A typical organization’s infrastructure has become increasingly complicated. A single organization may operate many remote offices with its own local infrastructure, internal networks, cloud services, and remote or mobile individuals. That sophistication has outstripped legacy practices of boundary-based network security because there’s no single, easily identified boundary for organizations. Also, boundary-based network security has proved insufficient because more lateral attacks are unhindered once cybercriminals breach the border.

This has led to the development of a new publication for cybersecurity known as the NIST Special Publication 800-207, Zero Trust Architecture (ZTA). Zero Trust has one fundamental assumption: an enterprise should implicitly trust nothing- not its devices, identities, or network components. This means organizations should trust nothing and verify everything every time. The publication NIST (National Institute of Standards and Technology) 800-207 expounds on the basics of NIST Zero Trust Architecture and implementing Zero Trust (ZT).  This article explains what NIST 800-207 is, where it applies, and how NIST guidelines can help you achieve your cybersecurity goals.

What Is NIST 800-207?

NIST 800-207 is a series of cybersecurity practices underscoring the fundamental elements of NIST Zero Trust principles. Typically, the draft offers government agencies comprehensive recommendations on maintaining and safeguarding the agency and citizens’ confidential data.

The draft was developed following an increased priority in Zero Trust systems that protect individual assets instead of network segments. Zero Trust endeavors offer additional security in modern organization networks, including remote users and cloud-based assets. Essentially, ZT shifts focus away from safeguarding network perimeter and bars access from everyone until it’s sure who they’re. Once a user is granted access, ZT guidelines require security teams to constantly review how they use and distribute data.

NIST 800-207 offers organizations periodic guidelines for updating their network security in a world where remote work has become the norm and traditional security defenses are insufficient.

ZT principles result in improved organization security postures, and NIST 800-207 supports organizations with optimal configurations based on their business needs. 

What Is Zero Trust Architecture?

Zero Trust Architecture, also known as the Zero Trust security model or perimeter security, is an approach to the design, strategy, and implementation of digital systems. Zero Trust refers to evolving cybersecurity paradigms that move cybersecurity defenses from static, network-based perimeters to focus on assets, resources, and users.

The primary concept behind the ZTA is “never trust, always verify.” That means enterprises shouldn’t trust devices and users by default, even though they were verified previously or connected to a permissioned network like LAN. Zero Trust Architecture is executed by creating robust identity verification, giving least privilege access to only explicitly verified resources, and validating device compliance before granting access. 

Most modern enterprise networks comprise cloud services and infrastructure, interconnected zones, connections to mobile and remote environments, and connections to non-traditional IT like IoT devices. The reasoning behind ZT is that the conventional approach--trusting devices and users within a corporate perimeter or devices or users connected through a VPN--is irrelevant in the complicated environment of corporate networks. The ZTA approach champions mutual authentication, which includes verifying the identity of devices and users irrespective of their location and granting access to services and applications based on device identity, the confidence of the user, and device health alongside user authentication. 

You can apply ZT tenets in data management and access of data. That results in ZT data security, where every access must be authenticated aggressively to ensure the least privileged access to devices and users. 

At RiskRecon by Mastercard, our continuous risk monitoring platform identifies potential risks before they happen. Regardless of your expertise, our platform organizes third-party service providers by risk and risk type, allowing you to make educated decisions about your data and other digital assets.

What Are the Requirements for Zero Trust Framework Compliance?

Enforcing Zero Trust depends on these six principles:

  • Don’t trust anything or anyone, verify
  • Review requests
  • Least privilege access
  • Protect your admin environment
  • Audit everything
  • Leverage adaptive controls

To build the best ZT security plan, enterprises should focus on the following key areas:

  • Data
  • Networks
  • Workloads
  • People
  • Devices 

Further, to implement and comply with the Zero Trust Framework, you should focus on these fundamental areas:

  • Automation and orchestration
  • Analytics and visibility

The key technologies and components underlying Zero Trust Framework include:

  • Philosophy of least privilege. The principle of least privilege involves limiting access rights for accounts, users, and devices to only those tasked to complete the task at hand.
  • Micro-segmentation. Zero Trust framework compliance requires organizations to implement micro-segmentation, which divides security boundaries into small zones to ensure separate access to different network parts.
  • Multi-factor authentication. Another crucial aspect of the Zero Trust Framework is multi-factor authentication (MFA). This means more than one piece of evidence is needed to verify users. Thus, if a hacker gets hold of the password in a sensitive zone, they can’t verify their identity without additional information like one-time passcode or biometric data. 
  • Access control and monitoring. Besides user access controls, ZT involves rigorous physical device access controls. It tracks the number of IP addresses and devices trying to connect to a network to ensure each device or IP address is authentic. 

What Kind of Guidelines Does NIST 800-207 Provide?

NIST guidelines were established to help organizations meet specific regulatory compliance requirements. For instance, NIST 800-207 has nine guidelines that can help agencies achieve FISMA compliance:

  • Categorize the information and data you want to protect
  • Create a baseline for minimum security controls needed to secure that information
  • Perform risk assessments to refine your baseline security controls
  • Document your baseline security controls in a written security framework
  • Roll out security controls to your systems
  • Once enforced, track performance to measure the efficiency of your security controls
  • Identify agency-level risk depending on your review of security controls
  • Authorize the information systems for processing
  • Periodically monitor your baseline security controls

The interconnectivity of various third- and fourth-party partnerships is usually challenging to visualize and address. But with RiskRecon, you’ll have a simplified understanding of your company’s supply chain landscape, including hosting providers, fourth-party software dimensions, and other relationships, allowing you to address crucial issues faster.

Is NIST 800-207 Compliance Required? 

In response to the increasing number of cybersecurity attacks, in May 2021, the government issued an executive order directing United States federal agencies to comply with NIST SP 800-207 as a fundamental step for ZT implementation. Consequently, the standard has received heavy validation and input from government agency stakeholders, vendors, and commercial customers. Thus, many private organizations feel that NIST compliance is a de facto standard for private businesses.  

ZTA is based on the notion that nothing should be trusted, a guideline where no user, device, or app trying to interact with your cybersecurity architecture should be deemed secure by default. The reasoning behind ZTA is to lower the risk of increased cybersecurity breaches and ransomware threats as more federal employees work remotely. 

Is NIST 800-207 Universal?

References to the NIST SP 800-207 SaaS security are being made globally too, and amendments to other standards, such as ISO, will likely follow a similar protection standard. When looking at compliance models, most requirements are connected to access control. The foundations of the NIST 800-207 are related to controlling access that fulfills these compliance provisions broadly by safeguarding resources. 

How Do the NIST Guidelines Help You Achieve Your Security Goals?

The NIST guidelines are globally recognized instructions explaining how to build a robust cybersecurity strategy. They’re designed to be customized to each organization's compliance regulations, risk level, industry, size, and needs. Thus, enforcing the NIST cybersecurity framework offers companies many benefits.

  •  NIST guidelines offer a straightforward way to understand current cybersecurity risks. You must know the potential threats to safeguard your networks, assets, and systems. These guidelines outline ways to identify all enterprise assets and their relevant risks.
  • Your company can attain a recognizable standard of cybersecurity. NIST guidelines were established by experienced IT experts across the globe. Thus, they can be used by all types of enterprises. The execution of the NIST framework offers you a universal language to communicate your cybersecurity measures with customers and business partners.
  • Businesses can quickly address immediate security risks. The time for implementing the NIST cybersecurity framework is now.  If your company is attempting to adopt or expand a cybersecurity solution, assessing immediate risks could mean the difference between falling prey to cyberattacks and preventing threats.
  • NIST guidelines allow businesses to measure the ROI of their cybersecurity investments. The cybersecurity industry is overcrowded with solutions and tools that promise maximum protection against modern cybersecurity threats. Yet, more is sometimes better when it comes to cybersecurity solutions and tools. Assessing how new solutions and tools will impact your current cybersecurity posture can help you make better investment decisions.  

How to Apply the NIST RMF

A Zero Trust Architecture involves creating access procedures around acceptable risk to the designated business process or mission. It’s possible to disallow all network access to specific resources and grant access only through a connected terminal. However, this is quite restrictive in most cases and could hinder work from being completed. That's because there's an acceptable level of risk for a federal agency to achieve its objectives. The risks associated with achieving the given objectives must be identified, assessed, and accepted or mitigated. The National Institute of Standards and Technologies (NIST) risk management framework (RMF) was established to aid this [SP800-37].

Zero Trust Architecture (ZTA) planning and execution might change the authorized boundaries defined by the organization. This is because of the inclusion of new components and a decline in dependence on network perimeter defenses. The overall procedures described in the risk management framework won’t change in a Zero Trust Architecture.

How Can RiskRecon Help Me? 

RiskRecon can constantly monitor your digital ecosystem to evaluate if the environment of your suppliers and vendors aligns with the standards you set, measure how well they’re doing against their competitors, and examine their compliance against other federal standards like CMMC and NIST. We automatically prioritize findings based on threat severity and asset value, and we’ll notify you if your third-party vendors surpass their limits.

If you have further questions about Zero Trust Architecture, NIST cybersecurity framework, third-party risk management, or anything related to cybersecurity, our team is here to help. Sign up for our 30-day trial today and let us help you protect your critical assets.