whole.

@boris taratine

Thanks for starting the conversation and insisting that Zero Trust is muddy concept which I couldn't agree with more. I am sure when folks at Forrest Research used the term in cybersecurity more than a decade ago, being catchy was more of a reason than being precise. However, as technologists, we interrupted it to the closest practical point as we possibly can. So we turn ZT into a mathematic function:

In essence, ZT is not literally "zero" trust, but the trust that approaches as close to zero as operationally possible. How close to 0 is implementation dependent, which separates the data-centric model from the rest.

That function is the foundation of our data-centric model: reduce the data accessed by each verification to as small of a piece as possible, so when the system reaches the decision that a breach is probably happening and stops the access, the data lost is to be kept at the smallest amount possible, so attackers are not able to get this investment back. We are now down to a single file for every authentication request, and we can detect and stop data loss with less than 100 files being breached. No one can stay in business by stealing less than 100 files with the investment of tens of thousands of dollars.

The data-centric model is independent and so is its decision-making process, user usage pattern creation included. It cannot be "tainted" when any other devices or processes are breached.

I am very interested to see if any known attacks could break this model.  False positives are possible, but a remedy to that is as easy as unlocking accounts after too many failed password attempts.

I like this discussion as it hits the head of the nail: what a "Zero Trust" system, or architect, looks or functions like that it can fend off the attacks as we know. The answer so far seems to be: no one knows. In another words, none of existing system or architect provides the protection that "Zero Trust" is supposed to provide.

We, however, take a different approach to "Zero Trust", and cyber defense in general. Instead of relying on "verification", aka authentication, which we know is not reliable when under attack, we reduce the resources a user can obtain through each "verification".  Here is excerpt from our white paper in a very simplified way.

"For companies and government agencies that are on the path to Zero Trust, data-centric management is the key to preventing data breaches that are profitable for intruders. How can data-centric management protect data in a way that network-centric approaches cannot? First of all, data are encrypted persistently and seamlessly in a data-centric management model. Secondly, every time a user needs to access data, s/he must be authenticated using dynamic data access policies and only then will the data be decrypted for the user to access.

Let's assume that the network has already been breached and a valid user credential is stolen by the attacker. The attacker wants to exfiltrate the files; in a network-centric Zero Trust environment, the attacker could use the stolen credential to make one request to access a device or cloud container and steal the 1000 files stored on it. The cloud data encryption would not stop the breach because the files were retrieved by an authenticated user.

On the other hand, with a data-centric solution in place, the attacker would have to use the stolen credential to make 1000 requests to access the encrypted data, one for each file. The access control process would detect the excessive number of requests from the user that would be a departure from the usual pattern, and an alert would simultaneously be issued while the user's access request is denied. In this case, only a tiny number of files could potentially be breached.  Since the attacker doesn't know the content of each encrypted file before the request to access is granted, s/he cannot select the files to exfiltrate first, minimizing the chances of losing critical data. Implementing more advanced measures including classified data access control can further reduce or eliminate the chance of a data breach."

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

@Jun Yu

>>In essence [of the formula ], ZT is not literally "zero" trust, but the trust that approaches as close to zero as operationally possible. How close to 0 is implementation dependent, which separates the data-centric model from the rest.

it seems this model assumes the system would not have a "trusted" element, and as such, how would you "trust" the validation?

on contrary, there was nist sp800-27 "engineering principles for it security" that defined amazingly consistent set of security engineering principles. among them were three i like to bring attention to:

• minimize the system elements to be trusted (i.e., minimize the amount of software and hardware expected to provide the most secure functions for the system),
• do not implement unnecessary security mechanisms, and
• assume that external systems are insecure (i.e., do not trust systems that are not under your control)

and this is a "better" set only because it is "consistent" - inconsistent set of requirements is unattainable.


>> I am very interested to see if any known attacks could break this model.  False positives are possible, but a remedy to that is as easy as unlocking accounts after too many failed password attempts.

this is easy: spoofing. the problem of "How to remotely tell apart the legit user of a remote system and an adversary who remotely controls the system when this system is compromised?" is not yet solved. the very problem zerotrust claims to address...


@Nya Murray

>>There is a major cybersecurity problem , therefore I am proposing a creative innovative experiment to demonstrate that Zero Trust Architecture is a significant advance with many business benefits, not least of which would be making identity fraud and data theft harder, and audit trail analysis to expose successful attacks, evidence of where devices are being breached, and last but not least, expose network incursion and lateral movement.

the fundamental problem with this approach is that "we can not prove security positive"  and as such, any relative measure, e.g., "significant" and "harder", are undefined - hence unmeasurable.

the audit trails are good, but this has nothing to do with zerotrust - those are 40yo requirements. however!!!, focusing on data analysis that we were not able to do in the past due to lack of computation power does seem to be a "better" approach only because it is offering something based on "evidence of observation" (as opposed to speculations and fallacies) and we have/could not done this before on the scale we can do it now.

@Nya Murray

Thanks for understanding the significance of the data-centric model. I can see it is still not "main stream," even though it is the center point of the DoD Zero Trust Reference Architecture - probably because no one has ever seen a product, yet! It is coming, I promise.  You will be interested to know how classification is being used to enforce real-time access policies.   

@Niels E. Anqvist         

Thanks for the quote from Fuller. We build a new model that works with existing models because we see how each one plays a different role that altogether improves the result. How? For an attacker to break current defense, it requires investment. The data-centric model makes sure that attacks will not get the return they expect. Higher investment and lower return is a proven economic model to drive anyone out of business.  You see, the data-centric solution is quite far from the "network detect response-world," even though I believe they contributes equally to security as whole.

@boris taratine

Thanks for starting the conversation and insisting that Zero Trust is muddy concept which I couldn't agree with more. I am sure when folks at Forrest Research used the term in cybersecurity more than a decade ago, being catchy was more of a reason than being precise. However, as technologists, we interrupted it to the closest practical point as we possibly can. So we turn ZT into a mathematic function:

In essence, ZT is not literally "zero" trust, but the trust that approaches as close to zero as operationally possible. How close to 0 is implementation dependent, which separates the data-centric model from the rest.

That function is the foundation of our data-centric model: reduce the data accessed by each verification to as small of a piece as possible, so when the system reaches the decision that a breach is probably happening and stops the access, the data lost is to be kept at the smallest amount possible, so attackers are not able to get this investment back. We are now down to a single file for every authentication request, and we can detect and stop data loss with less than 100 files being breached. No one can stay in business by stealing less than 100 files with the investment of tens of thousands of dollars.

The data-centric model is independent and so is its decision-making process, user usage pattern creation included. It cannot be "tainted" when any other devices or processes are breached.

I am very interested to see if any known attacks could break this model.  False positives are possible, but a remedy to that is as easy as unlocking accounts after too many failed password attempts.

I like this discussion as it hits the head of the nail: what a "Zero Trust" system, or architect, looks or functions like that it can fend off the attacks as we know. The answer so far seems to be: no one knows. In another words, none of existing system or architect provides the protection that "Zero Trust" is supposed to provide.

We, however, take a different approach to "Zero Trust", and cyber defense in general. Instead of relying on "verification", aka authentication, which we know is not reliable when under attack, we reduce the resources a user can obtain through each "verification".  Here is excerpt from our white paper in a very simplified way.

"For companies and government agencies that are on the path to Zero Trust, data-centric management is the key to preventing data breaches that are profitable for intruders. How can data-centric management protect data in a way that network-centric approaches cannot? First of all, data are encrypted persistently and seamlessly in a data-centric management model. Secondly, every time a user needs to access data, s/he must be authenticated using dynamic data access policies and only then will the data be decrypted for the user to access.

Let's assume that the network has already been breached and a valid user credential is stolen by the attacker. The attacker wants to exfiltrate the files; in a network-centric Zero Trust environment, the attacker could use the stolen credential to make one request to access a device or cloud container and steal the 1000 files stored on it. The cloud data encryption would not stop the breach because the files were retrieved by an authenticated user.

On the other hand, with a data-centric solution in place, the attacker would have to use the stolen credential to make 1000 requests to access the encrypted data, one for each file. The access control process would detect the excessive number of requests from the user that would be a departure from the usual pattern, and an alert would simultaneously be issued while the user's access request is denied. In this case, only a tiny number of files could potentially be breached.  Since the attacker doesn't know the content of each encrypted file before the request to access is granted, s/he cannot select the files to exfiltrate first, minimizing the chances of losing critical data. Implementing more advanced measures including classified data access control can further reduce or eliminate the chance of a data breach."

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

I like this discussion as it hits the head of the nail: what a "Zero Trust" system, or architect, looks or functions like that it can fend off the attacks as we know. The answer so far seems to be: no one knows. In another words, none of existing system or architect provides the protection that "Zero Trust" is supposed to provide.

We, however, take a different approach to "Zero Trust", and cyber defense in general. Instead of relying on "verification", aka authentication, which we know is not reliable when under attack, we reduce the resources a user can obtain through each "verification".  Here is excerpt from our white paper in a very simplified way.

"For companies and government agencies that are on the path to Zero Trust, data-centric management is the key to preventing data breaches that are profitable for intruders. How can data-centric management protect data in a way that network-centric approaches cannot? First of all, data are encrypted persistently and seamlessly in a data-centric management model. Secondly, every time a user needs to access data, s/he must be authenticated using dynamic data access policies and only then will the data be decrypted for the user to access.

Let's assume that the network has already been breached and a valid user credential is stolen by the attacker. The attacker wants to exfiltrate the files; in a network-centric Zero Trust environment, the attacker could use the stolen credential to make one request to access a device or cloud container and steal the 1000 files stored on it. The cloud data encryption would not stop the breach because the files were retrieved by an authenticated user.

On the other hand, with a data-centric solution in place, the attacker would have to use the stolen credential to make 1000 requests to access the encrypted data, one for each file. The access control process would detect the excessive number of requests from the user that would be a departure from the usual pattern, and an alert would simultaneously be issued while the user's access request is denied. In this case, only a tiny number of files could potentially be breached.  Since the attacker doesn't know the content of each encrypted file before the request to access is granted, s/he cannot select the files to exfiltrate first, minimizing the chances of losing critical data. Implementing more advanced measures including classified data access control can further reduce or eliminate the chance of a data breach."

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes

Thanks all for an interesting and wide-ranging discussion! These questions, I think, reflect the wide breadth of Zero Trust's scope, and that its principles represent a security philosophy and approach, that can grow to inform and affect all aspects of IT and security, as an organization proceeds on its journey (and I do believe that Zero Trust is a journey).

If we wind things back to the original Forrester whitepaper, John Kindervag introduced the three fundamental concepts of Zero Trust 

1. Ensure That All Resources Are Accessed Securely Regardless Of Location
2. Adopt A Least Privilege Strategy And Strictly Enforce Access Control
3. Inspect And Log All Traffic

The concept of "never trust, always verify" stems from these principles, and refers to the necessity to literally, have zero trust in the system. (If you listen to John's current presentations on this topic, you'll hear him still emphasizing this point!). What this means is to enforce the principle of least privilege, even at the network packet level – the network must have zero implicit trust in a network packet (or device, or identity) just because it's (for example) traversing a private network under the control of the enterprise. In all cases, the entities must be authenticated (verified), and access is only permitted to authorized and specific resources, based on contextual policies.

The verification that Zero Trust relies on is authentication -- mathematical (cryptographic) proof of identity, using modern authentication protocols and cryptographic algorithms with appropriate key sizes. Is this  "trust"? Well, I certainly trust math!

Of course, none of our computer, information, or human-based systems are infallible, so even systems and processes based on the strongest cryptography and authentication is going to be subject to some weaknesses. For example, how do you, really, onboard a new remote employee with 100% certainly that it's not a malicious actor? This is not a solved problem, but that doesn't stop our enterprises from onboarding thousands of such employees every single day, successfully, and making them productive. And this is important – our enterprises need a practical and reliable approach to security, which provides defense in depth, in order to compensate for the admitted weaknesses in every layer, protocol, system, and process.

Likewise – Boris raised a question of how a security system might be able to distinguish between a legitimate remote user, and an adversary remotely controlling that system. I posit two things. First, a robust Zero Trust system will have the ability to distinguish and act upon the differences in most cases. For example, by definition this adversary needs a network connection with the compromised device. This network connection can be detected and prevented through various means (such as a DNS filtering, and a Secure Web Gateway). In addition, an adversary should not be able to successfully pass step-up authentication imposed upon the compromised device. Yes, we all know that MFA can be bypassed through various means, and that not all adversaries will be detectable -- but this doesn't mean that we give up.

Second – because we know that our security systems are imperfect – even if a system is compromised – a properly implemented Zero Trust system will reduce the blast radius of an attack. This is a key part of the "assume breach" principle of Zero Trust. If my work laptop is compromised, the adversary will likely get access to my data files, and email, etc. While this isn't a great situation, it's far better than allowing the adversary to perform network reconnaissance and move laterally across the flat enterprise network. Zero Trust prevents this, and in fact makes it easier to detect and respond to attempted network discovery.

In closing, to me, Zero Trust is all about enabling our enterprises to achieve their missions (operating our banks, airlines, hospitals, restaurants, etc) – with a reasonable level of security – by which we mean confidentiality, integrity, and availability. Our IT and security systems aren't perfect, but a Zero Trust approach makes them demonstrably better.

"Paradoxes are very interesting. In fact, it's generally the way forward when you simply do not have anything else, ... but you have a set of concepts and the set of concepts clash. And when the set of concepts clash, then you may have something to learn." Leonard Susskind, Inside Black Holes