ZeroTrust Framework (ZTF)

Introduction

Zero Trust Framework is a security concept centered on the belief that organizations shouldn't automatically trust anything, inside and outside of it. ZTF inspires organizations to make layered security approach as the organisations control over attacker’s capabilities and motivations, is uncertain. Through this, the number of vulnerablities can be alleviated, making it harder for attackers to compromise data. ZTF establishes security requirements and controls that focuses on normalizing the functional and non-functional security controls required during the various stages of designing, developing and testing of modern technologies.

Goal of the Zero Trust Framework (ZTF) is to identify the Trust Dependencies (TD) of any Application and Network and to eliminate them. Trust Dependencies (TD) can be like a mist of confidence on Application Developers, Code reference, Security appliance, Platforms, DevOps Engineers, Managers, Customers and Partners etc. ZTF encourages to identify and eliminate each Trust Dependency (TD), building an independent IT environment.

Why ZTF?

Deploying a Zero Trust model puts the security team back in control of applications by making security automated, scalable and infrastructure agnostic. The goal of the Security Test/Penetration Test is to identify security issues such as Code and Misconfiguration issues. Our recent BINT lab research found that the cause for all cybersecurity issues exists because of blind Trust.

It can be explained in this way,

When Developer develops the payment gateway application, he passes the CHD (CARDHOLDER DATA) and CVV (CARD VERIFICATION VALUE) in plain text in POST request method.

What is the trust behind it?

Here developer blindly trusts the users with a speculation as they won’t intercept the request to see what data processes on POST request as they can see GET request alone in their browser URL.

Our traditional way of doing Penetration Test brings comprehensive penetration test report with recommendations. Sadly, 80% of Stakeholders do not learn the cause of the existing security issues and how to avoid them.

To address this area, ZTF recommends security consultants/Penetration Testers to audit the entire Network, respective of ZTF guidelines (Web, Mobile and Network) and facilitate recommendations along with their bespoke penetration test report. ZTF helps stakeholders to caution the root cause for the inception of security issues and to mitigate them.

Is ZTF An Independent Framework Or Customizable?

ZTF is a customizable framework. Security consultants can incorporate international standards (ISO 27001, PCI:DSS, HIPAA and NIST etc.) and other best practices to minimize the risk of data pilferage. Right policies and procedures are always recommended to reduce the Trust Dependencies. ZTF can be adopted by any industry to avoid emergency/hot fix situation. ZTF allows organizations to improve the overall process of their business with the highest level of security.

Is It Possible To Conduct Independent Audit On ZTF Adoption

ZTF independent audit is possible with the Penetration Test reports done at the various level of interviews with the stakeholders. Conducting ZTF audit without proper security assessment reports aren't advisable.

Key Areas To Implement ZTF:

Key areas to implement Zero Trust Framework depends on the organization requirements.

Benefits Of ZTF