ZTA (Zero Trust architecture), also known as perimeter-less security, has quickly become popular in the cyber security market. A recent report by Microsoft states that 90% of enterprise management teams are aware of what Zero Trust is today. This is huge as only a year ago, only 20% of organizations were aware of it.
John Kindervag created the idea of Zero Trust in 2009. He was a former Principal Analyst at Forrester Research. Zero Trust refers to the belief that it should be verified each time instead of simply trusting data to ensure security. It works on the principle of ‘never trust, always verify’ to protect data from potential breaches.
John Kindervag came up with the ZTA after noticing that most cyberattacks did not enter from the target spot. Hackers were identifying weak points to get in and move through the network to reach the target.
Zero Trust architecture became a solution as it forces all users to verify their identity at multiple points throughout the network before giving them access to confidential data.
Zero Trust is not a new concept but has gained splendid popularity in the last few years due to the pandemic. Many companies have migrated their software apps to cloud storage to enable remote working and cut down on IT costs. This means data is stored off-premises and is being handled by 3rd parties. Therefore, if the ZTA is not applied, data can be at serious risk.
Moreover, remote employees accessing sensitive data from different regions, locations, time zones, and devices adds additional risk that only the Zero Trust architecture can eliminate.
You are at the right spot if you wish to learn more about ZTA, access management, and implementation. Keep reading to learn more!
What Is Zero Trust Architecture?
ZTA is a security solution that demands that all users entering a network are constantly authorized and authenticated. They are validated not once but multiple times before being granted access to confidential/critical apps and data.
A Zero Trust architecture does not need a defined network edge. The network could be in the cloud or locally and could be a hybrid of resources with employees working both on-premises and offsite. Therefore, it is very suitable for the digital age and security needs.
Some 3rd parties have tried to invent their understanding of Zero Trust. Noticing the standards recognized by renowned companies can help your company deduce the correct Zero Trust framework.
Zero Trust Principles
- Trusting devices and individuals present within the network is deemed just as risky as trusting outsiders based on the Zero Trust principles.
- Employees that are potential threats and have joined the company only to cause harm and compromise corporate data can be warded off.
- Stolen user credentials by hackers or people outside the company will still not be allowed access without verification.
- It prevents cyber attacks and improves cyber security.
What Are Some Common Zero Trust Strategies?
Zero Trust is useful for organizations that wish to improve secure access management by believing their network is already at stake without verification. Therefore, certain technologies and strategies must be applied to bring the Zero Trust model into effect. These include:
Least Privilege Access
Users are defined by roles and are classified based on duties. This includes assigning every user with the least privilege access. This means that basic employees can access necessary resources but will not be granted access to other data.
This strategy is fruitful as compromised user credentials will still fail to pose a threat. Hackers cannot access the user’s device, but nothing beyond that, so sensitive data is kept safe.
Multi-Factor Authentication
Multiple-factor authentication verifies user login credentials in more than one way to ensure authenticity.
Instead of a password, this authentication may also ask users to input a code emailed or sent to them via SMS. This mobile phone number or email ID should belong to a verified user, which makes login safer.
SoD
SoD (Segregation of Duties or separation of duties) works behind the ideology that one person/device should not have the ultimate access to a company’s important resources and data. If a hacker can access this person’s device, the entire organization will go down.
Examples include virtual private networks and firewalls. Even though both these types of software limit access to resources and services, a user is automatically trusted once they enter the network, even if it is a hacker.
SoD, therefore, comes in and provides a solution to this by ensuring that one individual is not made responsible for multiple roles. This means one person is not held responsible for being the only one having access to critical data and software resources.
An example includes not allowing developers/programmers to test software production or change privilege settings without approval from other company members.
Microsegmentation
Microsegmentation divides a company’s IT network into security zones and verification orders. Therefore, a separate authorization is required to secure access to each zone or department.
This strategy prevents cybercriminals from jumping from one part of the network into another spot to cause a breach of sensitive data.
Tracking And Auditing
Updated logs of each user activity and identity verification of each connection are part of proper auditing.
Zero Trust solutions also offer session records to log every activity/action in a user session. This logging proves beneficial for reporting SIEM (Security Information and Event Management) systems and forensics.
Just-In-Time Access
Just-in-time access works on the principle that any user/device should not have permanent or constant access to confidential resources or sensitive data.
Every time users wish to gain access to this data; they must pass verification to be granted access. The authorization will dissolve automatically after a user’s work is done.
Identity verification and access are strictly monitored based on this strategy.
What Does Zero Trust Architecture Include?
To understand that ZTA is necessary, companies must realize their resources, apps, data, and assets must be protected. Understanding what ‘protect surface’ should include and what assets are super crucial to a company’s security enables a better plan.
User interaction, access management, and time slots help organizations decide what Zero Trust policy will work best.
Most policies include the following:
All devices/users with access to the network should have visible endpoints.
MFA (Multi-Factor Authentication) and SSO (Single Sign On) segmentation gateways authenticate users and allow network access to secure credentials.
Network infrastructure should meet compliance rules and set security protocols.
Access Management is strictly monitored for cloud apps, SaaS, virtual software, and mobile/web applications.
Confidential and sensitive data files are encrypted, and data sharing and access are provided to limited users.
What Is The Basic Zero Trust Framework?
The Zero Trust identity and access management framework includes the following technologies but is not limited to the strategies below:
All these combined help manage and eradicate the risks involved with digital tokens/keys, privilege credentials, certificates, API tokens, etc.
How Is Zero Trust Access Management For An Organization Identified And Implemented?
Monitoring and setting protocols for user accounts in a network is the best way to prevent data breaches. This strategy is the foundation of the Zero Trust model implementation. A unified, unique, and effective strategy for handling various accounts/identities in a complex network is crucial.
The specifics and rules of the strategy for each company will differ based on business size, industry, employee locations, etc. However, a few common things that most companies can begin their ZTA with include:
Administration
The IAM (Identity and Access Management) strategy can only be designed once a company deduces the standards it should comply with. This includes auditing requirements and reporting protocols.
A strategy created to maintain good governance will only be successful if adjustments based on user privileges are made as and when needed. This also applies to functions and software access.
Creating Identities
Creating identities means dedicating time and effort to deciding rules regarding user accounts. Often HR and IT departments in companies will plan how employee/user accounts will be created, deleted, or updated.
Proper user directories are also made, containing employee information like accounts, privileges, roles, etc.
This user identity directory must seamlessly integrate with IAM to ensure proper security.
Verification
Proper policies and protocols are necessary as they are the backbone of an IAM strategy. Since policies decide user identities, roles, responsibilities, and rights, it is necessary to define these clearly.
Changes in policies daily can make it difficult for an organization to cope and cause a lot of confusion regarding job roles. Therefore, not only must these be clear, but they should also be implemented properly once.
Access Management
Once a suitable framework has been designed, it is time to implement the IAM strategy.
- Users will be verified whenever they enter login credentials.
- Multiple-factor authentication promotes device security.
- Employees can be on-premises or working remotely and will be treated similarly to be granted access to mobile apps, SaaS, cloud storage, etc. using SSO.
Does My Company Require A Zero Trust Strategy?
Zero Trust security has emerged as the most reliable digital transformation strategy in the last few years. But, how to know if your own company requires implementation and whether or not it can benefit from it? Let’s look at the infrastructure that calls for Zero Trust below:
- Unmanaged employee devices.
- Legacy systems and SaaS app usage.
- Multiple identity accounts in a multi-cloud setting.
- Employees are hybrid which means they are working both on and offsite.
- Ransomware threats to user credentials and code applications.
- Privileged users work remotely or use unmanaged devices, causing a risk of supply chain attacks.
- Remote users that have not been tested for behavioral analytics to prevent insider threats.
- You wish to retain cyber insurance.
- SOC/analyst expertise challenges.
- The company is worried about the user experience impact of introducing technologies like multifactor authentication.
- Desire to meet industry/compliance requirements like financial sector/US government Zero Trust Mandate.
- Ensure ROI on security protocols.
What Is ZTX?
Forrester Research gave Zero Trust security a refreshing change by bringing in ZTX (Zero Trust Extended). The original was made more prescriptive to aid implementation.
ZTX revolutionized businesses by driving technology advancements through cloud adoption.
The ZTX framework expands beyond network segmentation. This new approach includes:
- Devices
- Analytics
- Data networks
- People
- Workloads
- Automation
The newly extended framework allows companies an alternative to ‘on ramps’ to achieve ZTX and security protocols.
The’ people’ rule is an on-ramp that represents PAM (Privileged Access Management) used to nullify user identity risks.
ZTX focuses on reinforcing security protocols during verification and authorization when login credentials are being used to access networks, servers, devices, or workstations. This also includes privileged access to applications and the ability to change command settings, ultimately ruling out ransomware and data breaches.
How Has Legacy PAM Been Transformed Into Modern PAM?
Legacy PAM has been part of the system for a long time. It dates back to when privileged access was restricted to systems/resources inside the network.
System admins with a shared root account would verify passwords through a vault to get access to devices, databases, and servers. And it all worked out back then. The newer technology, however, is quite different.
Today privileged access covers cloud environments, company infrastructure, devices, and databases. This also includes huge data projects that need to be automated for DevOps with hundreds of containers/microservices. This is vastly different from single server apps in the past.
APTs (Advanced Persistent Threats) have created even more threats to company reputation, resources, assets, and financial information. Ransomware is often used to steal credentials and gain privileged access.
Modern PAM based on ZTA or ZTX works flawlessly to handle requests from APIs, services, and machines.
Even though shared account users cannot be eliminated, the least privilege strategy takes care of the issues and risks involved:
- Risk awareness with machine learning capabilities.
- User behavior analytics must be used to define user privileges.
- PAM is made part of a wider network infrastructure to include IaaS (Azure/AWS), DevOps CI/CD pipeline tools (HashiCorp/Ansible), and container programs (Docker/Kubernetes).
What Are The 7 Principles Of Modern ZTX?
Trust
- PAM builds trust and ensures human admin, server, and service legitimacy during the enrollment process.
- The server can trust login credentials, MFA, and privilege access elevation when it receives the PAM policies.
- API calls, DevOps application access, and other requests are validated to confirm a trusted source.
Verification
- Verification must be provided to devices, servers, systems, directories, local accounts, etc.
- Microsoft’s Active Directory/OpenLDAP/Azure/AD/Ping/Okta is used to keep directories and ease identity management.
- A variety of directories can be used under Zero Trust.
- Users with higher privileges can change access settings for lower privileged users regularly or when needed.
- Alternate Admin/Dash-A is used for privileged accounts and is often encrypted to keep it safe and recognizable amongst other public accounts.
- MFA is often included with the FIDO2 dongle to keep accounts AAL (Authenticator Assurance Levels) or AAL2 verified.
- AAL3 with FIDO key/smart card may be required for super personal data protection.
Managing Requests
- 3rd party apps are used for authentication and verification.
- Contextualizing requests means defining set protocols for granting or denying access like role, duration, ticket number, etc.
- Strict granular roles eliminate easy access and help expose sensitive apps/systems.
Secure Environment
- Avoiding VPN connections and disabling remote access to a corporate network helps create a secure environment.
- Disallowing remote access to infected workstations and devices, especially those with Internet and email access.
- Browser-based access to 3rd party users, including SSH/RDP access from anywhere remotely and at any time, eliminates the need for VNets/VPNs.
PoLP
- PoLP (Principle of Least Privilege) grants highly privileged access for a limited time.
- Eliminates network attacks from servers/devices.
- Stops vertical and lateral movement within a corporate network.
Auditing
- Logging all actions allows forensic analysis in case an issue occurs.
- Video recording sessions work as added proof.
- Payment card data and regulations like PCI-DSS all require auditing.
- A vault proxy is used to audit and achieve system-level granularity.
- CASB (Cloud Access Security Broker) and SIEM (Security Information and Event Management) must be fed audit data to reduce risks.
Adaptive Control
- Adaptive access control helps differentiate between a valid user and an intruder.
- Context attributes like location, IP address, target server, target application, time of day, day of the week, trusted device, etc. help classify real and fake users.
- Machine learning and behavioral analytics are used to analyze thousands of audits in just a few seconds.
- Real-time response helps keep the system/network super secure.
Conclusion
Zero Trust security architecture or ZTX strategies are crucial for network safety and warding off cyberattacks. The proper implementation allows a company to define privileges, hire remote workers and even use 3rd party apps without fear of losing confidential company data.
