Cloud Security Architecture – Zero Trust Model

As we continue our series on Cloud Security I thought it would be useful to go over one of the most used ( and abused ! ) terms in Cloud Security architecture which is that of Zero Trust. Vendors and providers will be screaming its virtues and how its a game-changer for the new business model but very few people will be explain exactly what zero trust is.

Lets start with a few clarifications ; Zero Trust is not a product but a concept. Like the name says it revolves around providing security without relying on traditional network controls and moving towards an identity centric model

Zero Trust Model and how it changes things

With Zero Trust you forget upon relying on the trust that is created by where the user is coming from ( regardless of where the user is an application , an actual user, a service identity etc. ) and instead we move to an identity-focused model. Every access is validated , authenticated based on its context and other attributes

The below diagram gives an idea of how Zero Trust differs from your traditional model