It’s clear that existing approaches to cybersecurity are not doing enough to protect organizations in today’s threat landscape. So despite being created back in 2010, the concept of Zero Trust – of not trusting anything either inside or outside the enterprise network, and verifying everything that connects to it – is being increasingly adopted by IT teams to boost their company’s security postures.
It also reflects the reality of today’s complex, heterogenous enterprise network environments. These comprise multiple public clouds, SDN deployments and traditional on-premise networks, which means the traditional network perimeter is fast disappearing.
The Zero Trust model recognizes this, and mandates the creation of micro-perimeters of control around all of an organization’s sensitive business assets to increase security, with the use of automation and analytics to improve threat detection and response across the enterprise
While it can’t prevent every possible attack or breach, Zero Trust can ensure that organizations don’t fall victim to basic attacks, or fail to discover a breach for months or even years. Beyond security too, it makes it easier for companies to deploy new business and operational models and protect them quickly and logically secured.
So how should organizations go about applying the Zero Trust blueprint to address their network security issues? How do they translate the best-practice guidance into business requirements, and then ensure those requirements are implemented and enforced across their entire network estate? This can be done with the four key components of the Zero Trust framework: network visibility, automation, segmentation and compliance.
Holistic visibility
Forrester’s Zero Trust guidance is clear – you can’t protect what you can’t see. If you don’t know where your business stores data, how sensitive it is, what applications access it, or how employees, partners and customers use it, you’re then depending on blind luck to protect against a data breach.
Getting that network-wide visibility is a huge challenge in today’s hybrid environments. While a given vendor may offer a tool that gives visibility into its specific part of the network estate, it will not give IT teams oversight of the whole infrastructure; and using multiple tools to try and get visibility adds complexity and duplication to security processes, creating the very real risk that a threat or attack may be missed or overlooked.
So it’s a fundamental business requirement to get visibility across the network. Not just of the security controls such as firewalls, routers, and cloud security groups, but of the actual policies governing those security controls. IT teams need to understand what is allowing (or blocking) application traffic flows, and to understand what those security controls and policies mean from the business application perspective. What flows do those key applications need to function, and what is actually protecting them?
From the network architect’s viewpoint, what’s needed is a single-console ‘map’ view of the network, which shows all the rules, policies and connectivity supporting each application. This gives a viewpoint relevant to every stakeholder. Application owners can see what servers, resources and security controls their applications depend on; and IT and security teams can see applications’ connectivity needs, and the impact of any changes.
Automation matters
Defining and maintaining a Zero Trust network means constant changes to security policies, configurations and rules, because the business and its applications are constantly changing. Organizations’ IT teams often have to process 20 or more application change requests per week, and these frequently take more than 8 hours per change if done manually.
These manual processes mean that teams’ workloads can quickly become unmanageable. They are also prone to simple human errors and misconfigurations which can have catastrophic consequences. An AlgoSec study found that 20% of organizations had a security breach, 48% an application outage, and 42% a network outage caused by errors during a manual security change process.
To execute every change perfectly, the only realistic option is to automate. The automation solution should use the map of business application connectivity flows that we described earlier, and it should also integrate with the widest possible range of security solutions in your environment – including firewalls, cloud and SDN platforms, SIEM and vulnerability management tools, and so on. Then for each planned change, the solution should perform a proactive risk analysis before they are made, to ensure that they don’t introduce security gaps or compliance violations.
If no exceptions or issues are identified, the approved changes can be rolled out across all the relevant security controls and devices with zero touch – saving significant time, effort, and most importantly preventing damaging misconfigurations. The solution can also determine if the changes have rendered old policies obsolete, and flag that they can be deleted safely.
What’s more, the solution will document every change automatically for audit purposes, cutting down on tedious paperwork and enabling stakeholders to review the history of previous changes.
Segmenting for security
Zero Trust mandates the use of micro-perimeters around each of an organization’s sensitive business assets to enforce protection, and to stop threats spreading laterally on networks, but it’s not always easy to decide exactly where to place the borders to segment applications. You have to understand exactly how the positioning of each micro-perimeter will affect critical business applications. What’s more, setting up the segmentation regime is not a one-time-only activity, it will be an ongoing process that will change as your business applications and needs do.
So the starting point is to understand your business application flows across your network environment, using the connectivity map we described earlier. You can then plan where to place each micro-perimeter and perform ‘what if’ dry runs using the automation solution to eliminate the risks of causing an outage.
Concerning compliance
One of the key benefits of the Zero Trust approach is that the visibility and automation it requires make compliance demands far easier to meet. Zero Trust takes organizations beyond the demands of most compliance mandates, and the automation that helps to drive it ensures that compliance is always maintained.
The benefits of automation we mentioned earlier – proactive risk assessments, decommissioning obsolete rules, and automatic documentation of changes – mean that the burden of audit preparation is made much lighter for IT teams.
In conclusion, organizations should design their Zero Trust network model based on the way that their critical applications and data assets are used to drive the business. The approach I have described here ensures that organizations can roll out and manage a Zero Trust framework to protect, and accelerate their operations. The framework also improves communication and collaboration across IT groups and senior management, helping to ensure that infrastructure and security changes serve the evolving needs of the business – without introducing risk.