Two great changes have happened in IT in the past years: cloud adoption and the transition to remote work. Each of these changes has required IT and DevOps teams to shift their perspectives and adopt new methodologies and technologies. But these changes have also impacted the state of cybersecurity. Organizations are now vulnerable to new types of cyberattacks. Ransomware attacks, for example, doubled in frequency in 2021, and ransom demands were the highest ever to be demanded, sometimes reaching tens of millions per attack.
These IT and security earthquakes require a new cybersecurity way of thinking. To many, that new way is zero trust. According to Forrester:
Zero Trust is an information security model that denies access to applications and data by default. Threat prevention is achieved by only granting access to networks and workloads utilizing policy informed by continuous, contextual, risk-based verification across users and their associated devices. Zero Trust advocates these three core principles: All entities are untrusted by default; least privilege access is enforced; and comprehensive security monitoring is implemented.
Since zero trust is a concept and not a set of instructions to follow, different companies and firms have interpreted it in different ways. Here, we will focus on its “least privilege” component, which is the linchpin of zero trust. At the end, we will provide an actionable set of steps for getting started on how to apply this concept to your cloud security solution.
What is Zero Trust?
Zero trust is a security framework that enhances organizational security by eliminating implicit trust and continuously authenticating, authorizing and validating users before granting them – or allowing them to maintain – access to applications and data. Zero trust is based on the principle of “never trust, always verify,” which means: no user is trustworthy until verified.
Zero trust was designed as a security approach for modern networks. Unlike zero trust, traditional security approaches rely on implicit trust given inside networks. This means that users who made it into the network’s (often physical) perimeter, for example, past the firewall or through a VPN, can move laterally and access sensitive data quite freely.
But remote work, cloud migration and global expansion have made networks more complex, dispersed and vulnerable than ever. Therefore, a legacy approach is no longer sufficient for protecting organizations from advanced security threats, like ransomware. Zero trust addresses this gap by ensuring that users (including attackers) cannot access sensitive data or even see which applications exist in the network – before they are verified.
Zero Trust and Least Privilege
As mentioned above, “least privilege” is a cornerstone of “zero trust”. While the two terms are often used interchangeably, they are not exactly the same thing.
Least privilege is about restricting the access and permissions users and entities have to the resources they need, and only to the resources they need, to perform their work. Other resources are not accessible to them. This restrictive approach ensures that (a) users will not accidentally leak sensitive data and (b) a malicious actor obtaining a certain user’s access capabilities is limited in how much the actor can progress laterally and cause damage.
In other words, least privilege is how one can execute on zero trust. Other ways to execute zero trust include:
- Just-in-Time (JIT) access – giving permissions to users for a limited period of time and only the time they need to perform their work.
- Monitoring – tracking user activity to catch suspicious activity and investigate past events
- Policy management – the rules that determine which user can access which resources
- And more
Why Zero Trust is Important
In modern architectures, which are typically built with multiple components spread across multiple global locations, security and IT management have become a major challenge (and headache) for teams. Zero trust provides a simplified security model that answers this challenge. Here’s how:
Zero Trust Prevents Compromised Credentials Risk
According to the Verizon DBIR 2021 report, 61% of breaches involved credentials. Compromised credentials put the organization at risk, since they allow the attacker to laterally progress in the network while posing as a legitimate user. One of the most famous compromised credential disasters was the Solarwinds attack, in which a compromised password enabled attackers to access thousands of organizations, including the US federal government and companies like Microsoft, Intel and Cisco.
But with zero trust, an attacker can only progress as far as the compromised credentials will take it. By authorizing users for each application and hiding the network from sight, zero trust significantly limits the blast radius of compromised credentials, preventing attackers from gaining free accessibility rein to the entire organizational network.
True Security in the Modern Era
The modern workplace no longer comprises groups of employees sitting physically at work in the same location. Rather, employees are geographically dispersed around the globe. Whether they are company employees working remotely, business partners who have different offices or a newly acquired company from another continent, geographical proximity can no longer be a factor when planning security.
In zero trust, the geographical location of the user is irrelevant. This is because zero trust does not rely on implicit trust for giving access – that is, a user does not have to be physically in the company network or connected to an insecure VPN from remote. Instead, each user is continuously verified, regardless of the network they are using and their location. This helps improve organizational security by reducing the risk of external network access.
Building Trust in Security Teams
Unfortunately, security teams are sometimes (unjustifiably) perceived as getting in the way of business progress. This is because they prevent employees from using certain tools or they add steps to working processes to ensure security.
Zero trust actually eliminates some of that security friction. Since zero trust verifies each user, employees no longer have to connect through VPNs or go through firewalls, and they are not restricted from accessing the apps they need when they work remotely. Rather, they can use their devices as is and connect to any app they need, to get their work done. This approach builds trust in security teams and encourages devops to cooperate with them, which also enhances an organization’s security posture.
Zero Trust Challenges
While gaining popularity, zero trust is still a concept, or strategy, not a method or a series of steps to follow. Putting theory into practice requires a lot of legwork, including mapping the organization’s computing, finding the right tools and solutions, convincing the leadership and board to switch the company’s security strategy, building all the policies and permissions, and more. This kind of switch is not easy, especially considering you probably have a lot on your security plate at the moment.
What can security and IT professionals do to get some quick “zero trust” wins?
How to Get Started with Zero Trust
We recommend taking a phased approach to zero trust. This means gradually switching the security model to zero trust, one step at a time. Since zero trust is about giving minimal permissions to users, the first step is to gain visibility into all identities in your cloud inventory and their access relationships across all data, compute and network resources in the environment.
A cloud solution that provides identity-based contextual visibility into permissions, alongside risk assessment, prioritization and remediation, and anomaly detection and compliance, can help find and fix any risky permissions, while providing governance into the process. This helps organizations adhere to zero trust principles immediately without having to go through a long zero trust implementation process. It can also be used continuously, to ensure least privilege is always enforced.
Conclusion
Zero trust is an ongoing process that organizations take on themselves to being more secure and building trust among their customers, employees and partners. While there is no textbook solution to achieving zero trust, there are changes that can be made immediately to your cloud computing that will advance you towards this goal and reduce the existing risk. Implementing an identity-focused cloud infrastructure security platform is one important strategic action, helping organizations take a few more steps in the zero trust direction.
