As I write this, the Zero Trust definition faces a bizarre dichotomy; it’s on the verge of becoming the de facto cybersecurity approach while simultaneously having many security practitioners decry it as “just a marketing ploy.” How did we, as the security community, arrive at such a precarious perch?

Part of the problem, according to John Kindervag, former Forrester analyst and author of the original Zero Trust definition and research, was that the trilogy of Zero Trust papers remained largely behind the Forrester paywall. For over a decade, only Forrester clients and every security vendor in the world had access. The hype train left the station, with those vendors shaping the Zero Trust narrative from their highly subjective, self-serving perspective. Nonclients and the greater cybersecurity community only saw Zero Trust through the the stained-glass windows of vendor marketing.

Forrester’s research advanced the Zero Trust definition and concept from network-focused to an integrated, dynamic ecosystem of security capabilities and technologies with the introduction of Zero Trust Extended (ZTX). But analysts are not necessarily marketers (despite our vociferous opinions on the practice), and the research lacked a clear, concise, shareable definition our clients and the larger community could use as a stake in the ground.

We correct both of these issues with the release of a report titled, The Definition Of Modern Zero Trust. Well, yes, that report on the Zero Trust definition is for clients only, but we’re including its definition here, on the outside, for everyone.

Zero Trust Definition

Zero Trust is an information security model that denies access to applications and data by default. Threat prevention is achieved by only granting access to networks and workloads utilizing policy informed by continuous, contextual, risk-based verification across users and their associated devices. Zero Trust advocates these three core principles: All entities are untrusted by default; least privilege access is enforced; and comprehensive security monitoring is implemented.

Notice that the last sentence is the three original Zero Trust principles stated together. Here are the salient points in bullet form:

  • Default deny
  • Access by policy only
  • For data, workloads, users, devices
  • Least privilege access
  • Security monitoring
  • Risk-based verification

zero trust definition

The good news for everyone is that this definition is not divergent from NIST’s definition in SP 800-207. The two definitions explain the same concept, using the same principles and often the same words.

What About Zero Trust Architecture Or Zero Trust Strategy?

The broad theme of Zero Trust is the reduction of implicit trust. As a model for information security, Zero Trust translates to network and security architecture. See NIST SP 800-207, Zero Trust Architectures, as the most relevant example.

Some advocates of Zero Trust say that it should also be a strategy that works as well; consider replacing the phrase “Zero Trust strategy” with “a strategy to reduce implicit trust throughout our enterprise” in your mind.

So, what isn’t Zero Trust?

To better help security leaders and pros communicate the benefits of Zero Trust adoption, our report provides more clarity on what it isn’t. One key point is that it isn’t a security awareness and training strategy. In fact, there’s no need for the vast majority of end users in an organization to have any familiarity with this concept at all. Pushing Zero Trust concepts to end users will likely backfire from an awareness and training perspective as the perception of having “zero trust” implies a lack of trust in employees. Organizations that have adopted the Zero Trust model see trust as fundamental to creating a positive, low-friction work culture for employees and invest in initiatives to empower the firm at all levels to differentiate with trust.

Go Forth And Convert The Deniers

One more time for those in the back: Zero Trust is an information security model, one that can be worked toward but without an ultimate end state. Most Forrester clients we talk with already have many of the technologies in place that can be leveraged toward full Zero Trust model adoption. These clients made Forrester’s operational report, A Practical Guide To A Zero Trust Implementation, the top-read security and risk report in 2021. These clients understand that there is a journey from poor information security toward better information security and that progress along that spectrum is more valuable than the personal satisfaction some take in just decrying Zero Trust as marketing.