In Zero We Trust: Cultivating a Zero Trust Strategy

Written by Prakhar Singh, Business Development Manager, Cybersecurity & GRC Services, HCL Technologies and Sahil Pathak, Technology Evangelist.

Introduction

When one thinks about IT network and security, the first thing that comes to mind is the traditional de-militarized zones or the hub and spoke model. This requires the users to be in the office to access the corporate network, internet, SaaS, and on-premise applications. It is a simple yet effective way to build the complete security stack within these hubs and safeguard the users and apps by ensuring all inbound and outbound traffic that goes through them, thus assuring network security. For the remote users, backhauling the data back to the DMZ and VPN was the answer to enforce the security policies. But, what happens when a large part of the workforce is working remotely? What happens to the rising MPLS costs? Is there a security threat of lateral movement in providing network access through VPNs? What if the apps are not in the data centers anymore?

The arrival and increased adoption of technology trends such as cloud, 4G and 5G, IoT, BYOD, and more recently, the COVID-19 pandemic have raised questions. It is now glaringly obvious that the traditional/ pre-pandemic approach will only be an inhibitor to organizations trying to be more agile. As applications are moving from on-premise to cloud and users are working remotely, there is a need to go direct to the internet and protect the data, which requires security transformation. Internet is the new corporate network, and a new IT security infrastructure with an entirely novel approach to the architecture is the mandate.

What is Zero Trust and its need?

The term ‘Zero Trust’ was first used by John Kindervag during his tenure as a VP and Principal Analyst with Forrester in 2009. It was based on the fact that traditional security models operate on the assumption that everyone outside the perimeter is malicious and everyone inside the network is trustworthy. Hence, the perimeter-centric security is exposed to the vulnerability that once on the network, users (including threat actors and malicious insiders) and malware can freely move laterally, causing substantial damage. More often than not, the entry point is only the route to the main target for hackers.

The Zero Trust framework, on the other hand, recognizes trust as a vulnerability and ensures security and access policies are enforced based on identity, endpoint, and user context. Migration to cloud, BYOD, and 5G had already created the need for organizations to adopt the framework. However, COVID-19 demanded the need to work remotely combined with perimeter-centric security/VPN vulnerabilities has made it critical for enterprises to do so and soon.

What is Zero Trust?

While the concept of ‘Zero Trust’ has been around for a while, there has been some confusion about what it means. The fact that it is being used by vendors to market everything in their portfolio adds to the confusion, thus necessitating the need for a standard definition.

The National Institute of Standards and Technology is an agency of the U.S. Department of Commerce that develops cybersecurity standards, guidelines, best practices, and resources to meet the needs of U.S. industry, federal agencies, and the broader public. It defines Zero Trust architecture as:

“Zero Trust Architecture provides a collection of concepts, ideas, and component relationships (architectures) designed to eliminate the uncertainty in enforcing accurate access decisions in information systems and services. ^“

Zero Trust – Key tenets

Digital business transformation requires systems, services, application programming interfaces, data, and processes to be accessible through multiple mechanisms anywhere, anytime, from any user device over the internet. This expands the surface area for attackers to target.

Users and applications are already in the cloud. Hence, secure access capabilities must evolve to cloud delivery, too. Many Zero Trust network access products are cloud-based. Some key Zero Trust tenets are:

1. Implement least privilege using ZTNA: Make apps invisible to the internet by placing them behind the ZTNA framework. Deploy a ZTNA product that relies on multiple contextual aspects to establish and adapt trust for application-level access.
2. Assume breach and scan everything: Use relevant security architecture for proper content inspection for cyber and data protection.
3. Use app-centric model: Use app-centric and not a network security approach for policy enforcement. This should focus on user-application segmentation and workload micro-segmentation. Connect users and applications to resources, not the corporate network security.

Summary and recommendations

Traditional security architectures, which focus on protecting the network, are no longer effective in this new reality. Protecting business and retaining the benefits of digital transformation requires migrating to a Zero Trust security model delivered through the cloud, closer to where your users and business assets are now centered.

As the internet becomes the new corporate network, Zero Trust provides the path to fast, seamless, and secure access across the entire business ecosystem. However, implementing a Zero Trust security model isn’t just a function of IT—it impacts all areas of one’s business and beyond the traditional confines of an organization. Successfully implementing Zero Trust security architecture requires a detailed strategy that addresses challenges and opportunities across 3 Ps – platform, people, and processes.

Like crops, a Zero Trust architecture strategy needs cultivation as well. It includes preparing the environment for change, improving, developing the current security posture, and choosing the right tools.

Draft SP 800-207, Zero Trust Architecture (nist.gov)