How Intel Contributes to Zero Trust

Traditional security approaches, with secure perimeters and users/devices granted trust once inside, are no longer effective. Remote work, edge processing, hybrid environments, and sophisticated attacks have shown that credentials can be compromised, firewalls can be breached.

Businesses and governments are moving to Zero Trust, a modern framework to protect infrastructure, people, and data based on the belief that no user or asset is inherently trustworthy.  Each user, asset, application, and transaction must be continuously verified. Zero Trust frameworks typically spell out how verification is handled across Identity, Devices, Networks, Applications/Workloads, and Data.

The Zero Trust Paradox

While Zero Trust mandates a “never trust” mindset, you must establish something to trust (but verify!) as the basis for your strategy.

Hardware, including the component supply chain, offers that root of trust given its privileged position as the foundation of the compute stack.

Intel delivers products, services, and capabilities that partners and customers use to advance their Zero Trust strategy.

Establish Your Hardware Root of Trust

Zero Trust principle #4:

Access to resources is determined by dynamic policy defining resources, who members are, and what access members need.

For your Zero Trust strategy to be effective, devices must begin in a known good state and be continually verified that they remain that way.

Questions to answer:

• Where was your device designed, made, assembled and tested?
• Was the device you ordered what was delivered? 
• Did your PC boot to a “known healthy state”?
• Has your firmware or OS been tampered with?

Get Your Key Management Right

Zero Trust principle #4:

Access to resources is determined by dynamic policy defining resources, who members are, and what access members need.

Cryptographic keys are a foundation of modern cybersecurity, used to perform user authentication and enable sensitive information is accessed only by those with the right credentials.

Questions to answer:

• How are your keys generated?
• Do you use approved algorithms for random number generation?
• Where are your keys stored?
• Who is allowed access?

Isolate Your Sensitive Data and Workloads

Zero Trust principle #5:

The enterprise monitors and measures the integrity and security posture of assets. No asset is inherently trusted.

Confidential computing solutions protect sensitive and regulated data through isolation, encryption and control, and verification capabilities, helping unlock opportunities for business collaboration and insights.

Questions to answer:

• Can you protect data “in use”?
• Do you have silicon-based isolation and mechanisms to limit damage if breached?
• Are you using secure enclaves or trusted execution environments?
• How can you verify the trustworthiness of compute assets?

Verify Your Device Integrity

Zero Trust principle #4:

Access to resources is determined by dynamic policy defining resources, who members are, and what access members need.

Trusting your devices comes down to verifying your devices started in a secure state and have not been tampered with or changed or modified in ways you did not authorize.

Questions to answer:

• Did your PC boot based on its “known healthy state”?
• Has your firmware been tampered with?
• Has your OS been tampered with?
• Is your firmware up to date?
• Has your BIOS been modified?

Verify VM and Application Integrity

Zero Trust principle #5:

The enterprise monitors and measures the integrity and security posture of assets. No asset is inherently trusted.

With an established hardware root of trust and device integrity, the next area to focus is on is ensuring the things running on our devices are also operating as expected.

Questions to answer:

• Has your application code been tampered with?
• Has your VM been tampered with?

Enhance Detection with Vulnerability Insights

Zero Trust principle #6:

All resource authentication and authorization are dynamic and strictly enforced before access is allowed.

AI and advanced silicon-based telemetry offer unparalleled insights to help you detect and defend against targeted attacks.

Questions to answer:

• Can you discover zero-day attacks?
• Can you find hidden malware in memory?
• Can you detect threats within VMs?
• Can your device detect anomalous behavior?

Use Encryption to Prevent Unwanted Access

Zero Trust principle #2:

All communication is secured regardless of network location.

In an environment where a breach is expected, encryption is even more critical to safeguarding sensitive data and ensuring only authorized users have access to information and assets.

Questions to answer:

• How much damage can adversaries do in your environment?
• Is your device FIPS 140-2/3 certified?
  • Does it use NIST approved algorithms?
  • Have the crypto algorithms been rigorously tested?
  • Does your encryption work as promised?
  • What happens if you lose physical control of your device?

Streamline Device Management

Zero Trust principle #5:

The enterprise monitors and measures the integrity and security posture of assets. No asset is inherently trusted.

With the growth of remote work, devices and data are being used in more locations, making it critical to adopt comprehensive remote management.

Questions to answer:

• Are you able to manage your PCs remotely from a central location?
• Can you manage them even if they are powered off?

Getting Started

Transitioning to a Zero Trust Architecture (ZTA) is a process that’s as much about evaluating and addressing risk as physical systems to enhance security. In fact, ZTA cannot be accomplished solely with a wholesale replacement of technology.

Intel technology forms a significant part of a ZTA. We partner with leaders across the security ecosystem who provide a diversity of solutions relevant to all customers’ needs and minimize reliance on sole-source solutions.