User:Robbie.Parsons16/sandbox

Zero Trust Networks
Zero Trust Networks or Zero Trust Network Architectures are terms used in the field of Information Technology (IT) to describe an approach to the design and implementation of IT networks. The main concept behind Zero Trust, is that networked devices, such as laptops, should not be trusted by default, even if they are connected to a managed corporate network such as the corporate LAN. In most modern enterprise environments, corporate networks consist of many interconnected segments, cloud-based services and infrastructure, connections to remote and mobile environments, and increasingly connections to non-conventional IT, such as IoT devices. The once traditional approach of trusting devices within a notional corporate perimeter, or devices connected to it via a VPN, makes less sense in such highly diverse and distributed environments. Instead, the Zero Trust Networking approach advocates checking the identity and integrity of devices irrespective of location, and providing access to applications and services based on the confidence of device identity and device health in combination with user authentication.

Background
Many of the concepts supporting Zero Trust are not new. The challenges of defining the perimeter to an organisation's IT systems was highlighted by the Jericho Forum in 2003, discussing the trend of what was then coined de-perimiterisation. In 2009, Google implemented a Zero Trust architecture referred to as BeyondCorp, part influenced by an open source access control project. The term Zero Trust has been attributed to John Kindervag, an industry analyst at Forrester, whose reporting and analysis helped crystallize Zero Trust concepts across IT communities. However, it would take almost a decade for Zero Trust Architectures to become prevalent, driven in part be increased adoption of mobile and cloud services. By 2019, the UK National Technical Authority, the National Cyber Security Centre were recommending that network architects consider a Zero Trust approach for new IT deployments, particularly where significant use of cloud services is planned. By 2020 the majority of leading IT platform vendors, as well as cyber security providers, have well-documented examples of Zero Trust architectures or solutions. This increased popularization has in-turn created a range of definitions of Zero Trust, requiring a level of standardization by recognized authorities such as NCSC and NIST.

Principles Definitions
From late 2018, work undertaken by the National Institute of Standards and Technology (NIST) and National Cyber Security Center of Excellence (NCCoE) cyber security researchers led to A NIST Special Publication (SP) 800-207, Zero Trust Architecture. The publication defines Zero trust (ZT) as a collection of concepts and ideas designed to reduce the uncertainty in enforcing accurate, per-request access decisions in information systems and services in the face of a network viewed as compromised. A Zero trust architecture (ZTA) is an enterprise’s cyber security plan that utilizes zero trust concepts and encompasses component relationships, workflow planning, and access policies. Therefore, a zero trust enterprise is the network infrastructure (physical and virtual) and operational policies that are in place for an enterprise as a product of a zero trust architecture plan.

An alternative but consistent approach is taken by NCSC, in identifying the key principles behind Zero Trust Architectures:


 * 1) Single strong source of user identity
 * 2) User authentication
 * 3) Machine authentication
 * 4) Additional context, such as policy compliance and device health
 * 5) Authorization policies to access an application
 * 6) Access control policies within an application