NIST Releases Enterprise Zero Trust Architecture Draft Document

mood · Sep 25, 2019

NIST defines zero trust architecture, releases use cases
September 24, 2019
https://www.fedscoop.com/nist-zero-trust-architecture-definition/

The National Institute of Standards and Technology wants feedback on its definition of zero trust security architecture and potential deployments — outlined in a draft special publication released Monday.

Zero trust refers to the narrowing of cyberdefenses from wide network perimeters to micro-perimeters around individual or small groups of resources, NIST says in the new guidance.
No implicit trust is given to systems based on their location, and user and device authentication is required prior to establishing a connection. This is particularly important as more employees work remotely and data is migrated to the cloud.

“[M]any organizations already have elements of a ZTA in their enterprise infrastructure today,” reads the document. “Organizations should seek to incrementally implement zero trust principles, process changes, and technology solutions that protect its data assets and business functions.”
In addition to providing a ZTA roadmap, the document highlights a number of use cases including agencies with satellite facilities, multi-cloud environments and contracted services.
Click to expand...

NIST: Zero Trust Architecture - SP 800-207 (DRAFT)

mood · Jan 29, 2020

NIST adds zero-trust ‘approaches’ to its security architecture guidance for agencies
January 28, 2020
https://www.fedscoop.com/nist-zero-trust-approaches-guidance/

The National Institute of Standards and Technology wants agencies to consider their approach to zero-trust security architecture when it re-releases a draft special publication for public comment — tentatively in early February.

NIST released the first draft in September, defining zero-trust as the narrowing of cyberdefenses from wide network perimeters to micro-perimeters around individual or small groups of resources.
NIST added a section on approaches to its guidance after the first comment period resolved.
Frazier said he expects the guidance will be “streamlined” after vendors attempt to make their own additions to the document [...]

Once the special publication is finalized, NIST plans follow-on documents diving deeper into the relationship between zero trust and technologies spanning microservices, identity management, and machine learning and artificial intelligence, Rose said.
Click to expand...

mood · Aug 12, 2020

NIST Shares Final Zero Trust Architecture Strategies, Guidance
August 11, 2020
https://healthitsecurity.com/news/nist-shares-final-zero-trust-architecture-strategies-guidance

NIST unveiled the final version of its Zero Trust Architecture publication, which sheds light on the enterprise security model and provides private sector organizations a road map for deploying the cybersecurity concept across the organization.

Overseen by the Federal CIO Council, the guidance was developed in collaboration between NIST and multiple federal agencies and is meant for cybersecurity leaders, administrators, and managers. The document is aimed at providing leadership with a better understanding of the zero trust environment.
It’s important to note that zero trust is not a single deployment, as security researchers have previously explained to HealthITSecurity.com.
Click to expand...

The model gives no “implicit trust” to users and assets based on location, either physical or network-based, or based on ownership. Rather, authorization and authentication are functions performed before a user session is established.

“Zero trust is a response to enterprise network trends that include remote users, bring your own device (BYOD), and cloud-based assets that are not located within an enterpriseowned network boundary,” according to NIST.
The guide contains both a full description of the architecture, as well as various deployment models and use cases that organizations could leverage on their own networks to improve the overal IT security posture.
Click to expand...

Lastly, the publication breaks down how the zero trust architecture can be paired with existing federal guidance like the NIST Risk Management Framework and NIST Privacy Framework.
Click to expand...

NIST: Zero Trust Architecture (SP 800-207)

Log in or Sign up

NIST Releases Enterprise Zero Trust Architecture Draft Document

mood Updates Team

mood Updates Team

mood Updates Team

Log in or Sign up

NIST Releases Enterprise Zero Trust Architecture Draft Document

mood Updates Team

mood Updates Team

mood Updates Team

Useful Searches