Zero Trust has been around for almost a decade. what it actually means, and how to extend it to cloud environments.
The term "Zero Trust" has been around for almost 10 years, but it has recently picked up momentum as businesses look to proactively protect their data and infrastructure. With the shift to the cloud, Zero Trust is now a philosophy of choice for CIOs and CISOs tasked with protecting their systems from outside attacks as well as from within the organization.
Traditionally, network admins only needed to worry about protecting their organizations from outside threats. But the threat landscape has evolved. From zero-day malware to insider threats, network admins must now proactively protect networks and data to avoid breaches. With this evolution, the Zero Trust philosophy was born.
Zero Trust is based on the belief that trust should not be given to anyone or anything, no matter if they are within the network or outside. This "never trust, always verify" approach enforces least-privileged access in which, once users are authenticated and identified, continuous inspection is implemented on the traffic while the user is connected to the network. According to the 2019 Verizon Data Breach Investigations Report, 29% of hacking-related breaches still involve compromised and weak credentials.
To fully implement a Zero Trust approach, the following must be considered: Segmentation. ensure only known, allowed traffic or legitimate application communication is allowed, by segmenting and enabling Layer 7 policy. Access Control. adopt a least-privileged access strategy and strictly enforce access control. Threat Prevention, Investigation and Response. inspect and log all traffic to quickly identify, prevent, and respond to threats.
As the popularity of SaaS applications and public cloud offerings has grown, so has the complexity of maintaining security and control over the data, traffic, and users accessing the cloud. Zero Trust in the cloud requires complete visibility into the cloud apps, the data being stored, and who is accessing the data.
To extend Zero Trust to the cloud requires security delivered from the cloud. Security from the cloud allows for policy enforcement, better protection, and visibility into all internet traffic. By having users and offices connect directly to the cloud instead of first going through headquarters or firewalls, your network and cloud architecture is simplified, and your overall attack vector is minimized.
Use cases where Zero Trust in the cloud can be applied include: Zero Trust for Private Apps in the Public Cloud, where managed or unmanaged devices need strict policy enforcement allowing access to necessary apps per user role while maintaining security and protection; and Zero Trust for SaaS applications, where consistent security policy must follow the user regardless of device or location.
If you're working on something worth talking about, reach out.