What’s Zero Trust Data Access?

This blogs was originally published by DoControl here.

Written by Adam Gavish, DoControl.

“Zero trust is a way of thinking, not a specific technology or architecture,” says Gartner Distinguished VP Analyst Neil MacDonald. “It’s really about zero implicit trust, as that’s what we want to get rid of.”

What’s Zero Trust?

Zero Trust is a security model that implicits trust in any user, device, network, or service and instead requires continuous verification of the authentication and authorization used to access corporate data. The Zero Trust model assumes that a breach is inevitable and has possibly already taken place, therefore it embraces access limitations and alerts on anomalous activity. Zero Trust is a framework for securing corporate data for today’s modern digital transformation. It is designed for the technological challenges of today’s business, including insider threats, secure remote access, ransomware threats, and more.

Zero Trust security consists of three main principles:

1. Continuous monitoring

Under the Zero Trust model, we assume that there are attackers both inside and outside our organizational perimeter, therefore no users should be automatically trusted. Zero Trust verifies every single user’s access.

2. Least privilege

While users are routinely accessing company data as part of their job function, the principle of least-privilege ensures that users are given only as much access as they need to perform their role effectively. On “a need to know” basis. This minimizes each users’ exposure to sensitive data. If a breach happens, Zero Trust limits the scope of the incident and gives time for security teams to respond and mitigate the attack.

3. Automation

Continuous monitoring and least privilege access cannot be achieved without complete automation around these processes. Zero Trust embraces the full adoption of automated security processes to achieve least privilege access, and continuously monitor and verify every single data access by every single user - both inside and outside the organization.

Why is ZTNA not enough for SaaS Data Security?

The most widely adopted use case of the Zero Trust security model is securing remote access, or Zero Trust Network Access (ZTNA). This product category eliminates the need for a legacy VPN and embraces the Zero Trust principles to verify any remote access to corporate networks through network and device micro-segmentation and access control.

ZTNA solutions enable impressive and comprehensive micro-segmentation and access control based on identity, network, and device metadata, such as an IP address, OS versions, and user roles. ZTNA solves multiple significant threat models, such as account takeover attacks (examples of allowed access from unknown networks/devices). However, when ZTNA solutions approve access, the end-user will be able to connect to the allowed applications without any micro-segmentation on what “kind” of data from those applications can or cannot be accessed, manipulated, and shared. Specifically for SaaS applications, the end-user will be able to fully access and manipulate SaaS data without any further granularity around data access control by the ZTNA solution.

For example, an employee who resigns from a company can scrape and steal a significant amount of sensitive company data before leaving the company; simply because their identity, device, and network metadata are still approved by the ZTNA solution. There is no context around data exfiltration nor what kind of data it is that is being taken. As such, organizations adopting ZTNA solutions are still exposed to various day to day threat models:

• Resigning employees exfiltrating company data
• Accidental sharing of company data with personal accounts
• Internal overexposure and consumption of sensitive data
• 3rd party collaborators overexposed to company data forever
• Data shared publicly to anyone with a link
• And more…

What’s Zero Trust Data Access?

Zero Trust Data Access (ZTDA) takes the principle of least privilege and the concept of micro segmentation and extends it throughout Software as a Service (SaaS) application environments, which are one of the most critical data sources for an enterprise trying to align to the Zero Trust model.

ZTDA is a new guiding principle that provides the granularity required to assume that implicit trust is not granted to any user inside or outside the organization, beyond the identity layer and/or deeply ingrained into the SaaS application level. This concept allows for more targeted security policies to be applied to end users and entities - both internal and external - across all SaaS applications.

ZTDA moves security closer to critical resources that drive the modern business forward.

While ZTNA micro segments on identities, networks, and devices, ZTDA micro segments on users, 3rd party collaborators, identity provider group membership, HR employment status, file type, file location, PII detection, malware detection, and more.

ZTDA applies the three Zero Trust principles as follows:

1. Continuous monitoring

ZTDA platforms are subscribed to all internal and external user activity events, SaaS assets metadata, and data enrichments originated in a broad array of interconnected integrations, such IDP, EDR, and HR platforms. All of these data points are combined to enable deep micro-segmentations on multiple levels, such as users, assets, groups, employment status, domains, and more. ZTDA platforms keep a real-time inventory of your SaaS ecosystems metadata without the need to actually replicate and store SaaS hosted data.‍

2. Least privilege

Based on the unified inventory and data enrichments, ZTDA platforms continuously revoke data access to both internal and external users to achieve the least privilege model at scale. Users in return can always share or request access to the very same data over and over so that business enablement continues as is. Over time, organizations adopting ZTDA platforms significantly reduce their attack surface, number of people having access to sensitive data, and scope of any potential breach.

3. Automation

ZTDA platforms offer automated workflows powered by comprehensive micro segmentation around users, collaborators, assets, groups, and more. These automated workflows are not opinionated or hard coded but rather highly flexible and customizable to be triggered based on any end-user activity event and/or identified anomalous activity. ZTDA platforms offer a rich catalog of workflows based remediation paths, either on-demand or fully automated.

How to apply Zero Trust on the data layer?

No two security teams/programs are equal. As such, here are the general stages to implement a Zero Trust Data Access model:

1. Visualize - understand all users, collaborators, assets, groups, and risks.
2. Mitigate - remediate identified threats to improve your security posture.‍
3. Prevent - enable automated workflows to prevent high risk scenarios.‍
4. Optimize - adjust your security needs based on business changes.