Always verify every request based on available data such as user identity, location, device health, etc. Assume every request originates from an open network.

Restrict access based on minimum permissions required to carry out a task. Secure data by using risk-based access policies.

Inspect and monitor everything to reduce risk. Minimize impact and segment access if any external or internal breach occurs.

Because failure to comply with security and compliance policies can have drastic consequences resulting in loss of data, trust and revenue, Zero Trust is today the security model of choice for large enterprises and government organizations. With Zero Trust, organizations can gain insight into users and devices connected to the network, identify threats and maintain control across the entire diverse IT ecosystem. This helps organizations run continuous verification, maintain visibility and detect vulnerabilities faster, often before an intrusion occurs. Zero Trust models also allow organizations to implement personalized rule engines that can be automatically updated based on identified risks. Designing Zero Trust capabilities within business processes, services and systems maintain security policies cover multiple environments (physical, virtual, cloud, containers), monitor security postures continuously and prevent breaches proactively.

Implementing a Zero Trust security approach means doing away with legacy infrastructure, workflows and approaches that prevent the implementation of a robust security strategy. Traditional approaches relied on 'trust but verify' models of security. This put the organizations at risk from security vulnerabilities like unauthorized access, compromised accounts, misuse of credentials, etc. With Zero Trust, organizations are required to continuously monitor and validate users and devices for privileges and attributes. Some major advantages of using Zero Trust approach to security are:

• Reduced business risk due to continuous visibility and monitoring
• Increased control over multiple environments - cloud, containers, virtual machines, etc.
• Minimized risk of data breach due to reassessment of privileges and authorizations based on changing context
• Enhanced compliance reporting
• Decreased overall capital expenditure

The Progress® Chef® platform is designed to incorporate the principles of Zero Trust and enable organizations to implement a in-depth security and compliance strategy. The Chef platform enables teams to configure security and compliance policies based on organizational needs and apply those policies consistently across all devices in the fleet irrespective of operating system or environment. The Chef infrastructure management and compliance automation capabilities collect insightful data from end points regarding system hardening status and compliance postures within the fleet. These insights can then be used to define flows in the Rules Engine and make better decisions with respect to user/device authorizations and privileges, based on attributed such as device compliance health, user data, device context, infrastructure attributes, etc. The built-in Chef dashboard tracks the status of configuration, compliance, device health, and other attributes and offers continuous visibility into the state of devices within the fleet. Continuous audits help immediately identify vulnerabilities and automated remediation helps devices maintain compliance with standard benchmarks such as CIS and DISA STIGs.

Zero Trust has become a necessary approach to security in order to help prevent cyberattacks that threaten data integrity. Risk-based adaptive rules that incorporate compliance requirements before permitting transactions make Zero Trust an ideal approach to ensure a strong security strategy among organizations. Built on the Zero Trust model, the Chef platform bundles infrastructure and compliance automation to offer a robust solution for fast, consistent and highly secure management of IT environments, systems and networks.