Zero Trust Visibility: Why Access Controls Need Continuous Validation
Keysight's Greg Copeland argues that zero trust needs visibility tools such as asset discovery, traffic monitoring and attack simulation, not just access controls.
Cybersecurity vendors like to talk about Zero Trust Architecture (ZTA), yet no single product delivers it, says Greg Copeland, director of technical alliances at Keysight Technologies. In his account, ZTA is a set of many parts which, combined, amount to a new way of approaching security. That approach suits a period in which a company's operations no longer sit inside a clearly defined and trusted perimeter, as is the case with remote working and cloud environments. For readers who want the detail, he points to the thorough ZTA publication produced by the National Institute of Standards and Technology (NIST).
From a fixed perimeter to protecting resources
Copeland traces the idea of Zero Trust to trends such as bring your own device, and to cloud assets that live outside any boundary the enterprise owns. The architecture shifts defences away from static perimeters defined by the network and concentrates them on users, assets and resources. An asset or user account receives no implicit trust just because of where it physically sits or who owns it. Authentication and authorisation happen before any session with an enterprise resource begins, and the main aim is to protect resources (assets, services, workflows, accounts and so on) instead of network segments.
In the traditional corporate IT set-up, he explains, the edge of the network was guarded at a small number of points by technologies such as firewalls, a boundary now sometimes called "North-South". That clear perimeter is disappearing, because the pandemic sent more staff to work from home and because remote and cloud access were already growing before it. Perimeter firewalls still matter, in his view, but on their own they fall short in infrastructure that is distributed, dynamic and more and more defined by software. Where an asset sits on the network is no longer grounds for trusting it.
ZTA adds components that secure the space inside the perimeter, sometimes called the "East-West" or internal domain, and anywhere else application resources are reached, such as the cloud. These components govern access to resources. Copeland lists identity authentication, authorisation and privilege management, policy enforcement points (PEPs), micro-segmentation and implicit trust zones, software-defined perimeters and compliance. Micro-segmentation and similar controls can be achieved with dedicated PEPs or with specially configured hardware or software such as next-generation firewalls (NGFWs), which protect traffic between internal resources. Put simply, the control components decide who may reach which resources, wherever those resources happen to be.
The visibility half of Zero Trust
Alongside access control, ZTA includes components whose purpose is to confirm that security works: asset discovery, network traffic monitoring, threat feeds, and continuous diagnostics and mitigation. Their role is to check that the controls really do secure access in the intended way. Copeland groups these under the label he uses for them, "Zero Trust Visibility". He observes that they usually receive less attention than the control components, although he regards them as every bit as important.
Policy enforcement, for example, relies on knowing which resources need controlling. New and unknown assets will keep appearing, some malicious and some not, so discovery mechanisms are required to establish what must be secured in the first place. Detecting and responding to threats across both known assets and ones nobody knew about is critical, he says, and network traffic monitoring, threat feeds, logging and metadata analysis are central to doing it. Supporting capabilities such as decryption also count.
A second example is the need to keep validating the security controls between endpoints so that possible breaches come to light. Breach and attack simulation, an emerging technique, safely stages attacks between endpoints and reports which of them get through and which are stopped. Those reports can then be used to tune the control components, for instance the rules for software-defined micro-segmentation, the configuration of policy enforcement, and identity and privilege authorisation.
Copeland describes ZTA as a wide paradigm for which no single answer fits every case. Making it work, he argues, takes a mixed approach that combines security controls with visibility components, while additions such as breach and attack simulation and continuous validation reduce risk and get an organisation ready for security breaches.