The traditional infosec model that trusts internal networks by default and automatically mistrusts external networks is “a flawed trust model”.A security perimeter “is not only unenforceable, it does not even exist” because today’s networks are “now highly bifurcated and distributed”.As Kindervag wrote in a 2015 Forrester report, Zero Trust is based on concepts such as: Zero Trust isn’t a product or a solution it’s a philosophy and a strategy. BeyondCorp is basically Google’s own in-house version of Zero Trust.
As Mulder would say on The X-Files, “trust no one” with your data or your network - not even your own staff members.Īccording to CSO Online, John Kindervag (now field CTO at Palo Alto Networks) coined the term Zero Trust in 2010 when he was still a Forrester analyst.Īlso in 2010, Google started developing something called BeyondCorp after Chinese hackers breached the company’s system and stole intellectual property. Zero Trust takes a similar approach to infosec: stop trying to keep bad actors out of your network assume they’ve already infiltrated it. Peacock in the library with the revolver? Mustard in the conservatory with the wrench or Mrs. Instead of trying to keep the bad person out of the house, players have to figure out where they are in the house, who they are, and which weapon they’re brandishing. In fact, they’ve already committed murder. What if your company approached cybersecurity like the board game Clue? It starts off with the assumption that someone bad is already lurking inside the fictional house.