AI and ML for Adopting, Implementing, and Maturing Zero Trust Network Access

Originally published by CXO REvolutionaries.

Written by Ben Corll, CISO in Residence, Zscaler.

In today's evolving cyber threat landscape, traditional network security models are increasingly inadequate. More robust and dynamic security paradigms like zero trust network access (ZTNA) are needed. As organizations adopt ZTNA, artificial intelligence (AI) and machine learning (ML) are emerging as pivotal technologies that can significantly enhance the implementation and maturation of these frameworks.

Understanding ZTNA

ZTNA operates on the principle of "never trust, always verify." Unlike traditional security models that rely on a secure perimeter (or crunchy shell with a gooey center), ZTNA assumes threats exist both inside and outside the network. It emphasizes continuous verification of user and device identities, as well as strict access policies.

The core components of ZTNA include:

1. Identity: Instead of an internet or network device being the perimeter, identity is the new perimeter for users, devices, workloads, and even OT/IoT devices.
2. Microsegmentation: Dividing the network into small segments to limit the potential spread of a breach, since flat networks allow malware like ransomware to run rampant and infect entire organizations in moments. If devices cannot communicate with every other device or network, it cannot spread malicious software.
3. Least-privilege access: Granting users and devices the minimum level of access needed to perform their functions only when it’s needed (just-in-time access) limits potential damage should an organization be breached.
4. Continuous monitoring: Ongoing network traffic and user behavior assessment can help security practitioners detect and respond to anomalies. This is where ML can establish a “normal” baseline for an identity and generate alerts when activity diverts from that baseline.

The role of AI and ML in ZTNA

AI/ML can play a crucial role in enhancing each component, providing advanced capabilities that are difficult to achieve through traditional methods.

1. Enhanced threat detection and response

One of the primary benefits of AI/ML in ZTNA is the ability to detect and respond to threats more effectively. Traditional security systems often rely on predefined rules and signatures, which can be inadequate against sophisticated and evolving threats. AI, on the other hand, analyzes vast amounts of data to identify patterns and anomalies that may indicate a threat.

For example, algorithms can be trained on historical network traffic data to recognize normal behavior. Once trained, these models can continuously monitor network traffic in real-time, flagging any deviations. This allows for early detection of potential threats, often before they can cause damage, especially with segmentation in place.

AI-powered systems can also automate the response to detected threats. For instance, if an anomaly suggesting a breach is detected, the system can automatically isolate the affected network segment, preventing the threat from spreading. This not only speeds up response but also reduces the burden on security teams. Of course, this requires training, including for the help desk, so technicians do not simply reenable an isolated system if a user calls asking for support.

2. Dynamic access control

ZTNA relies heavily on dynamic access control, where decisions are made in real-time based on a variety of factors like user identity, device type, location, and behavior. AI/ML enhance this process by providing more granular, adaptive access control mechanisms.

If a user suddenly starts accessing resources they don't typically use, or they do so from an unusual location, the system can flag this as suspicious and prompt additional authentication. For instance, if a user who typically works 9 a.m. to 5 p.m. on Monday through Friday from the UK suddenly attempts access from Hong Kong at 2 a.m on a Sunday, this warrants suspicion. Or, if an HR employee has accessed only HR systems during her tenure suddenly begins trying to access engineering systems, an alert or action may be needed.

Similarly, AI can be used to continuously assess the security posture of devices attempting to access the network. If a device shows signs of compromise, such as outdated software or unusual network activity, access can be restricted or denied.

3. Streamlining policy management

Managing security policies in a ZTNA environment can be complex, especially as user, device, and application numbers grow. AI/ML can streamline this process by automating policy creation and management. Although many organizations are not yet comfortable with AI creating policies or implementing blocks, it is certainly possible for ML algorithms to analyze historical access data to identify common patterns and/or behaviors.

This information can be used to automatically generate policies that reflect the actual usage patterns (which I tried to do manually 15-20 years ago when I deployed and managed firewalls for enterprises. Yet what took me weeks or months can be done is days or less). Additionally, AI can continuously monitor the effectiveness of existing policies and make adjustments as needed to ensure they remain effective against evolving threats and user behaviors.

4. Improving user experience

One challenge of implementing ZTNA is balancing security with user experience. Stringent security measures often lead to friction for users, resulting in reduced productivity and increased frustration. AI/ML can help mitigate this by providing a more seamless, adaptive user experience. Users are willing to accept change and they are willing to accept controls, so long as they are not overly tedious. For instance, they accept that they need to swipe a badge to access a building or unlock the door to access a building. It may slow them down for a moment or two, but it’s generally seen as worthwhile. Our digital controls need to be similar.

For instance, AI-powered authentication systems can use contextual information to streamline authentication. If a user is accessing the network from a previously authenticated and trusted device and location, the system can allow access with minimal friction. Conversely, if the access attempt is deemed new or suspicious, additional authentication steps can be introduced.

ML can also predict and preemptively address potential issues that could impact user experience. By analyzing network traffic patterns, ML models can identify potential bottlenecks and recommend optimizations to ensure smooth and efficient access to resources.

5. Facilitating compliance and auditing

Regulatory compliance is a critical aspect of network security. ZTNA frameworks must be able to demonstrate appropriate security measures are in place and access to sensitive data is controlled. AI/ML can facilitate compliance audits through detailed insights and automated reporting capabilities.

AI-powered analytics can continuously monitor and log all access attempts, providing a comprehensive audit trail. This data can be used to generate reports demonstrating compliance with relevant regulations and that can be sent to auditors to simplify this process. ML algorithms can also analyze this data to identify potential compliance gaps, recommend corrective actions, and document when they were taken.

6. Predictive security

One of the most exciting applications of AI/ML in ZTNA is predictive security. By analyzing historical data, ML models can identify trends and patterns that may indicate a threat. For instance, a sudden increase in access attempts from a particular region or a spike in activity on a specific resource might trigger a system to proactively take measures to mitigate the risk.

Predictive security can also be applied to user behavior. By continuously analyzing user activity, ML models can identify signs of compromised accounts or insider threats. For example, if an employee's behavior suddenly deviates significantly from their normal patterns, this could indicate that their account has been compromised, and the system can then prompt additional authentication or temporarily restrict access. Even if an organization isn't comfortable with systems taking action, it can alert administrators with recommended steps.

Overcoming challenges in AI and ML integration

While the benefits of AI/ML in enhancing ZTNA are significant, there are also challenges to fully realizing these benefits.

1. Data quality and quantity

AI models require large amounts of high-quality data to be effective. Inadequate or poor-quality data can lead to inaccurate models and unreliable predictions. Organizations must ensure they have robust data collection and management processes in place to support AI/ML initiatives. After all, bad data means bad results. With generative AI tools, the quality of user prompts also affects the quality of the answer returned.

2. Model training and maintenance

Developing effective AI/ML models is not a one-time effort. Models must be continuously trained and updated to remain effective against evolving threats. This requires ongoing investment in data science expertise and resources. This was my initial concern with security orchestration automation response (SOAR) tools: I was concerned who could train the models. I'm just as concerned with those who are authorized to train the models with data.

3. Integration with existing systems

Integrating AI/ML capabilities with existing security infrastructure can be complex. Organizations must ensure these technologies integrate with current systems and processes. This may require investment in new tools and platforms that support AI/ML integration. Go slow. Be cautious. But get started and stay the course.

4. Ethical and Privacy Considerations

AI/ML technologies raise important ethical and privacy considerations. For instance, continuous monitoring of user behavior can raise privacy concerns. Organizations need to ensure they have appropriate policies and controls in place to address these issues and protect user privacy. As things change, reevaluate. As new laws and regulations are drafted and published, work with compliance, HR, and legal teams to understand what needs to be done (if anything) to stay compliant.

Conclusion

As the cyber threat landscape continues to evolve, traditional network security models are becoming increasingly more and more inadequate. ZTNA offers a more robust and dynamic security paradigm that can better address these challenges. By leveraging AI/ML, organizations can enhance the implementation, adoption, and maturation of ZTNA model(s), providing more effective threat detection and response, dynamic access control, streamlined policy management, improved user experience, facilitated compliance, and predictive security capabilities.

While there are challenges to integrating AI/ML into ZTNA, the potential benefits far outweigh the difficulties. By continuously investing in these technologies, organizations should be able to significantly enhance their security posture and better protect their users and their data in an increasingly complex and hostile cyber environment.