What is Zero Trust and How Does it Enable More Secure Access?

What is Zero Trust?

Zero trust is an innovative security model that ensures secure connectivity by eliminating transitive trust and continuously identifying and authenticating every device, user and identity before providing them with access to network apps. Based on the premise “never trust, always verify,” the zero trust model grants access only if a user or device's identity can be authenticated. Indeed, users and devices must be validated each and every time they want to access a network component - and they are never given access to the full network. The network is actually cloaked for users, preventing network visibility and limiting the damage potential intruders could cause.

In contrast to the legacy castle-and-moat security approach, the zero trust framework moves defenses from network-based parameters to identity-based parameters. Attributes like originating network and domain membership are no longer valid for granting access or gaining network visibility. As a result, zero trust reduces organizations' attack surface and improves their security posture. The term "zero trust" was originally coined by John Kindervag, Forrester Research analyst and thought leader.

Why Do Enterprises Need Zero Trust?

The advancements of networks and technologies have created complex enterprise tech stacks with multiple (often overlapping) security controls and policies to manage. These include network access control (NAC), network segmentation, cloud access security brokers (CASBs), privileged access management (PAM), application security, and much more. This architecture is operationally heavy, making it difficult for security and IT teams to ensure secure access for employees, whether they are working in the office or remotely. Covid-19 accelerated the business need to provide immediate secure connectivity to an entire workforce working remotely, from both managed and unmanaged devices.

The perimeter-based security approach cannot answer today’s business needs. Insufficient maintenance, a lack of integrations between security controls, and security flaws make the network’s entry points vulnerable. VPNs, the remote access tool of choice for many years, have proven unable to support full remote workforces; plus, they suffer the same limitations as other perimeter security solutions and can tunnel perpetrators right into the network. Greater connectivity needs, the rapid shift to remote work, and insufficient security tools have all led to today's reality: Enterprises are subject to more data breaches than ever before.

Zero trust answers this gap. The zero trust model blocks attackers both inside and outside the network, enables easy monitoring and management of security policies in one place, provides service segmentation, and enables visibility and auditing capabilities.

Zero trust prevents most of the reconnaissance techniques associated with the MITRE Att&ck model, thus significantly reducing the potential attack surface for bad actors. In the case of an attacker who is already inside the network, zero trust can help stop many of the attack techniques in all remaining 13 MITRE tactics.

Zero Trust Principles

The idea of zero trust is based on seven main principles, or pillars:

Never Trust

Zero trust is based on the premise of never trusting any user or device until they are authenticated. The originating network or source is not enough to establish trust and provide access. This prevents attackers who have infiltrated the system from gaining access to valuable data.

Always Verify

All users and devices are verified and continuously authenticated before they are granted access to applications or systems. Measures like multi-factor authentication (MFA) or single sign-on (SSO) add extra security to the authentication process and help ensure that unauthorized devices do not have access to sensitive data.

Identity is the New Perimeter

The legacy perimeter security model leaves networks vulnerable by providing unsolicited access to anyone in the network, including attackers. In zero trust, what matters is user and device identity, and these must be continuously verified each time access is sought.

Asset Protection

Zero trust protects assets, not networks. The zero trust model actually assumes that, at some point, attackers will be able to breach perimeter defenses. The question is, what happens next? By protecting applications and components through continuous authorization before access, limiting lateral movement, and cloaking the network, zero trust ensures that organizations and their most valued assets remain safe - even after a breach.

Simplicity

Zero trust enables security management in a simple manner. Set up takes minutes, and user policies can be updated in seconds through a centralized dashboard.

Monitoring and Auditing

Zero trust empowers security teams to monitor and control all types of users from anywhere. They can see a clear view of logins, user locations, application usage, access logs, and more. Session recordings and full audit trails enable post-incident investigations and help achieve regulatory compliance.

Don't Trust Your ZTNA provider

Many zero trust network access (ZTNA) providers maintain access to all of the network’s vulnerability points. In these cases, ZTNA is zero trust with an exception - because you do have to trust your ZTNA vendor.

Being required to trust the provider of your zero-trust access solution presents quite the paradox. Here are 7 questions to ask your provider to ensure they don't immediately violate the basics tenet of zero trust by asking you to trust them with your sensitive data.

1. Is the users’ data exposed?

2. Who has control of the access rules?

3. Where are our secrets (passwords, tokens, private keys) stored?

4. How is the risk of internal threats mitigated?

5. What is the scope of secure access? Does it include users, networks, applications, etc?

6. What is the ZTNA provider’s infrastructure? Are the servers located in the cloud or in a data center? Who can access this infrastructure?

7. What happens if the ZTNA provider is compromised? Is my organization and our data still secure?

The answer to this final question is particularly crucial and should be given due attention when choosing a partner for your ZTNA journey.

Zero Trust Architecture

An enterprise network diagram consists of multiple types of internal and external users and all their devices (managed or unmanaged), applications running from SaaS platforms, applications and resources running from public and private clouds, data centers or co-location sites.

A zero trust architecture with a true zero-trust deployment is shown below. All applications and resources are hidden from users, including attackers who are attempting to perform reconnaissance or to move internally. No inbound network traffic is allowed from the outside, and the zero trust component secures and validates access from within. This architecture can support remote access as well as networks that are not even connected to the internet.

This implementation works with any application and protocol, including legacy applications that most ZTNA tools cannot support. Security and verification measures include MFA, SSO, privileged access management capabilities, and more. Various session controls are enforced in real-time, and session recording, risk-based access, and audits provide an added layer of security.

Zero Trust vs. VPNs

VPNs are virtual secure tunnels between network points that create private connections. But at the end of the day, a VPN is just another perimeter.

As a result, VPNs have multiple shortcomings:

• VPNs lack agility. Adding new devices to VPNs is a bulky process. This hampers business growth when the entire workforce is remote.

• VPNs are resource intensive. VPNs create a heavy server load and utilize heavy encryptions. This creates latency that frustrates employees and makes it difficult to work. Lots of DevOps and IT resources are required.

• VPNs aren’t fit for modern business needs. VPNs cannot handle the loads of remote employees, third-party vendors and contractors, post-merger and acquisition (M&A) users, and more.

• VPNs aren’t secure. VPNs are based on the insecure perimeter-based approach, which trusts any user in the network. An attacker who steals an authorized user's credentials will be tunneled into the network and set free to cause substantial damage.

On the other hand, zero trust provides enterprises with the following significant benefits:

• Agility. Attribute based access control (ABAC) and role-based access control (RBAC) enable IT teams to easily provision user access based on immediate business needs.

• Fast Implementation. Zero trust can be implemented in less than an hour, and access policies can be set up in seconds.

• Broad Use-Case Fit. The zero trust security model is ideal for securing remote work, third party access, M&As, and more.

• Security. The zero trust architecture provides real granular security that protects corporate assets, externally and internally. Added security measures limit the damage attacks can do even if they breach the network.

What is ZTNA?

ZTNA is the most common implementation of the zero trust model and is often used interchangeably with “zero trust.”

Additional architectural versions of zero trust include Zero Trust Application Access (ZTAA), which opens access to applications, not networks, and Zero Trust Access (ZTA), which provides access that isn’t bound to specific networks and extends zero trust security to environments and systems that are not usually supported, including industrial control systems (ICS), SAP and ERP.

The best description of the Cyolo solution is ZTA, as it can de deployed in every possible scenario, even offline and air-gapped environments.

Zero Trust Access Use Cases

Zero trust access (ZTA) can answer multiple business requirements that no other security solution can:

Remote Workers

Zero trust seamlessly and securely connects the remote workforce to the business network to ensure business continuity and employee productivity.

Secure Third-Party Access

Third-party users like suppliers, partners and contractors are often critical to business operations, but they pose a heightened security risk because they are external to the organization. Zero trust access allows these risky users to connect securely and support the business without compromising the network's security and while ensuring governance.

Privileged Users

Zero trust monitors and manages PAM users and their unique access rights while enabling control and supervision.

Mergers and Acquisitions

The mass onboarding of new employees following an M&A present substantial security and logistical challenges. With zero trust, M&A users can be assigned to access policies within minutes and without operational overhead. This both accelerates time to value and ensures the security of the acquiring organization.

Developer Access

Developers and DevOps require access to some of the company's most important intellectual property, like source code and production environments - but security is usually not their first priority. Zero trust allows developers to access the sensitive resources they need without exposing the organization to extra risk.

OT Operations

As noted above, many ZTNA solutions do not work in operational technology (OT) environments. However, the Cyolo platform is built on a unique architecture that isolates OT networks and systems while enabling connectivity that complies with regulatory requirements.

How to Get Started with Zero Trust

Deploying zero trust is a simple 5-step process:

1. Choose your ZTNA provider. Use this list to help you choose the optimal ZTNA provider. Most providers will terminate TLS sessions but retain access to your sensitive data, such as passwords, keys, token, etc. Make sure your zero trust provider complies with the zero trust security principles.

2. Add a zero trust connector. The key component in your zero trust deployment, the zero trust connector is what connects you to the cloud broker. You will manage access and segmentation from the connector to ensure only authorized IDs have access to your assets.

3. Configure your identity provider. Configure your identity provider and users, import your servers and applications, and configure the entities and connections.

4. Create policies. Map the connections between identities and applications. These include systems, applications, protocols, identities, privilege users, mission critical assets, third parties, OT networks, and more. Then, build policies to determine which devices and users can asses with systems and applications.

5. Run. You can run your new zero trust deployment side-by-side with your VPN, or migrate completely. Update policies easily from a single UI, audit user actions, monitor in real-time, and record risky users or sessions.

For a stress-free deployment that achieves the fastest possible time to value, Cyolo recommends dividing your zero trust initiative into 3 stages based on user groups. To learn more, read the Complete 3-Step Guide to Implementing Zero Trust Access.