Do you have a minute? Get your cybersecurity score for your organization.

icon Book Free Consultation

ZeroTrust Framework (ZTF)

Download Your Zero Trust Framework (ZTF Guide)

We invite you to continue to explore Briskinfosec’s library of information to further augment your knowledge of cybersecurity.

Introduction

Zero Trust Framework is a security concept centered on the belief that organizations shouldn't automatically trust anything, inside and outside of it. ZTF inspires organizations to make layered security approach as the organisations control over attacker’s capabilities and motivations, is uncertain. Through this, the number of vulnerabilities can be alleviated, making it harder for attackers to compromise data. ZTF establishes security requirements and controls that focuses on normalizing the functional and non-functional security controls required during the various stages of designing, developing and testing of modern technologies.

Goal of the Zero Trust Framework (ZTF) is to identify the Trust Dependencies (TD) of any Application and Network and to eliminate them. Trust Dependencies (TD) can be like a mist of confidence on Application Developers, Code reference, Security appliance, Platforms, DevOps Engineers, Managers, Customers and Partners etc. ZTF encourages to identify and eliminate each Trust Dependency (TD), building an independent IT environment.

Why ZTF?

Deploying a Zero Trust model puts the security team back in control of applications by making security automated, scalable and infrastructure agnostic. The goal of the Security Test/Penetration Test is to identify security issues such as Code and Misconfiguration issues. Our recent BINT lab research found that the cause for all cybersecurity issues exists because of blind Trust.

It can be explained in this way,

When Developer develops the payment gateway application, he passes the CHD (CARDHOLDER DATA) and CVV (CARD VERIFICATION VALUE) in plain text in POST request method.

What is the trust behind it?

Here developer blindly trusts the users with a speculation as they won’t intercept the request to see what data processes on POST request as they can see GET request alone in their browser URL.

Our traditional way of doing Penetration Test brings comprehensive penetration test report with recommendations. Sadly, 80% of Stakeholders do not learn the cause of the existing security issues and how to avoid them.

To address this area, ZTF recommends security consultants/Penetration Testers to audit the entire Network, respective of ZTF guidelines (Web, Mobile and Network) and facilitate recommendations along with their bespoke penetration test report. ZTF helps stakeholders to caution the root cause for the inception of security issues and to mitigate them.

Is ZTF An Independent Framework Or Customizable?

ZTF is a customizable framework. Security consultants can incorporate international standards (ISO 27001, PCI:DSS, HIPAA and NIST etc.) and other best practices to minimize the risk of data pilferage. Right policies and procedures are always recommended to reduce the Trust Dependencies. ZTF can be adopted by any industry to avoid emergency/hot fix situation. ZTF allows organizations to improve the overall process of their business with the highest level of security.

Is It Possible To Conduct Independent Audit On ZTF Adoption

ZTF independent audit is possible with the Penetration Test reports done at the various level of interviews with the stakeholders. Conducting ZTF audit without proper security assessment reports aren't advisable.

Key Areas To Implement ZTF:

Key areas to implement Zero Trust Framework depends on the organization requirements.

  • ZeroTrust Web Application
  • ZeroTrust Mobile Application
  • ZeroTrust Application
  • ZeroTrust Server1
  • ZeroTrust DB
  • ZeroTrust System
  • ZeroTrust Firewall
  • ZeroTrust UTM (Unified Threat Management) and much more.

Benefits Of ZTF

  • ZTF is a Transparent and straightforward framework.
  • ZTF is a general framework which can be used by any industry.
  • ZTF can be adopted along with other compliance standards such as ISO 27001, PCI-DSS, HIPAA etc.
  • ZTF assures security as a top most priority to sustainable business.
  • ZTF ensures the audit process in a more effective manner.
  • ZTF will build an independent business process without digital trust dependencies.

Image

Discover the Latest Cyber Threats - Stay Ahead of the Curve

Get exclusive access to our latest Threatsploit Report detailing the most recent and sophisticated cyber attacks. Stay informed and protect your business from emerging threats.

captcha-img