Zero Trust Architecture: Securing the expanding edges of networks

ZTA is based on the proposition of "never assume, always authenticate. This protects modern environments and enables digital transformation.

The pandemic altered our working practices in profound and far-reaching ways. Some people became remote workers right away, navigating the challenges of balancing their home and work lives. Others continued to report to work, despite a slew of concerns ranging from safety to new demands and ways of working. New technologies, protocols (such as keeping our distance), were implemented.

Due to remote working companies became more susceptible to security breaches. The traditional security approach like perimeter based network security wasn’t working in this context. Traditional security approaches are based on the old idea that everything within an organization's network should be implicitly trusted, that’s when Fulcrum Digital gave rise to Zero Trust Architecture.

Amidst the large scale digital transformation that took place, corporates are increasingly storing data in the cloud and allowing employees to connect to the network remotely, exposing this traditional strategy as a business risk. Zero Trust Architecture (ZTA) is the solution that helps users to authenticate their identity each time they access a network application or data.

ZTA is a cybersecurity strategy that protects an enterprise by removing the implicit trust of each user and device attempting to connect to the network or access the company's resources and continuously validating at every stage of a digital connection. It is a set of guiding principles for workflow, system design, security controls, and operations that can be applied to any segmentation or sensitivity level to improve security posture.

ZTA is based on the proposition of "never assume, always authenticate. This protects modern environments and enables digital transformation by utilizing robust authentication methods, network segmentation, lateral movement prevention, advanced threat prevention, and simplified granular, "least access" policies.

As hybrid work styles become the new normal, data will continue to be distributed across on-premises, cloud, and hybrid systems. To further their commitment to operating as a zero-trust network, IT administrators must implement a data-centric security strategy.

All businesses should use ZTA for network design and implement certain basic network connectivity assumptions, such as enterprise-owned resources using non-owned network infrastructure (e.g., public Wi-Fi or public cloud providers).

In an organization, a ZTA deployment is made up of several logical components:

Secure Data & Network: A professional medium of communication, regardless of network location, is secure. Access requests and communication from assets on enterprise-owned network infrastructure (such as within a traditional network perimeter) must comply with the same security standards as requests and communication from any other non-enterprise-owned network. The trust should not be granted simply because a device is connected to a corporate network.



Monitoring and Incident Response: Access should also be restricted to only the permissions required to complete the task. To implement enhanced identity governance-based techniques, enterprises typically use an open network architecture or an enterprise network with guest access or a large number of non-enterprise devices on the network. Initially, all assets are granted network access, but access to enterprise resources is restricted to identities with the appropriate access entitlements. Allowing direct network access has the disadvantage of allowing bad actors to conduct network reconnaissance and use the network to perform denial-of-service attacks, either internally or against a third party. Businesses must continue to monitor and respond to such behaviour before it has an impact on processes.

Determined attackers are doing everything in their means to stay one step ahead of security solutions and, will change their tactics in the face of Zero Trust Architecture. Another possibility is that in a hybrid ZTA/perimeter-based organisation, attackers will focus on business operations that have not been subjected to ZTA principles (i.e., those that adhere to traditional network perimeter-based security)—in other words, they will go for the low-hanging fruit.

Zero trust is still being developed as a strategy for corporate infrastructure design and deployment. To characterize Zero Trust Architecture components and processes, the industry has yet to agree on a single set of instructions or principles.

Organizations must develop comprehensive information security and resilience measures for zero trust in order to succeed.

The author is Vaibhav Tare, CISO, Fulcrum Digital