NIST and ZTA

A short reminder of what Zero Trust is might be needed. I wrote an article about it and why it’s useful here on the Versasec blog (read it here) last year. NIST made a very good summary in the abstract of the publication that is excellent: “Zero trust (ZT) is the term for an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources. A zero trust architecture (ZTA) uses zero trust principles to plan industrial and enterprise infrastructure and workflows. Zero trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location (i.e., local area networks versus the internet) or based on asset ownership (enterprise or personally owned).”The full NIST Special Publication 800-207 can be found here: https://csrc.nist.gov/pubs/sp/800/207/final

I am especially interested in section 6.3 where the authors focus on the importance of securing provisioning to enable moving to ZTA. And it is even more important to secure the provisioning against impersonation and account escalation attempts.In vSEC:CMS we have implemented a long list of what we call secondary authentication methods. These are used to authenticate users, when the main authentication credentials are not available – for example during provisioning. Examples of such secondary authentication methods include OTP, Domain Credentials, SMS, Email, manager approvals and IdP via OIDC. Further vSEC:CMS has implemented granular access control of all parts of the system, which enables administrators to limit what operator can do (which tasks), for what subject, for what device and for what certificate etc.Have a look at the NIST Special Publication and please let us know if you have any other ideas how Versasec can help the world move faster to implement Zero Trust!