How it Works: Shrinking the Attack Surface
Decoupling access and connections shrinks the attack surface.
To understand the mechanics of a Zero Trust security model, consider the folly of giving users access to everything on a network when they require access to a single application. Traditional network security does just that. Once a user crosses the threshold and validates onto a network, that user often will have free access to poke and prod across a range of systems and applications.
Zero Trust decouples shared network access from the remote user connection, limiting a user’s access only to those applications that are necessary and authorized. Limiting access can be done through hardware solutions that use multiple firewalls to achieve micro-segmentation. The level of complexity required, however, can quickly bog down IT resources.
Taking a more elegant approach, implementing Zero Trust using an identity-aware proxy to manage access, provides app-level security and a seamless end user experience. Users experience for authorized apps is unchanged. They log on through a web portal and only see the apps they have access to with a single-sign on experience. When opening an app, instead of accessing it on the network, requests flow through the proxy, which investigates and monitors every request. The proxy is aware of identity and can implement least privilege so that users get only the necessary level of access. This provides you the ability to endure your most sensitive apps and date, such as human resources and financial, are out of reach and invisible to everyone except authorized users.
And even before those application-layer safeguards kick in, Zero Trust ensures that only legitimate users get access to applications. Controlling access begins with strong authentication and a layer of geofencing. Those safeguards ensure that a device is authorized to a particular user and that the connection is coming from an expected location. Zero Trust then applies a dynamic range of systems checks to ensure that software patches are current; that the device is running the most recent operating system; and that the browser does or doesn’t have known critical vulnerabilities.
In addition to validating the health and safety of the device, Zero Trust examines the user, validating name and password and confirming the presence of a layer of multifactor authentication or recognized client certificate.
Finally, Zero Trust validates end-users’ activities, tracking requests over time to ensure that user behavior aligns with security expectations, such as did the user log-in from New York at 5:00pm and then attempt to log-in from Sydney at 5:05pm?. Zero Trust vets requests to ensure that they make sense, aren’t syntactically malicious.
Validating device, users, and activity in an iterative way is more rigorous than the conventional name-and-password paradigm. The dynamic nature of today’s IT systems demands a robust security strategy.