A zero-trust approach to security, as the name implies, means that no user or application is inherently trusted. All access must be verified before permission is granted. A zero-trust approach relies on the principle of least privilege and microsegmentation of resources to limit access to just what is needed for the work being done. Behavior is monitored during the session as well, and access may be revoked if suspicious behavior is identified. Zero trust becomes particularly important in the cloud where there is no physical perimeter to define in-network traffic as inherently safe. According to Zscaler’s Adopting Zero-Trust Strategies Report, 82% of organizations anticipated increasing their spending on zero trust over the next 12-18 months.
While zero trust has numerous benefits, implementing a zero-trust policy in the cloud can be extremely challenging. In this post, we break down some of the benefits and impediments to implementing key elements of a zero-trust strategy.
Segmentation
Segmentation of resources is one of the essential tenets of a zero-trust approach. Segmenting resources is beneficial in an attempted attack as a threat actor gaining access to one segment of the network will not guarantee access to the entirety of the company’s assets. This segmentation can get as granular as segmenting down to the individual workload in the cloud. While this has the advantage of restricting a potential attacker’s lateral mobility, it also introduces a high risk of denying legitimate traffic, particularly in a hybrid cloud environment, where parts of an application may be spread out across clouds.
In order to effectively segment your network, you have to map your application’s dependencies and fully understand what apps are relying on communication with each other, otherwise you risk breaking or significantly slowing down usage for employees or customers. Organizations attempting to begin segmentation also need to be able to prioritize the information that is truly critical. If you don’t have the resources to completely microsegment, starting with the most valuable data can be a good way to at least add extra protection to the most mission critical elements.
Privileged Access Management
Another presumption of a zero-trust policy is that only users with the clearance to access sensitive data will be allowed to access it. PAM goes hand-in-hand with segmentation, as users are granted privileged access to specific segments of the network. In order to implement a privileged access policy however, your architecture must actually be able to support it. One of the biggest challenges enterprises who are attempting to transition to a policy of zero trust face, is that their legacy systems cannot support the changes they would like to make.
Zero trust is a lot easier to bake into a system from the ground up than it is to apply to already established architecture, designed for the traditional methods of approved internal network access, which may also include shared access accounts. Organizations may be intimidated by the scale of overhauling their network in the way required to successfully implement these policies, as it is time-consuming and costly. For organizations that can successfully implement PAM, however, there is less of a risk of a stolen credentials being used to access valuable resources, and security teams have increased visibility into user behavior, which can help in pinpointing the source of a breach.
Is Zero Trust Worth the Investment?
Zero trust is not something that can be achieved overnight by implementing one solution. It is a costly process that involves significant investment and an overhaul of your technology, which can make it a hard sell to leadership. It does however offer valuable benefits, the biggest of which is preventing threat actors from gaining access to critical resources and moving laterally through your network. Zero-trust policies can also provide visibility into user behavior, reduce likelihood of data exfiltration, and enable effective remote work. When getting started transitioning to a zero-trust mentality, there are smaller steps that can be taken such as implementing multi-factor authentication and segmenting your highest level, mission critical data, that can normalize the concept of zero trust for gradual implementation as buy-in increases.
However, successfully implementing a zero-trust policy is not a silver bullet for preventing an attacker from gaining access. If the resources you’re protecting have exploitable vulnerabilities or you’re not enforcing strong password policies, all of the work that you’ve put into segmentation may be for naught. Similarly, a misconfiguration in your cloud may be exposing your sensitive data, despite the effort you’ve put into access management. Zero trust can be a valuable tool in your vulnerability management plan, when used in conjunction with other cloud best practices.
Learn more about zero trust in RH-ISAC’s recorded webinars, available exclusively to members on the Member Exchange. Not an RH-ISAC member? Learn more about how RH-ISAC membership can benefit you.
