What is a Zero Trust Network?
Implementing zero trust principles within an organization’s environment requires the development of a zero trust network. A zero trust network is one that implements and enforces zero trust policies, such as zero trust network access (ZTNA) or Software Defined Perimeter (SDP), consistently across an organization’s entire environment.
Below, we describe how to move from a legacy, perimeter-based security model to a zero trust network that is capable of meeting and managing modern cyber threats.
Step 1: Identify a Protect Surface
Managing access to corporate assets is a central tenet to a zero trust security strategy. As mentioned earlier, zero trust policies provide access to resources on a case-by-case basis driven by role-based access controls. And to be able to manage access to resources, enterprises need to know what these resources are.
A critical stage in developing a zero trust network is to define the protect surface, which is composed of the resources that an enterprise wishes to secure. A protect surface is composed of an organization’s DAAS:
- Data: One of the most common reasons to adopt a zero trust strategy is to avoid data breaches and meet compliance requirements for data protection regulations. Identifying and classifying an organization’s data is essential for appropriately managing access to these resources.
- Assets: The modern enterprise has a wide range of corporate assets, including traditional computers, mobile devices, cloud-based resources, and Internet of Things (IoT) devices. The rise of remote work and mobile devices means that many companies struggle to maintain visibility into their entire asset catalog. Addressing these visibility gaps is crucial to an effective zero trust deployment.
- Applications: Applications are valuable resources for any business and a common target of cyberattacks. Exploitation of application vulnerabilities can provide an attacker with access to valuable data or a foothold from which they can exploit other targets. Enterprises need a complete listing of their corporate applications to develop a strategy for securing them.
- Services: The growth of the cloud means that many organizations are using or offering cloud-based services. These services also represent potential vulnerabilities and attack vectors for cybercriminals and need to be identified and protected as well.
Step 2: Explore Interdependencies
Zero trust networks operate on the principle of least privilege. This means that users are only granted the permissions they require to do their jobs.
To appropriately assign these permissions, enterprises need to understand what access and permissions their employees and IT assets required to fulfill their roles. The best way to accomplish this is to monitor what activities are performed during the organization’s daily business.
By monitoring the corporate network, enterprises can develop a map of the communications and interdependencies between its DAAS, infrastructure, services, and users. Based on viewing these network flows, it is possible to determine which communications should be permitted as part of a zero trust policy and which should be blocked as being inappropriate or unnecessary.
This exploration of the dependencies and communication patterns within an organization’s network helps set the stage for deploying a zero-trust strategy, but this is not the only benefit. If anomalous or suspicious flows are detected, this can kick off incident response activities that help enterprises root out infections within their networks.
Step 3: Implement Microsegmentation
Access controls are typically enforced at network boundaries where traffic is routed through a network security appliance. To implement a zero trust strategy, enterprises need to have many of these boundaries to provide granular protection and access control for corporate resources.
Creating network boundaries throughout the corporate network requires implementing microsegmentation. Microsegmentation places each corporate asset within its own perimeter and performs traffic monitoring and filtering at Layer 7.
This Layer 7 monitoring is essential for achieving the required visibility for zero trust. The rise of cloud computing and service-based delivery models means that Layer 3/4 traffic analysis no longer provides the granularity and visibility needed to determine the purpose of network traffic. With Layer 7 analysis, enterprises can view application-layer data and include it in their access control decisions.
When developing a micro segmentation policy, the Kipling Method can be a useful resource. It defines a zero trust policy based on the answer to six questions, including:
- Who is making the request?
- What is the resource being requested?
- Where is the request coming from?
- When was the request made?
- Why does the user need access to that resource?
- How is the user requesting access?
By answering these questions, enterprises can determine whether or not a particular request is compliant with corporate security policies. For example, access to a particular resource may be permitted only from certain computers, but a request for it may be made from a remote worker’s device. Even if the worker has legitimate access to the resource, the request should not be granted if it comes from the wrong device. Knowing not only who but where is critical to making the correct access control decision.