Recently I gave a talk on Zero Trust Model at SACON Conference in Bangalore, India. I have written a small write-up around Zero Trust model and architecture.
Zero Trust has become the new buzzword in the industry. Everyone is talking about it and most of the people are unsure about how to implement and attain the same. Leadership is demanding zero trust architecture in the organisation and the pressure is only increasing. So, it’s vitally important to understand what Zero Trust is, as well as what Zero Trust isn’t.
With this article, I am sharing my perspective on zero trust, what I have understood of it by working on different technologies, reading from various blogs and articles on the internet and learning from leaders like Mr. Sunil Varkey.
To start with, in conventional security models we assumed that good guys are inside the protective cover of firewall and bad guys outside. Like the castle below is protected with walls, a moat which is deep filled with water and crocodiles to provide it with a preliminary line of defence.
Source: Pinterest
Conventional network security architecture breaks a network into different zones like internal, external or DMZ. Every zone has some level of trust which inturn determines the network resource access or permissions. \
Source:- O’reilly
Under this model, it is assumed that the Organization is safe, and no one can get inside thanks to the presence of so many layers of defences. In this process, the insider threats are ignored. However, this approach lacks the depth and breadth required for the ever-changing technology.
● Can we trust a client?
● Can we trust a server?
● Can we trust a network?
These questions keep popping up and we realize that these questions will keep coming up with the kind of breaches we have seen, or we are seeing.
Time and again it’s proven, we can’t trust anything or anyone, be it client, server or network. But what do we do? Simply don’t trust or if we have to trust then verify, it’s like “trust but verify”.
Over the years, we have seen the advancements in the security models. First access control lists (ACLs), then role-based access controls (RBAC), and then principles of least privilege, these were all the rage and now Zero Trust.
The question to think is, why are we advancing the security models? There could be issues with the old models. The transition did not happen all of a sudden, over the years organisations faced issues and in the process of resolving issues, the security models evolved.
There have been few models that have evolved around Zero trust. Forester coined the term Zero trust in 2010. Later Google implemented Beyond corp in their internal environment in 2011. Gartner also came up with their own model Continuous Adaptive Risk and Trust Assessment (CARTA) in 2017.
With the new Zero Trust model, the first thing is authenticating and verify access to all resources. When a user tries to access a resource, we need to verify that identity with strong authentication, ensure access is compliant and follows least privilege access principles. We need to grant the level of access a user needs based on the access policy assigned. We should not be granting users access to a service unless the request is authorized against a policy. In short, only the right users need to have access to the right applications and data. E.g why a security person needs access to all environments or application development person needs access to the firewall.
For an organisation, Zero Trust can be used to gain visibility of all traffic – across user, device, location and application. We need to make sure we protect our internal or corporate applications too. If we don’t protect internal applications, we don’t know if we may have risk inside our premise, we can’t trust people who are present inside like our disgruntled employees or an outside malicious actor who has somehow gained internal entry etc.. Just like we can’t trust external users its the same
When it comes to Principles of Least Privilege, organization should always assume, the environment is hostile and internal users can cause issues.
- Either one of our employees could attack the internal environment.
- Or one of the employee account access might get compromised.
Logging and Monitoring is important for an organisation. Hacking is inevitable, attacks will happen. The systems will get compromised. As an organisation, we need to have an idea about the blast radius. This will give an idea as soon as the attack starts. It goes with the mantra; I cannot trust anything, and I need to monitor every single thing in my network. Log monitor and analyse all activities and take action.
Zero Trust is again the best fit for cloud as well because we can’t trust the public cloud. So, our environment will be built keeping the resilience in mind. People are going away from the VPN and connecting directly to the cloud. Everything should be encrypted which kind of contradict with the old traditional model. 100 percent encrypted communication is the way to go in the cloud environment. Encrypt data at rest, data in motion and at the edge. In order to remove trust from the network, we need to strengthen the devices and services for e.g if I am confident that the devices are secure upto a certain degree, then I can remove my trust from the network.
Recently someone asked, can we implement a zero-trust model at a single location? To answer the same, it is not applicable to a single location but to an entire environment. Zero Trust is an essential “perimeter-everywhere” world. Trust security is no longer just a concept. We can say “Identity is a new security perimeter”.
Slides from the conference:- https://www.slideshare.net/VandanaVerma24