Evolve perimeter-based defenses with a zero trust architecture and identity-based network security approach
Why use zero trust?
Zero trust is a modern approach to reducing the risk and impact of cyber threats.
Vendors have responded to the growing interest in zero trust by marketing the concept. But zero trust is not a product an organization can buy. Rather, it is a mindset or a set of principles. Nor does zero trust solve every security challenge an organization faces. Instead, it has the following technical strengths and weaknesses:
Strengths of zero trust:
- Replaces implicit trust with explicit trust based on identity and context
- Connects entities securely to resources. This lets you securely connect users to applications and restrict non-user devices to authorized resources only
- Enforces a consistent and dynamic approach to protecting resources
- Provides visibility into which users are accessing which applications, which helps comply with the “just-in-time” and “just-enough” access principles
- Drives a consistent security posture and consistent access policies regardless of user, device, or location, while minimizing user friction by matching authentication to risk
- Limits lateral movement by threat actors or malware within the organization by pushing access decisions closer to the resources
- Enhances system confidentiality by encrypting all data in transit
Weaknesses of zero trust:
- Employee resistance, as some will find the approach too restrictive
- Long deployment timelines
- Errors in context-based decisions can incorrectly disconnect users, causing random or poorly timed loss of access
- Does not: prevent software supply chain attacks; protect public-facing applications; guarantee 100% that the user behind an account is the right one; generally protect access to SaaS applications; remediate or compensate for poor access policies
- Complexity grows quickly if automation and sound processes are not deeply embedded
- Requires well-developed exception-handling processes so that critical access can be granted quickly
- The policy decision point (PDP) is a single point of control that can be compromised
- Technical debt can hinder zero trust implementation across the board
Focus on the four areas for building and implementing a zero trust architecture.
- Identity of users and devices
- Application governance and logging
- Enforcement through technical controls and encryption
- Enrichment through monitoring and automation
Domain 1: Identity of users and devices
A key capability of the zero trust model is ensuring that a user or entity has an appropriate level of authentication. Accessing different resources may require different strengths of authentication, depending on how sensitive the application is.
For devices, the more you know, the better you can manage risk. For user devices, ask questions such as: Has it accessed the application before? Does it meet basic hygiene requirements? For non-user devices such as IoT devices, establish defaults, such as denying the device internet access and logging the resources these devices are allowed to reach.
Domain 2: Application governance and logging
To achieve secure connections between users and applications, categorize the applications in your network, including details such as name and owner, data sensitivity and business criticality levels, business users, and hosting location. Be prepared to spend considerable effort gathering information, including information about unapproved SaaS applications and user-defined applications.
Once you understand your applications, establish entitlements that define which users can access them and at what level, and decide how to keep those entitlements up to date. Finally, establish logging rules, including what to log, who can access the logs, and how to back up the logs and ensure they cannot be modified.
Domain 3: Enforcement
Once you know user identities and their entitlements, you must enforce appropriate access. Common terms for the devices that enforce access in a zero trust environment include controllers, proxies, identity-aware proxies, microsegmentation, and even firewalls.
Microsegmentation is a particularly important concept in zero trust, because it can place security services between any two workloads in your infrastructure, allowing you to isolate workloads and enforce end-user access to workloads or access from one workload to another.
Perimeters also continue to play a role in a zero trust environment, but they should be more isolated to prevent lateral movement within the network, thereby slowing attacks and forcing attackers to leave more traces. Encrypting all data in transit preserves confidentiality.
Domain 4: Enrichment
Because user risk levels change over time, monitoring and logging are essential. Malicious insiders are among the most dangerous threat actors, but whether attackers are internal or external, network detection and response (NDR) combined with user and entity behavior analytics (UEBA) can help information security teams find them quickly.
Threat intelligence is another valuable addition, and it can answer questions such as: What are the latest zero-day vulnerabilities? Or, which vulnerabilities are being heavily exploited? Design your zero trust environment to ingest threat intelligence and determine which users and/or devices are affected.
