A key tenet of Zero Trust or least privilege is to assume breach. This mindset moves away from relying on perimeter-centric security models, discontinuing the widespread use of policies that allow automatic access or connections for any resource – internal or external. There is no trusted perimeter. No device, user, nor application can be trusted and must therefore only have least-privilege access.
The main objective of a Zero Trust architecture is to address the lateral movement problem. Lateral movement is an attack technique often used in advanced persistent threat (APT) campaigns where bad actors implement a variety of known tactics to compromise an organization’s perimeter defenses. The bad actor then explores the network to find weaknesses, gain higher privileges, and eventually acquire access to critical applications, like payment systems or customer data. At that point they exfiltrate the data from the network and into their full control. The initial breach is never the primary target, but is the gateway to reach the main goal: your company’s digital crown jewels.
Ransomware worms like NotPetya and WannaCry also use lateral movement to rapidly propagate across endpoints and into data center workloads. Applying Zero Trust micro-segmentation limits the worm’s ability to spread across endpoints and into the corporate network.
Why is this especially relevant today? The recent mass transition to remote work operating models among companies, where employees and devices are communicating with critical applications from their home networks using company-issued and personal machines (BYOD), underscores the need to treat all communications as untrusted, be it endpoint to endpoint, user/endpoint to data center and cloud, and workload to workload.
So it is clear that the use of micro-segmentation to address the lateral movement problem is no longer just focused on east-west traffic behind the perimeter, meaning data center and cloud connections, but now also extends to peer-to-peer connections across endpoints and to connections between remote users/machines to data center applications.
Zero Trust Architecture: Functionality and Design Considerations
Forrester Research developed the Zero Trust Extended Framework to help companies plan a Zero Trust strategy and design the Zero Trust architecture that best fits their needs. It also developed the Zero Trust Maturity Model (subscription required) and a self-assessment tool (subscription required) which companies can use to gauge their maturity, identify gaps in their capabilities, and plan the architecture and roadmap for deploying the relevant security technologies.
For companies that are in the early stages of their Zero Trust journey, identifying the vendors that are the best fit for operationalizing their plans can be a bit confusing. If you run a Google search, the first two pages of the organic search results on “Zero Trust” offer a broad range of security technologies including next generation firewalls (NGFW), networking, software-defined perimeter, data security, identity, authentication and access governance, data loss prevention (DLP), CASB, and web security.
In May, Forrester Research also published the report Now Tech: Zero Trust Solution Providers, Q2 2020 (subscription required). This document provides an overview of 38 leading Zero Trust vendors. It also offers security and risk management professionals advice on planning their ZT architecture and selecting the relevant vendor solutions. The report breaks the market into two functionality segments for Zero Trust solutions.
Zero Trust Functionality Segments
- A Zero Trust platform allows firms to leverage other security tooling and applications. A Zero Trust platform is a group of technologies used as a base upon which other security tooling, applications, processes, or technologies are leveraged. A firm can use solutions in this sector as a singular tool or a subset of technologies that operate collaboratively to enable significant sections of a Zero Trust strategy.
- A Zero Trust pillar is best-of-breed singular tooling that solves specific problems. Solutions in this segment are functionally best-of-breed solutions that address pressing, but singular, security use cases. Organizations can plug these solutions into Zero Trust platforms via APIs and other means but can also leverage them on their own to solve specific technical problems.
Why Should You Consider a Zero Trust Platform to Enable Your Strategy?
Here are the reasons why a Zero Trust approach with Illumio is a smart choice for enabling your strategy:
- An agile response to black swan events. Our customers typically start designing their ZT architecture by focusing on one of their top 10 critical applications and a pillar. For example, using micro-segmentation to ringfence their PCI applications. This focused approach is practical and achievable since the customer avoids having to implement multiple controls across various products. However, black swan events, like a global pandemic, may force companies to reassess their priorities and address multiple ZT pillars concurrently.
The transition to a remote work operating model upended the loose separation of solutions that secure the internal traffic from solutions that secure the edge. Instead of looking at lateral movement attacks in the context of data center and public cloud network traffic (your east-west traffic), you’ll also need to expand this lens to include your assets and connections at the edge. Let’s look at PCI DSS, for example. Activities that were previously conducted within trusted network environments, such as the maintenance and support of POS systems and payment processing, are now being done remotely from employees’ less secure home networks. In these scenarios, identifying the upstream and downstream dependencies of your PCI-connected system would mean extending that visibility and control to the edge of your network. Your endpoints are the focal point where you micro-segment connections between peer-to-peer applications and between end-users and data center applications. A Zero Trust approach with Illumio will allow you to scale and minimize the risk from policy conflicts.
- API integrations with a vast ecosystem of third-party IT operations, analytics, and security tools. Zero Trust requires continuous verification of trust with the various Zero Trust-enabling technologies, and the automation of cross-functional processes to help maintain a ZT posture. A platform, by definition, delivers efficiencies through connections to external tools and processes. Even if there was no sudden shift in global business operating models, analytics, automation, REST-API integration, and orchestration are critical to supporting multi-cloud or hybrid cloud environments. Illumio ASP’s ecosystem of API-based integrations with tools that enable security in other pillars and with IT ops and CI/CD tools help automate and orchestrate IT and security processes such as security provisioning, monitoring, patch management, threat detection, and incident response.
- Micro-segmentation that scales and supports future-state of the Zero Trust architecture. Illumio ASP secures customers that have multi-cloud or hybrid cloud environments that are scattered across multiple global regions and availability zones. The PCE Supercluster configuration allows for centralized policy management at scale. Our customers are also adopting cloud-native technologies like containers where micro-segmentation is provisioned at “birth” while continuing with micro-segmentation in their legacy environments. They are also using Illumio Edge to contain the spread of ransomware between endpoints.
If you’d like to find out more about Illumio’s approach to Zero Trust, check out our solutions page.