Never Trust, always Verify, and again Re-Verify!!!
The global pandemic has changed the way we look at technology and business requirements. Everything is now moving to a cloud right from the way we work, access to data and business-critical applications. Compared to the traditional IT grid, organizations used to dump everything into a single data center. Security was implemented in the form of DiD (Defense in Depth), with physical control, access control, and various other security measures to secure data and infrastructure, making it hard for the external network to access while trusting everyone inside the network.
But today, with the technology shift, most corporate data resides in/transits public clouds and the internet, ensuring resources tagged with “Always Available” to all their employees. Hindrances like employees misusing workstations/laptops by downloading unwanted applications, compromising data, accessing unauthorized data, intentional data theft by disgruntled employees, poor configurations, and other activities can disrupt the overall business function.
Perimeter security becomes less effective in such scenarios, so cybersecurity leaders must fundamentally rethink their security architecture and ensure optimal security is achieved across the network, be it On-Prem or Cloud. Trusting no users/devices/application connected to the enterprise network and access to critical business data & applications is granted upon verification. Implementing the Zero-Trust model integrated with an existing model has become the need of the hour than ever before.
‘Thanks to Forrester for introducing the concept of the Zero-Trust model with the principle of ‘never trust always verify’.Â
So, what is Zero Trust Security, and why is it crucial for an organization? Zero-Trust is a security model that eliminates trust to protect the organization networks, applications, and data. It requires a stringent identity confirmation of every person and device trying to access the resources, whether within the network or outside the network. When the identity is combined with security, it increases the overall security posture and reduces organizational cost.
Since most organizations are moving their applications and infrastructure to the cloud, it is often cost-effective compared to the applications hosted in a data center. Cloud service providers and SaaS-based vendors commonly operate these cloud environments. These cloud service providers are neither part of the organization’s network nor have security controls defined. As a result, organizations find it hard to figure out who is accessing what applications, the user’s location, and how they are using the data. Various security technologies are used to safeguard the data or applications in the cloud, but every technology has its own limitations. For instance, remote VPNs are being implemented along with user identification or authorization. However, if the attacker compromises the user’s VPN by a known vulnerability, it would be a huge setback for the enterprises.
As per Gartner, by 2023, 60% of enterprises will phase out most of their remote access VPNs, favoring Zero-Trust Model.
Cloud Environments are totally divergent compared to the traditional on-prem, which changes continuously. So, an organization’s approach to security must be wide-ranging and flexible. Hence, it is very much important to implement Zero-Trust into the world of cloud environments.
Implementing Zero-Trust would be highly beneficial for your organization, increasing the verification level by detecting suspicious activities like Phishing e-mails, external attacks, stolen credentials, privilege escalations, lateral movements between the organization’s network and more.
Now let us look at how Zero-Trust Security can be implemented through these full-proof eight steps.Â
1.Principle of Least Privilege (PoLP): Authorizing access to the resources only when needed for the users in an organization will help reduce the attack surface area. This will prevent unauthorized access to the data and services, thereby making the controls more granular and achieving Zero-Trust.
2.Data Classification and Discovery: Organization to understand the criticality of the data.
- how it is classified and tagged
- Where does the data reside?
- Who are permissible to access the data?
The organization should implement Data Loss Prevention (DLP) by classifying the data and necessary labelling based on the business requirements to create a trusted zone.
3.Identity and Access Management: Since the Zero-Trust model indicates that organizations should not trust anyone, it is crucial to verify before authorization. Organizations need to regulate and automate identity and access management to ensure access to the resources is granted to the right people/devices.
4.Multi-Factor Authentication: Implementing Multi-Factor Authentication replicates the principle of Zero-Trust Security. User authentication must have two or more verification factors before granting access to organization resources.
5.Encryption: An organization’s mission-critical data, backups and databases are the most important and mandatory needs. Encrypting these would increase the security level and reduce the risk of the data getting compromised or hacked. Data must be encrypted, whether on transit or at rest, with a robust encryption algorithm favorable for accomplishing zero-trust security.
6.Micro-Segmentation: Breaking the organization’s network into multiple zones and not allowing to access other zones without authorizations is termed micro-segmentation. Each zone in the cloud world must be split into multiple VPC’s and separate authorizations to be configured if the user wants to access one VPC to other VPC’s. This prevents the attackers, regardless of the environment, to move laterally from a compromised system using unauthorized connections.
7.Continuous Monitoring and Logging: Organizations should invest in constant monitoring and logging to identify malicious activities and behaviors. Using advanced technologies like Artificial Intelligence (AI) and Machine Learning (ML) will simplify analyzing and correlating different data bulk logs data. Thereby alerts when any suspicious activities found and mitigate them by taking appropriate actions that would further safeguard the environment from external or internal attacks.
8.Security Orchestration and Automated Response: Organizations nowadays are shifting towards orchestration and automation to reduce the response time, eliminating the repetitive and mundane tasks performed by the analyst, and automating the remediations to achieve Zero-Trust Security. So, enterprises should revisit their security technologies eliminating the needless and meeting the technology needs by integrating the existing tools and systems with SOAR (Security Orchestration Automation and Response), thereby automating identified and known vulnerabilities by defining the workflows or playbooks.
Way Ahead!
Sketching out a plan for Zero-Trust Security is very easy. Though implementation of the same is a little complicated and time-consuming, it is worth the efforts. Organizations should take an incremental approach to revisit the existing architecture carefully by planning the identity verification, authentication, and authorization measures. Investing in useful tools and automation aligned to business objectives can help demonstrate Zero-Trust Security’s effectiveness and increase stakeholder’s acceptance and confidence.
has over 13+ years of experience in IT Security transversely manifold domains like Cloud Security, Infrastructure Security and Cyber Security Practice. He is a Senior Practice Manager and currently part of Infrastructure Management and Security Services business unit of Happiest Minds Technologies Pvt Ltd. He is predominantly responsible for designing and implementing multiple Technologies spanning Cloud, and On-Prem focused on Security.
