What is Zero Trust Security?

Cybersecurity has always been important, but now that most organizations rely on networking and interconnection, the risk of being hacked has grown exponentially.

With wireless connectivity, mobile computing, public and private cloud networks, and the Internet of Things (IoT), the potential for a serious and potentially disastrous attack is at an all-time high. 

The Zero Trust Security Approach

Historically, security systems and procedures have operated at the edge of the network. The notion being that if you only admit authorized users and traffic, then anyone or anything inside the network perimeter could be trusted implicitly. 

The problem is that once malicious operators, both external and internal, are inside the perimeter, they can traverse the network searching for targets. These potential exposures are magnified by the extensive use of distributed systems, private and public clouds, and IoT applications. 

The Zero Trust methodology requires that all users, both inside and outside an organization be authorized, authenticated, and validated. In other words, don’t assume any account is trustworthy. Zero Trust has been embraced by the US Government and is formalized in the NIST 800-207 standard for Zero Trust architectures. The methodology, as defined, is vendor-neutral, however, most leading vendors have retooled their technologies and products to accommodate Zero Trust security methods and practices. See, for example, the Zero Trust network architectures (ZTNA) developed by Palo Alto Networks, Amazon Web Services (AWS), Cisco Networks, and Microsoft.

See also: 7 Popular Zero Trust Practices.

Elements of Zero Trust Methodology

The basic tenets of Zero Trust security are as follows:

1. Always verify. Before allowing users, devices, or services access to a resource, verify and secure their identity, their right to be where they are, the context of their request, and their authority to be doing what they are asking to do.

2. Least privilege. Allow users, devices, or services to access only what they need (Just-Enough-Access) and when they need it (Just-In-Time).

3. Assume a breach. Always act as if there is imminent danger of an incursion or an exfiltration of data. Employ defenses, such as threat detection and data analytics to identify anomalies and repel hackers.

The Zero Trust methodology calls for a concept known as micro-segmentation to section off network locations and resources into discrete walled zones. This allows potential threats to be detected in real-time and then contained and prevented from traversing across the enterprise. 

Organizations can implement Zero Trust security practices using their vendor’s access policy control capability. For example, in Microsoft environments, security professionals facilitate micro-segmentation, as well as Just-Enough Access/Just-In-Time access, through role-based access control with Azure Active Directory Privileged Identity Management (PIM).

Users, devices, and applications requesting access are authenticated based on their identity, role, and context before they are granted access to the authorized applications and network resources. Because of the “Assume a breach” tenet of Zero Trust security, even authorized users may have their connection request denied if, for example, they are attempting access with a new device or from an unrecognized location.

Training for Zero Trust Security

Although Zero Trust security is a top priority for many security decision makers, you’re unlikely to find many jobs or certifications with “Zero Trust security” in the title. Most current Zero Trust security training and certification is focused on the generic zero-trust methodology.

While academically relevant, this security training does not meet the here-and-now practical need to implement zero trust methodology within a vendor environment. For that, you’ll need to look at vendor certifications, such as Microsoft Certified: Security, Compliance, and Identity Fundamentals.

This role-based certification addresses Zero Trust security as a core concept that must be mastered for jobs in security operations, identity and access management. The cert validates the holder’s knowledge of Microsoft security, compliance, and identity (SCI) solutions and how they enable end-to-end cybersecurity protection.

The certification exam for Microsoft Certified: Security, Compliance, and Identity (SCI) Fundamentals tests each candidate’s mastery of the following areas:

• Security, compliance, and identity concepts, including the Zero Trust security model, authentication and authorization, the functions of Microsoft Active Directory, and the operation of a federated security architecture. 

• Microsoft Azure Active Directory (Azure AD) features and capabilities, including authentication methods, multi-factor authentication, password protection/management,  role-based access control, and identity governance.

• Implementing Microsoft security solutions, including distributed denial of service (DDoS) protection, firewall implementation, micro-segmentation, Just-In-Time access, data encryption, and integrated threat management.

• Implementing security compliance with Microsoft Service Trust Portal, including privacy principles, compliance scores and management, data classification and data lifecycle management capabilities, data loss prevention, and records management.

Preparing for Microsoft SCI Certification

So how do you prepare for the SC-900 certification exam that’s required to become Microsoft Certified in Security, Compliance, and Identity Fundamentals? 

There are no specific prerequisites for this accreditation. However, it is assumed that candidates have working experience in IT and are familiar with networking and the cloud architectures that underpin Microsoft Azure and Microsoft 365. If you’re not completely up to speed, we suggest that you brush up by taking a few introductory online training courses:

• Microsoft Azure Fundamentals to learn about Azure Cloud technical concepts and business propositions.

• Microsoft 365 Fundamentals to reinforce your knowledge of core Microsoft 365 services and concepts.

Once you’re comfortable with Azure and Microsoft 365, prepare for the Microsoft SCI certification exam by taking the CBTNuggets Microsoft Certified: Security, Compliance, and Identity Fundamentals online security training course.

If you are currently involved in administering, managing, or planning network operations, then earning a Microsoft SCI certification can give you an important career edge! If you’re hoping to make a move into security, then Microsoft Certified: SCI Fundamentals online security training will teach important concepts that will persist throughout your cybersecurity career.

You can take all three of these online security training courses (and so much more!) when you subscribe to CBT Nuggets. Not sure you want to subscribe? Sign up for a free 1-week trial subscription to see how much you get with a monthly subscription.