Why You Need to Move Beyond Traditional IT Architectures: The Case for Zero Trust Architecture

Traditional IT architectures built their security systems on the premise of “trust, but verify.” But today’s security perimeter has expanded exponentially with remote workforces, BYOD policies, and cloud-based solutions. As a result, the attack surface that hackers can exploit is so broad that the “trust, but verify” mantra is no longer tenable.

Moreover, organizations now deal with highly sophisticated attacks beyond the capacity of a single lone hacker. The cybercriminals they now face include well-financed and determined adversaries like rogue nation-states and organized crime syndicates.

Zero Trust security architecture grew out of the need to fortify modern digital environments more comprehensively.

What is zero trust security?

“Zero trust” is a paradigm shift from the traditional security model. It involves eliminating the concept of trust to prevent data breaches. It’s a security framework based on the negative premise that all network traffic, without exception, is malicious. Hence, its adopted slogan of “never trust, always verify.”

Flowing from the assumption that all traffic is compromised, its mode of operation is based on an identity-centric model that protects the expanded perimeter by granting no automatic trust to any asset, user, or resource.

Zero trust was popularized by John Kindervag in 2010 during his tenure as a senior analyst at Forrester Research. Kindervag realized that traditional IT architectures and security models were outdated because they were operating on outdated assumptions. Paramountly, its misplaced mindset that anything already inside the organization’s network should automatically be trusted.

Sounding the alarm that “times have changed,” Kindervag emphasized that enterprises “can’t think about trusted and untrusted users.” Hence, the only way to fix this broken trust model was to completely eliminate the concept or dichotomy of the trusted internal network and the untrusted external network.

Zero Trust was conceptualized to combat the torrent of insider-borne breaches resulting from the willy-nilly, lackadaisical access granted to users. Therefore, it operates from the concept that those within the network have already been compromised, mandating that nothing in the network should be trusted until validated against a list of known values.

How does zero-trust network architecture differ from traditional IT architectures?

Traditional IT architectures primarily focused on a “castle-and-moat” approach to security. This relied on strengthening the network perimeter to prevent unauthorized outsiders from accessing corporate data. Its major flaw, however, was implicitly trusting those already inside the network.

To compound the situation, technologies and processes like DevOps, IoT, and cloud systems have redefined and blurred the corporate perimeter as perceived by traditional IT architectures. Moreover, the threat landscape has become much more complex than Gartner’s 2020 projections when the research company forecasted enterprise and automotive IoT markets would grow to 5.8 billion endpoints.

As a result of this hyper-connected IT environment, the ubiquity of the modern technology ecosphere has become treacherous and difficult for corporate defenses to contain. Zero trust aims to tame this beast by narrowing the scope of cybersecurity defenses from overly wide network perimeters to micro-perimeters.

The zero trust architecture hinges on the creation of segmentation zones to control sensitive IT resources. The National Institute of Standards and Technology’s (NIST) guide for implementing Zero Trust architecture proposes having micro-perimeters around individual and small groups of resources.

False sense of security vs implicit distrust

Unlike traditional architectures, zero trust models grant no implicit trust. This approach is more aligned to the realities of cybersecurity, where even a simple, socially engineered phishing attack can compromise an entire system. Hence, zero trust eliminates the false sense of security provided by traditional IT architectures.

The false sense of security is created by the illusion you can limit illicit network activity and breed trust through network connections and firewalls alone.

On the contrary, the zero trust model requires all on-site or remote devices, users, and applications to be continuously monitored, authenticated, and authorized to ensure utmost compliance before granting them access.

Pillars of zero trust architecture

A zero trust network access (ZTNA) is the main technology that operates this adaptive trust model: it does so by rejecting implicit trust but favoring granular policies that grant access on a “need-to-know,” least privilege basis.

The following constitute the pillars of the zero trust architecture:

A new network segmentation model

Zero trust jettisons the flat network structure and perimeter approach of traditional legacy VLAN segmentation. However, zero trust still leverages network segmentation to prevent lateral movement within the network. But it does it in such a way that promotes a deeper level of trust by determining who should and shouldn’t be allowed to connect to the network.

This is accomplished by defining an initial, inner-layer of zero-trust micro-perimeters, which act as segmentation zones around sensitive data. The micro-perimeter is nimble and moves with the protected surface wherever it goes.

An extension of this methodology is micro-segmentation. It also protects individual or group resources by locating them inside a unique network segment such as a gateway device or firewall. However, it must be noted that unlike traditional IT models, zero trust doesn’t depend on firewalls for its effectiveness.

Rather, zero trust incorporates identity governance (to prevent unauthorized access) for its effectiveness.

Identity access management

In zero trust, security now hinges on identity. In this security arrangement, identities are now the core component and new perimeter. This identity management follows these access guidelines:

• Never assume access: In zero trust, access is never assumed. Because standing privilege doesn’t exist, a privileged access manager is constantly evaluating contextual information such as the user agent’s job role, request history, peer permissions and a variety of other identifiers to decide whether or not to bestow access. Hence, the principle of least privileges and multi-factor authentication reign supreme.
• Time bound access: Undergirding zero trust is the idea that access to any resource is bound to a short lived session. In addition to granting least privileges for any given task, access is only provided for the amount of time necessary to complete the task. Hence, authentication and authorization are constantly required after a short period of time. This time-limited nature of zero trust thwarts attackers with stolen credentials or employees who have left the organization from gaining access to the system for any long period.

Inhibiting lateral movement

One of the difficult things to detect and contain when a breach occurs, even after an attacker’s entry point is identified, is lateral movement. Lateral movement is dangerous because it allows a hacker to compromise other parts of the system. But zero trust’s twin tools of network segmentation and time-limited access (which forces access to be re-established periodically) ensures the hacker can’t move to other microsegments, hence thwarting any lateral movement within the system.

Automation and orchestration:

Zero trust architecture is not a technology but a framework that requires constant work and effort. Embracing a zero trust policy therefore requires constant and real-time monitoring. This breadth of monitoring can be overwhelming for administrators, so there’s the need to enforce some heuristic-based rules and practices like:

• Embracing security analytics to monitor the zero trust environment in detail
• Continuous risk assessments requiring the embrace of adaptive responses through security automation
• Threat intelligence for advanced analysis and building a threat-driven security posture to protect the organization.

Automation and a well orchestrated policy enables organizations to be positioned to detect and catch illicit activity more quickly in their networks.

Zero Trust Architecture : Benefits and Use Cases

Organizations that have maintained traditional IT architectures for a long time might wonder whether zero trust is appropriate for their organization. Because of multiple endpoints, multiple SaaS configurations, and BYOD policies, virtually all organizations require zero trust architecture in the modern IT era.

So, any organization will benefit from moving away from implicit trust. But more specifically, zero trust will serve any organization that desires to mitigate risk in any of the following use cases:

• Limiting access to non-employee identities such as vendors, third-party contractors, and supply chains
• Securing and protecting globally distributed teams (remote worker and their connections)
• Isolating unsecured IoT devices
• Securing access across enterprise boundaries and subsidiaries
• Multi-cloud architecture and cloud to cloud connections

Benefits of implementing a zero-trust model

• Protects company data more comprehensively
• Provides increased control in a cloud environment
• Provides uniform security enforcement and compliance auditing
• Increased security and visibility into network traffic
• Drastically lowers the breach risk detection time

Why it’s important to move beyond traditional IT architecture to Zero Trust

The case for implementing zero trust architecture hasn’t been more urgent. According to IBM, the average cost of a data breach has now skyrocketed to $4.24 million. The false sense of security provided by traditional IT architectures is a major culprit in data breaches.

This is untenable and it must give way to a robust security framework that’s better aligned with the threats faced by today’s multifaceted systems.

We can help. The Launchpad partners with all of the major cybersecurity, IAM and zero trust partners to ensure your environment is protected and secure. Call us today for a quick chat, and we can find you the right partner for your specific needs and environment.