Hotline 400-686-2011
Evolve perimeter-based defenses with a zero trust architecture and identity-based network security approach
Vendors have responded to the growing interest in zero trust by marketing the concept. But zero trust is not a product an organization can buy. Rather, it is a mindset or a set of principles. Nor does zero trust solve every security challenge an organization faces. Instead, it has the following technical strengths and weaknesses:
Strengths of zero trust:
Weaknesses of zero trust:
Domain 1: Identity of users and devices
A key capability of the zero trust model is ensuring that a user or entity has an appropriate level of authentication. Accessing different resources may require different strengths of authentication, depending on how sensitive the application is.
For devices, the more you know, the better you can manage risk. For user devices, ask questions such as: Has it accessed the application before? Does it meet basic hygiene requirements? For non-user devices such as IoT devices, establish defaults, such as denying the device internet access and logging the resources these devices are allowed to reach.
Domain 2: Application governance and logging
To achieve secure connections between users and applications, categorize the applications in your network, including details such as name and owner, data sensitivity and business criticality levels, business users, and hosting location. Be prepared to spend considerable effort gathering information, including information about unapproved SaaS applications and user-defined applications.
Once you understand your applications, establish entitlements that define which users can access them and at what level, and decide how to keep those entitlements up to date. Finally, establish logging rules, including what to log, who can access the logs, and how to back up the logs and ensure they cannot be modified.
Domain 3: Enforcement
Once you know user identities and their entitlements, you must enforce appropriate access. Common terms for the devices that enforce access in a zero trust environment include controllers, proxies, identity-aware proxies, microsegmentation, and even firewalls.
Microsegmentation is a particularly important concept in zero trust, because it can place security services between any two workloads in your infrastructure, allowing you to isolate workloads and enforce end-user access to workloads or access from one workload to another.
Perimeters also continue to play a role in a zero trust environment, but they should be more isolated to prevent lateral movement within the network, thereby slowing attacks and forcing attackers to leave more traces. Encrypting all data in transit preserves confidentiality.
Domain 4: Enrichment
Because user risk levels change over time, monitoring and logging are essential. Malicious insiders are among the most dangerous threat actors, but whether attackers are internal or external, network detection and response (NDR) combined with user and entity behavior analytics (UEBA) can help information security teams find them quickly.
Threat intelligence is another valuable addition, and it can answer questions such as: What are the latest zero-day vulnerabilities? Or, which vulnerabilities are being heavily exploited? Design your zero trust environment to ingest threat intelligence and determine which users and/or devices are affected.
