ไทย
English
Summary of Concepts from the NSA
In an era where cyber threats are increasingly sophisticated and constantly evolving, traditional security approaches that rely on trusting internal users or protecting only the network perimeter with firewalls are no longer sufficient.
This is why Zero Trust Architecture (ZTA) has become one of the most important cybersecurity frameworks adopted by organizations worldwide.
This article summarizes key concepts from the “Zero Trust Implementation Guideline – Primer” published by the National Security Agency (NSA) to help organizations better understand Zero Trust and how it can be implemented effectively.
What is Zero Trust?
Zero Trust is a cybersecurity concept built on two fundamental principles:
Never Trust, Always Verify
– No user, device, or system should be trusted automatically.
Assume Breach
– Organizations must assume that a compromise may already exist and design security controls accordingly.
Every access request to systems, data, or applications must be verified, authenticated, and authorized appropriately, regardless of whether the request originates from inside or outside the organization.
Why Zero Trust is Important
Modern business operations are no longer confined to the office or the corporate network. Users may access applications and data from multiple locations, using a wide range of devices, cloud environments, and third-party services. As a result, traditional network boundaries have become more complex and difficult to control.
At the same time, many cyberattacks do not begin by directly breaking through perimeter defenses. Instead, attackers may exploit stolen credentials, vulnerable devices, or excessive access privileges. This allows them to enter an environment while appearing to be legitimate users and potentially move laterally to other systems.
The U.S. government established Zero Trust as a national cybersecurity priority through Executive Order 14028 to strengthen the security of federal agencies and reduce exposure to threats such as:
- Credential theft: The theft of usernames, passwords, or authentication information to gain unauthorized access
- Ransomware: Malware that encrypts or takes control of systems and data to demand payment
- Supply chain attacks: Attacks carried out through software providers, service providers, vendors, or business partners
- Insider threats: Risks caused by employees, contractors, compromised accounts, negligence, or malicious intent
Zero Trust helps reduce these risks by verifying every access request, applying least-privilege access, and segmenting critical resources. Even when an attacker compromises one account or system, they should not automatically gain access to the entire environment. This helps contain incidents and reduce their overall impact.
| Zero Trust is Not Just Technology — It is a Mindset
The NSA makes it clear that Zero Trust is not achieved by purchasing or installing a single security solution. It requires a broader transformation in how an organization manages cybersecurity across its policies, processes, people, and technology.
Zero Trust assumes that no user, device, or system should be trusted automatically, whether it is located inside or outside the organization. Every access request must be properly verified and continuously evaluated.
To support this approach, organizations need several core capabilities.
Continuously Verify Every Access Request
Verification should not end after a user successfully signs in. Organizations should continue evaluating access privileges and context throughout the entire session.
Factors such as user identity, device status, location, time, behavior, and the sensitivity of the requested resource should be assessed continuously. When risk levels change, the system should be able to require additional authentication, limit access, or terminate the session.
Assess Device Security Posture
Every device requesting access should be checked against the organization’s security policies.
This may include verifying whether the device:
- Has the latest operating system and security patches
- Uses approved anti-malware or endpoint protection
- Has encryption enabled
- Complies with configuration policies
- Shows signs of compromise or suspicious activity
Devices that do not meet security requirements should be restricted or denied access until the identified issues are resolved.
Improve Visibility and Behavioral Analytics
Organizations must be able to see and understand activities across their environments, including login attempts, account usage, data access, device connections, and system changes.
Logs and behavioral analytics can help identify suspicious activity, such as:
- Sign-ins from unusual locations
- Access at unexpected times
- Large or unusual data downloads
- Attempts to access systems unrelated to a user’s role
- Sudden changes in normal user or device behavior
These capabilities allow security teams to detect potential threats earlier and provide valuable information for incident investigation.
Prepare for Incident Response and Recovery
Zero Trust recognizes that no security control can prevent every attack. Organizations must therefore be prepared to respond when an account, device, application, or system is compromised.
When suspicious activity is detected, the organization should be able to:
- Suspend or restrict user accounts
- Revoke access privileges
- Isolate affected devices
- Prevent threats from spreading
- Restore systems and data
- Maintain business continuity
A clearly defined incident response and recovery process is essential for minimizing operational impact and restoring services as quickly as possible.
Designing a Zero Trust Architecture
An effective Zero Trust architecture should begin with the following steps:
- Identify the organization’s most critical assets (Crown Jewels)
- Design security controls from the inside out
- Apply the Least Privilege principle, granting only necessary access rights
- Monitor and log all traffic and activities across the environment
- Use contextual signals such as user identity, device posture, location, and behavioral patterns
Zero Trust Should Be Implemented in Phases
Moving an entire organization to Zero Trust in a single project can create unnecessary complexity and operational disruption. The NSA therefore recommends a phased implementation approach.
Organizations can begin with the systems that present the greatest business value or security risk, test the effectiveness of new controls, and gradually expand Zero Trust practices across the broader environment.
Discovery Phase
The Discovery Phase focuses on understanding the organization’s current environment.
The organization should identify its users, devices, applications, data, administrative accounts, and access paths. It should also determine where sensitive information is stored, which systems communicate with one another, and how employees and third parties access business resources.
This phase often reveals security gaps such as inactive accounts, unnecessary privileges, unmanaged devices, outdated systems, or applications that lack appropriate monitoring.
The information gathered during discovery becomes the foundation for a realistic Zero Trust roadmap.
Phase One: Establishing the Foundation
Once the organization understands its environment, the next step is to strengthen identity, device, and access controls.
This may involve implementing Multi-Factor Authentication, improving identity lifecycle management, introducing role-based access control, assessing device posture, and applying risk-based access policies.
The organization should also begin applying least privilege to its most important systems and improve logging across identity, endpoint, network, and application environments.
The goal of this phase is to establish sufficient visibility and control to make more reliable access decisions.
Phase Two: Integration and Automation
After the foundational capabilities are in place, the organization can integrate information from identity, endpoint, network, application, and security analytics platforms.
This integration allows security decisions to be based on a broader and more accurate view of risk. For example, an identity platform may identify a valid user, while an endpoint security system detects that the user’s device is compromised. When these systems share information, access can be restricted automatically.
Automation can also support actions such as suspending a high-risk account, isolating a compromised device, requiring additional authentication, or blocking access until a security issue has been resolved.
A phased approach allows organizations to evaluate results, refine policies, minimize disruption, and gradually extend Zero Trust across the entire environment.
The 7 Pillars of Zero Trust
The Zero Trust framework is structured around seven core pillars designed to support modern IT environments. These pillars align with the DoD Zero Trust Framework and emphasize the following principles:
- Continuous Verification
- Identity and Context Validation
- Strict Access Control
- Comprehensive Data Protection
These pillars work together to strengthen the overall security posture of an organization.
Core Components of Zero Trust
1. User
The User pillar focuses on verifying identities, assessing user risk, and monitoring behavior continuously.
Access rights should reflect the user’s responsibilities, current context, and level of risk. Privileged permissions should be controlled more strictly and granted only when necessary.
Organizations should also protect user sessions and interactions throughout the entire access lifecycle rather than relying solely on the initial login process.
2. Device
The Device pillar focuses on evaluating the condition and trustworthiness of endpoints before access is granted.
Organizations should consider patch status, malware risk, encryption, device ownership, security configuration, and compliance with internal policies.
Device posture should form part of every access decision, especially when sensitive data or high-value systems are involved.
3. Applications and Workloads
The Applications and Workloads pillar covers applications, APIs, containers, virtual machines, hypervisors, cloud workloads, and supporting infrastructure.
No workload should be trusted automatically simply because it operates within the organization’s network or cloud environment.
Applications and workloads should be authenticated, monitored, segmented, and protected according to their purpose and level of risk.
4. Data
The Data pillar focuses on understanding where information is stored, how it is classified, who can access it, and how it moves across the environment.
Organizations should protect sensitive information throughout its lifecycle, including when it is stored, transmitted, processed, shared, archived, or deleted.
Controls such as encryption, classification, access policies, labeling, and Data Loss Prevention can help ensure that information is used appropriately and remains protected.
5. Network and Environment
The Network and Environment pillar focuses on controlling communication between users, devices, applications, workloads, and data.
Network segmentation and microsegmentation can help prevent an attacker from moving freely across the environment after compromising one system.
Access should be controlled through detailed policies that define which resources may communicate and under what conditions.
6. Automation and Orchestration
The Automation and Orchestration pillar enables security policies and response actions to be applied quickly and consistently.
Automation may be used to block access, isolate an affected device, revoke a user session, require additional authentication, or initiate a remediation workflow.
These capabilities reduce response time and limit the possibility of errors associated with manual processes.
7. Visibility and Analytics
The Visibility and Analytics pillar brings together events, activities, and behavioral information from across the organization.
Security analytics, artificial intelligence, and machine learning can add context to this information, identify anomalies, improve threat detection, and support real-time access decisions.
Without sufficient visibility, organizations cannot verify activity continuously or determine whether users, devices, and systems continue to meet the required security conditions.
How Organizations Can Begin Their Zero Trust Journey
Although Zero Trust Architecture provides an effective framework for strengthening access control and reducing the impact of cyberattacks, successful implementation requires coordinated changes across policy, processes, people, and technology.
A practical starting point is a Zero Trust Readiness Assessment. This process helps the organization understand its current capabilities and identify gaps in areas such as identity management, privileged access, device security, network segmentation, data protection, security monitoring, incident response, and automation.
Once the assessment is complete, the organization can identify its most critical systems and data, analyze existing access patterns, and develop a phased implementation roadmap based on business priorities and security risk.
Implementation does not need to begin across the entire organization. It may initially focus on systems containing customer information, financial applications, administrative accounts, or other business-critical resources. The organization can then apply lessons learned from these initial projects as it expands Zero Trust to additional areas.
For organizations that are uncertain where to begin, working with cybersecurity and Zero Trust Architecture specialists can help reduce complexity. Experienced professionals can assess the existing environment, identify security gaps, design suitable access policies, and develop a roadmap aligned with the organization’s risk profile and business objectives.
BMSP’s cybersecurity specialists can help organizations assess their Zero Trust readiness, design an appropriate Zero Trust Architecture, and develop an implementation roadmap tailored to their systems, workforce, and operational requirements.
By adopting a structured and phased approach, organizations can strengthen cybersecurity, improve control over access to critical resources, and reduce long-term exposure to cyber threats.
- Ready to begin your organization’s Zero Trust journey? Contact BMSP for a consultation at marketing@bangkokmsp.com
