Zero trust principles

Zero trust security is a philosophy and approach to security that requires IT leaders and employees to rethink the way they relate to cybersecurity. This approach assumes that a breach has already occurred, and threat actors have already penetrated the network—a premise which necessitates re-evaluation of the network architecture.

Many organizations use network infrastructures that have not yet embraced the concept of “assume breach.” Their focus is on preventing penetrations, or reacting to them when they occur. This makes it easy for attackers to practice lateral movement once already inside the network.

The zero trust security model is data-centric. It focuses less on IT’s physical infrastructure and more on the data transport method. The most important thing for cybercriminals is to gain access to digital assets, most of them represented as data. Therefore, it is important to protect where the data comes from, how it is transmitted, and where it is ultimately stored.

Zero trust enforces strict access controls and permissions. Users have access only to the digital assets they actually need. They can view and access only the infrastructure components that allow them to perform their assigned tasks. This is the risk-based, fine-grained access control that is at the basis of zero trust.

Understand the protected surface

A protected IT surface includes all users, data, services, and devices connected to an organization’s network. This includes the network’s backbone that provides a means of transporting sensitive data.

A key benefit of zero trust is that it solves the problem of protecting modern protective surfaces that reside outside firewalled networks and LANs. Traditional edge- and perimeter-based tools do not provide the security coverage of zero trust network architectures, so they are insufficient to protect external devices. 

Changes in data flow patterns are forcing security providers to offer security tools that protect data, devices, and applications beyond the edge of the corporate network. Automated asset and service inventory tools complement manual inventory processes. A hybrid approach allows security teams to prioritize the assets they need to protect.

Analyze how to use existing cybersecurity infrastructure

After mapping your protected surfaces, the next step is to consider all your organization’s existing cybersecurity tools. A zero trust strategy can be adapted to existing tools without investing in new technologies—in fact, research has shown that many of an organization’s existing tool sets can help create a zero trust architecture. 

When implementing zero trust security, network security architects can extend the capabilities of existing tools to analyze how they reach extended areas of IT security, such as cloud data centers and remote locations.

Use multiple preventative techniques

The zero trust model relies on a variety of preventive technologies to deter breaches and minimize damage:

• Identity protection and device discovery are at the heart of the zero trust model. Knowing which devices exist, what credentials each device has, and keeping credentials and devices auditable is the first step in zero trust. By understanding how these devices and credentials work and connect, organizations can enforce effective identity challenges and strengthen authentication for anomalies.
• Multi-factor authentication (MFA) is a popular method of verifying user identity and improving network security. MFA relies on two or more pieces of evidence to evaluate a user’s credibility: typically passwords and email/SMS verification. The number of authentication factors used by an organization is directly proportional to network security. 
• In addition, email security solutions, encryption, and cloud access security brokers can improve security for user credentials.

Apply zero trust policies

With the right security tools in place and adherence to other zero trust principles, organizations can easily implement a zero trust policy security framework. Because these policies control access to resources, they must clearly describe resources, access levels, permissions, user accounts, administrators, and other metadata.

Monitoring and alerting

Zero trust requires monitoring the activity of protected surfaces and utilizing appropriate alerting tools. These tools give security teams a better understanding of the effectiveness of their security policies, and whether attackers are exploiting vulnerabilities in the zero trust framework.

Even with a zero trust architecture, security is not perfect, requiring an ongoing effort to track suspicious behavior and identify malicious activity. The sooner your team detects a threat, the sooner it can be eliminated and damage minimized. It is also important to perform root cause analysis to identify and address deficiencies in existing security policies.

Distributed network security approaches such as zero trust can be challenging for a security administrator to properly monitor. However, modern cybersecurity monitoring tools leverage automation and artificial intelligence to reduce the burden. 

These tools include Network Detection and Response (NDR) and Security Orchestration, Automation and Response (SOAR), which can automatically identify the root cause of threats, provide remediation, and respond to security incidents.

Start by getting buy-in from the people who will benefit the most from a zero trust architecture. Together, plan the steps necessary to make zero trust an integral part of the organization’s security posture:

• Learn as much as possible about the organization—find out who works for your company and what access they have. Take inventory of your company’s IT assets like equipment and systems. Ultimately, you want a complete picture of your workloads and the connections they need to keep them running.
• Set security standards—consider the baseline of your current security capabilities and set goals for migrating different parts of your company’s infrastructure.
• Identify business priorities for a zero trust transition—during the planning phase, it is important to evaluate how important the workflow or service is to the organization and the role it plays in the overall goal of improving security.
• Perform a risk assessment—conduct risk assessments based on the performance of various processes and develop risk-based policies to bridge gaps.

Many companies start this process gradually by observing the effects of the change. For example, you can add strong authentication to the network, then set security controls on user devices, and later on deploy microsegmentation in the network.

In early stages of zero trust implementation, it is recommended to operate in report-only mode to see how the changes impact the network. This mode enables most access requests and helps evaluate the impact of proposed policies. When you have confidence, you can apply policies to actual production traffic.

Solo enables zero trust policy using a defense-in-depth approach, which can be applied to either API management at the edge, or within a microservices application environment using service mesh. 

Solo Gloo Platform, inclusive of Gloo Gateway (API-Gateway) and Gloo Mesh (Istio Service Mesh) both use Envoy proxy for the data plane, which means that consistent zero rust policies can be created and deployed across internal and/or external security boundaries and control points. This simplifies zero trust security and compliance across APIs and Kubernetes environments.  

Learn more about Solo zero trust security.