Zero Trust Security

Zero Trust Security
Security approach with no implicit network-based trust

Zero trust security is an approach that avoids granting implicit trust solely because a person or device is connected from a particular network location. NIST SP 800-207 describes a zero trust architecture organized around explicit access decisions for users, assets and resources.

Design principles

Authentication, authorization and context-sensitive policy decisions precede access to protected resources. Trust decisions may incorporate account identity, device identity, security posture and the sensitivity of the requested action.

Use with physical systems

A robot fleet might verify service identities before permitting telemetry access or command channels. However, access to a command endpoint is a separate question from whether the requested movement is operationally safe.

Limitations

Zero trust is an architectural strategy rather than a single technology or product. It cannot eliminate faults, guarantee software correctness or replace physical safety engineering.

Further reading

• Recommendation for Key Management, Part 1 — NIST

See also

• Machine identity
• Device authentication
• Robot cybersecurity
• Public key infrastructure
• User authentication