What is Zero Trust? A Model for Better Security

With the concept of “never trust, always verify,” Zero Trust is designed to protect a digital environment by leveraging network segmentation, preventing lateral movement, simplifying granular user-access control and be able to provide Layer 7 threat prevention.

What is Zero Trust?

As defined by Crowdstrike, Zero Trust is a security concept that requires all users, even those inside the organization’s enterprise network, to be authenticated, authorized, and continuously validating security configuration and posture, before being granted or keeping access to applications and data. By utilizing this approach, one can leverage technologies such as multifactor authentication, identity and access management (IAM), and also next-generation endpoint security technology to authenticate a user’s identification and maintain proper system security.

Zero Trust is a unique feature that is different from the typical network security, following the concept of “trust but verify” methodology. A traditional approach would, by default, would trust users and endpoints within the boundaries of an organization; as a result, this will open doors for malicious activity to occur and enabling unwarranted/unauthorized users limitless access once they penetrate the network. For Zero Trust to work, an organization must be able to constantly monitor and validate a user on their device that has enabled privileges/attributes. Unfortunately, a one-time validation is ineffective due to the fact that user attributes and a probable threat can likely change.

With this being known, a company or organization must be able to verify that each time there is a request for access, they must be vetted on a constant basis to enable connection to the network or any other asset. Zero Trust policies urgently depend on real-time visibility for user attributions, and such policies can include:

• User identification
• Endpoint hardware type
• Version of firmware
• Version of Operating System
• Patch level
• User login information
• Currently installed application
• Probable vulnerabilities
• Security/incident detection

By default, a company or organization should actively assess, in depth, their network topography and access privileges to contain any possible breach and ultimately keep the impact of the breach at an absolute minimum, assuming there is a potential breach.

Why is Zero Trust important?

For controlling access to a network, application and data, Zero Trust is an extremely valuable capability for a company or organization to utilize. Zero Trust would feature various preventative techniques, which would include identity verification, microsegmentation (this is a method of developing secure zones in data centers and cloud deployments that enables companies to isolate workloads from each other and secure them individually. It’s aimed at making network security more granular), endpoint security and least privilege controls in order to prevent a possible costly intrusion.

This extra layer of security is crucial, especially since companies aspire to increase the total count of endpoints within their network and expand their given infrastructure to feature cloud-based applications and servers; these trends make it challenging to set-up, maintain and monitor secure boundaries. Also, a borderless security strategy is valuable for a company or organization that are equipped with a global workforce with the capability of offering remote work.

To add on, if one is able to segment a network and restrict a user’s access, Zero Trust security is capable of aiding a company or organization to contain a breach and minimize any possible damage that could potentially occur. This matters significantly as some of the more complicated infiltrations occur from internal users rather than external.

Edward Snowden

Edward Snowden was a particularly interesting individual that left a unique mark in the realm of cybersecurity. The reason why his situation matters is because he revealed that an organization, especially at the scale of the NSA, should not go numb on the approved internal users. Since Edward Snowden, as a subcontractor for the NSA, had proper credentials, he was able to access the NSA network.

Sine Zero Trust framework was not a topic of concern, he was able to access the network and did not have to go through any other authentication protocols that would have stopped him from downloading sensitive data that was deemed top-secret. However, if Zero Trust (and least privilege principle) were to be in place, Snowden would have been easily caught and prevented from being able to download top-secret intel that was not meant to be shared.

Core principles of Zero Trust

The Zero Trust model is based on various principles, which include:

• Re-examination of all default access controls
  • There is no trusted source, based on a Zero Trust model. The Zero Trust model assumes potential cybercriminals exist internally and externally within a network. All request to receive access to a network must be authenticated, authorized, and encrypted.
• Leverage various preventative methods
  • The Zero Trust model depends on having various preventative techniques to halt a breach.
  • Multifactor authentication (MFA) is among the most popular yet effective means to confirm the identity of a user and promote the security of a network. A MFA depends on multiple pieces of evidence that proves an identity of a user, which includes security questions, email/text confirmation, and so on. By utilizing more authentication points, an organization’s security would amplified; the amount of authentication factors that are necessary is in direct correlation to the given network security.
  • Another means of preventing an attack, through Zero Trust, is through least-privilege access, meaning that an organization would offer the most minimal level of access possible to a user/device. If a breach were to occur, the least-privilege access would help as it would aid in limiting a possible lateral movement across a network in order to minimize the effects of a breach.
  • Another security technique that is used, with a Zero Trust model, is microsegmentation. As mentioned before, microsegmentation is a method of developing secure zones in data centers and cloud deployments that enables companies to isolate workloads from each other and secure them individually. It’s aimed at making network security more granular. If there were a possible breach, the penetrator would be incapable of venturing beyond the microsegment.
• Enable real-time monitoring to pinpoint malicious activity in a timely manner
  • A key piece for the Zero Trust model is to be able to utilize a real-time monitoring capability that would aid in improving on the critical window between the moment a perpetrator penetrates the initial machine and can eventually push towards other systems within the same network. Real-time monitoring matters to a company or organization’s capability to detect, investigate and correct the probably breach.
• Align to the greater security strategies
  • Zero Trust infrastructure is a piece of a detailed and comprehensive security protocol. Also, since technology plays a significant part in defending an organization, digital capabilities alone will not prevent an intrusion. A company must invest in a comprehensive security solution that features various endpoint monitoring, detection and response capabilities to help guarantee the protection of a network.

Implementation of Zero Trust

To implement a Zero Trust model, consider the following suggestions:

• Assess the given organization
  • As an administrator or member of the IT team, one should define the protect surface and be able to identify key data, assets, applications and services (DAAS) within the selected framework. One would also need to assess the organization’s current security tools and pinpoint the possible gaps within the given infrastructure. Additionally, being able to verify the most crucial assets are granted the highest level of protection in a given security architecture is urgent.
• Create a directory of the assets and map the transaction flows
  • One should determine where the sensitive data resides and who can access it; consider how the different DAAS components can work together and confirm that there will compatibility with the security access controls between the given resources.
• Establish the preventative measures
  • Being able to leverage the various preventative measures to keep cybercriminals away and disable them from committing an infiltration is crucial, and one could utilize strategies such as: multifactor authentication, least privilege principles, and even microsegmentation.
• Monitor the network, continuously
  • Those watching the network should be able to detect where the anomalies are detected and be able to monitor all activity nearby. Also, they should be able to inspect, analyze and record all of the traffic and data without being interrupted.

Challenges of Zero Trust

Despite the extensive benefits of Zero Trust, there are some challenges that one may entail during its implementation. Here are some examples:

• Legacy applications and networks resources, administrative tools and protocols
  • The mentioned aspects are featured within a network operation, such as the cases of Powershell, Mainframes, HR Systems, etc. that are excluded from a Zero Trust architecture. Regardless, they are important tools for various operations. In a traditional sense, all of the various resources mentioned cannot be protected via identity verification, which would be very expensive. Also, since they are often excluded from the implementation, they become the weak link which could lead to various other problems.
• Regulation
  • Due to how compliances are established within organizations, regulations have not yet entirely accommodated for the Zero Trust model, creating an issue with getting through an audit. If, as an example, the Payment Card Industry Data Security Standard (PCI-DSS) requires the utilization of a firewall or segmentation of data that is sensitive, how would audits pass through if there is a lack of firewalls? Would the transition place the schematics under the proper regulations? Are there any possible implications of a possible regulation that target segmentation and the Zero Trust? Regulations, potentially, need to adjust drastically prior to being utilized for the Zero Trust model.
• Visibility and Control
  • The final challenge that will be pointed out is based on visibility and control. Visibility and control within a network is typically the leading challenge, for a large organization, attempting to implement Zero Trust networks. Typically, an organization lack explicit insight of all users within the network, which makes it a probable yet vulnerable threat imposed by things like unpatched devices, legacy systems, and over-privileged users.

There are various other samples to examine, but regardless, cybersecurity is still catching up to where it can become truly Zero Trust compliant; this would imply that there would have to be a massive redesign of the overall IT architecture for an organization. As of now, a hybrid concept would have to implemented for the time being until a true Zero Trust can be reached.

Current market leaders for Zero Trust implementation

• Citrix
• Centrify
• Proofpoint
• Akamai
• Zscaler
• Pulse Secure
• Illumio
• Cisco
• Cyxtera Technologies
• Palo Alto Networks

For additional information

For more information in regard to Zero Trust Network Access, consider examining the research conducted by Gartner Inc.

Tags:

• Cybersecurity,
• Information Technology,
• Zero Trust