NIST Releases Enterprise Zero Trust Architecture Draft Document

guest · Sep 25, 2019

NIST defines zero trust architecture, releases use cases
September 24, 2019
https://www.fedscoop.com/nist-zero-trust-architecture-definition/

The National Institute of Standards and Technology wants feedback on its definition of zero trust security architecture and potential deployments — outlined in a draft special publication released Monday.

Zero trust refers to the narrowing of cyberdefenses from wide network perimeters to micro-perimeters around individual or small groups of resources, NIST says in the new guidance.
No implicit trust is given to systems based on their location, and user and device authentication is required prior to establishing a connection. This is particularly important as more employees work remotely and data is migrated to the cloud.

“[M]any organizations already have elements of a ZTA in their enterprise infrastructure today,” reads the document. “Organizations should seek to incrementally implement zero trust principles, process changes, and technology solutions that protect its data assets and business functions.”
In addition to providing a ZTA roadmap, the document highlights a number of use cases including agencies with satellite facilities, multi-cloud environments and contracted services.
Click to expand...

NIST: Zero Trust Architecture - SP 800-207 (DRAFT)

guest · Jan 29, 2020

NIST adds zero-trust ‘approaches’ to its security architecture guidance for agencies
January 28, 2020
https://www.fedscoop.com/nist-zero-trust-approaches-guidance/

The National Institute of Standards and Technology wants agencies to consider their approach to zero-trust security architecture when it re-releases a draft special publication for public comment — tentatively in early February.

NIST released the first draft in September, defining zero-trust as the narrowing of cyberdefenses from wide network perimeters to micro-perimeters around individual or small groups of resources.
NIST added a section on approaches to its guidance after the first comment period resolved.
Frazier said he expects the guidance will be “streamlined” after vendors attempt to make their own additions to the document [...]

Once the special publication is finalized, NIST plans follow-on documents diving deeper into the relationship between zero trust and technologies spanning microservices, identity management, and machine learning and artificial intelligence, Rose said.
Click to expand...

guest · Aug 12, 2020

NIST Shares Final Zero Trust Architecture Strategies, Guidance
August 11, 2020
https://healthitsecurity.com/news/nist-shares-final-zero-trust-architecture-strategies-guidance

NIST unveiled the final version of its Zero Trust Architecture publication, which sheds light on the enterprise security model and provides private sector organizations a road map for deploying the cybersecurity concept across the organization.

Overseen by the Federal CIO Council, the guidance was developed in collaboration between NIST and multiple federal agencies and is meant for cybersecurity leaders, administrators, and managers. The document is aimed at providing leadership with a better understanding of the zero trust environment.
It’s important to note that zero trust is not a single deployment, as security researchers have previously explained to HealthITSecurity.com.
Click to expand...

The model gives no “implicit trust” to users and assets based on location, either physical or network-based, or based on ownership. Rather, authorization and authentication are functions performed before a user session is established.

“Zero trust is a response to enterprise network trends that include remote users, bring your own device (BYOD), and cloud-based assets that are not located within an enterpriseowned network boundary,” according to NIST.
The guide contains both a full description of the architecture, as well as various deployment models and use cases that organizations could leverage on their own networks to improve the overal IT security posture.
Click to expand...

Lastly, the publication breaks down how the zero trust architecture can be paired with existing federal guidance like the NIST Risk Management Framework and NIST Privacy Framework.
Click to expand...

NIST: Zero Trust Architecture (SP 800-207)

guest · Jul 27, 2021

NCCoE Names 18 Firms for Zero Trust Collaboration Project
July 23, 2021
https://www.meritalk.com/articles/nccoe-names-18-firms-for-zero-trust-collaboration-project/

The National Institute of Standards and Technology’s (NIST) National Cybersecurity Center of Excellence (NCCoE) has named 18 firms it will work with on NCCoE’s Implementing a Zero Trust Architecture Project.

The 18 companies – all of whom answered a public call for collaborators and entered a related cooperative research and development agreement with NCCoE – will work with the organization to demonstrate approaches to implementing zero trust architectures designed and deployed according the concepts and tenets in NIST’s Special Publication (SP) 800-207 on Zero Trust Architecture.
Click to expand...

The goal of the project is to produce a publicly available NIST Cybersecurity Practice Guide that shows the practical steps to implement the cybersecurity reference designs.

“Implementing a zero trust architecture has become a Federal cybersecurity mandate and a business imperative,” she said. “We are excited to work with industry demonstrating various approaches to implementing a zero trust architecture using a diverse mix of vendor products and capabilities, and share how-to guidance and lessons learned from the experience.”
Click to expand...

The 18 firms are: Amazon Web Services, Inc.; Appgate; Cisco Systems, Inc.; F5 Networks, Inc.; FireEye, Inc.; Forescout Technologies, Inc.; International Business Machines Corporation (IBM);
McAfee Corp.; Microsoft Corporation; MobileIron, Inc. an Ivanti Company; Okta, Inc.; Palo Alto Networks; PC Matic, Inc.; Radiant Logic, Inc.; SailPoint Technologies, Inc.; Symantec, a Division of Broadcom; Tenable, Inc.; and Zscaler, Inc.

“Zero trust is a team sport and the NIST NCCoE is taking the initiative to bring together best-of-breed zero trust leaders,” commented Stephen Kovac, Vice President of Global Government and Head of Corporate Compliance at Zscaler.
Click to expand...

guest · Sep 27, 2021

NIST to begin publishing Cybersecurity Practice Guide in 2022
September 27, 2021
https://www.fedscoop.com/nist-cybersecurity-practice-guide-2022/

The National Institute of Standards and Technology plans to publish various volumes of its forthcoming Cybersecurity Practice Guide throughout 2022 and beyond.

A description of the practical steps needed to implement the cyber reference designs for zero-trust security, the guide will be the end result of NIST’s Implementing a Zero Trust Architecture Project.
Click to expand...

Lookout, a San Francisco-based mobile threat defense company, is part of NIST’s working group and pushing for the Cybersecurity Practice Guide to encourage agencies to secure mobile endpoints, data and apps in the cloud, and data and apps on premise.

Lookout is interested in promoting virtual private network (VPN) replacement, continuous risk assessment and continuous conditional access as the practice guide is developed.

“The objective moving forward is to look at continuous risk assessment, so really drive zero-trust continuous conditional risk around policy enforcement and effectively have that adapt dynamically and continue to change depending on the risk level.”
Click to expand...

Ideally the Cybersecurity Practice Guide will not only be a best practices document, but a policy engine for agencies to enforce zero trust, D’Angelo said.

“It will focus on different types of solutions but, overall, a general architecture and a blueprint for different agencies to follow,” he said.
Click to expand...

Log in or Sign up

NIST Releases Enterprise Zero Trust Architecture Draft Document

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

NIST Releases Enterprise Zero Trust Architecture Draft Document

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches