What is "Zero Trust" actually about? – AVANTEC

About the job

Zero Trust is not a technology or a solution that can be simply purchased ready-made from a manufacturer, but rather a framework or perhaps even more a philosophy. Zero Trust assumes that every connection, regardless of where it comes from and where it goes, must be identified and authenticated. That actually sounds reasonable, but when we look at "classic" network architectures, we almost always find so-called Trusted Zones.Classic Network SegmentationIn a classic on-premises network, we have the perimeter, usually with a DMZ, where external connections are terminated. The DMZ is separated from the remaining internal zones by a firewall. The internal zones themselves can also be isolated from each other by firewalls, but network traffic within a zone is usually quite open. Yes, there are also VLANs and VRFs within network zones that further isolate traffic, and sometimes network fabrics (e.g. spine-leaf switches) are used, which allow further isolation.MicrosegmentationBut Zero Trust goes much further in its approach. Every application that communicates with another application or a service should be authenticated before a connection is established. And only authorised connections are allowed at all. This is what is meant by microsegmentation. Here, the network traffic from one application to another is checked and only permitted if it is allowed according to a policy. First, an overall view of the application traffic is created, where it is discovered and visualised which application is connected to which services. Creating these policies is usually simplified today by machine learning. The resulting policy can also be manually refined or changed as needed. Even this first step, where the traffic between all applications and services is disclosed and visualised, is very valuable. But it is also the basis for microsegmentation itself, where traffic is then restricted only to the necessary connections.Zero Trust Network Access (ZTNA)But Zero Trust goes even further. User access is checked according to the same principles. An identity- and context-based access boundary is created in front of the applications. Even if a user is in the same network zone as an application, that does not mean they should have access to the application (or the host). They should not even be able to discover applications in the same zone. This removes exactly the visibility from a user that an attacker normally seeks. Zero Trust Network Access (ZTNA) is also called Software-Defined Perimeter (SDP). Both concepts limit a user’s access to applications and resources of an organisation and only allow the connection if this access is permitted and needed according to existing policies.Why is Zero Trust needed?Nowadays, we assume that a motivated attacker can find a way into the company network. The idea that you can build the perimeter protection so well that no one gets through is no longer up to date. So if we assume that an unauthorised person is already in the network, we want to ensure that they have difficulty accessing further systems. A brief digression here: How do attacks actually work? An attacker can gain access to an account or an endpoint of a legitimate user by means of a brute-force attack, credential stuffing, phishing, or the use of malware. Once they are in the network, they usually perform an enumeration using tools. This involves finding out information about usernames, groups, shares, services, and servers. Classic network scans are avoided as they are usually quite easy to identify. With this information, they try to get to other systems. This is called "lateral movement." An attacker tries to get to endpoints and servers of higher privileged users to possibly gain access to an AD (Active Directory) or similarly central systems. If they have enough privileges, they can create user accounts, enable access via VPN, manipulate the IdP, read emails, etc. From a Zero Trust perspective, we want to make these "lateral movements" difficult or even impossible for an attacker. The so-called blast radius should be kept as small as possible. A user account of an employee in the HR environment only has access to HR applications. They may have access to an HR SharePoint, but nothing else. If an attacker wants to misuse this user’s account, they have only a very limited list of potential attack targets (the blast radius is small).In practiceIs such a Zero Trust approach even feasible? Does usability not suffer from all these restrictions? You cannot introduce Zero Trust overnight. As is often the case, it is best to proceed step by step. A good start is to get an overview of the applications – visibility of which applications communicate with which applications and services. Then you can start protecting the most important systems first by identifying the so-called "crown jewels" and their dependencies and then "microsegmenting." At the same time, at the other end of the spectrum, a ZTNA solution can be implemented to have much better control over which applications an external user has access to at all. This can then also be extended to internal users. Likewise, microsegmentation can gradually cover and secure more and more systems. Microsegmentation projects are much faster than classic network segmentation projects, which usually take at least six to twelve months. Obviously, this depends on the size and complexity of the network. But microsegmentation can often be up and running in one to two months, and even larger networks can be converted in three months.SummaryZero Trust is more a concept than a ready-made solution. However, it definitely makes sense for most companies to at least engage with the Zero Trust approach. How easy is it for an attacker to move further once they have taken over a user account? How large is the blast radius? How large is the attack surface? How widespread is the use of highly privileged accounts? Is a Network Detection & Response (NDR) solution in use? Depending on how these questions are answered, it is worth talking about Zero Trust.The article What is "Zero Trust" actually about? first appeared on Tec-Bite.