Zero Trust Model - The Present Necessity

When I was preparing for CISSP 3 years back, a line from the book AIO guide - Shon Harris really made an impact on me. It goes like this “ There are only two people in the world I trust - You and I and I m not so sure about you.” This statement summaries the entire zero trust model, I presume.

Given the current situation, a lot of organizations have enabled remote access for its employees. The remote access when enabled has increased the attack surface for the hackers. In this blog post, we will learn about the zero trust architecture and why it is essential to enable zero trust for everyone including the CEO of the organization. 

What is Zero Trust?

Simple terms - No trust in anyone. Everyone has to prove themselves via the identity verification whether the person is operating from the office or the comfort of his/ her home. Zero Trust is not about making a system trusted, but instead about eliminating trust.

The term ‘zero trust’ was coined by an analyst at Forrester Research Inc. in 2010 when the model for the concept was first presented. A few years later, Google announced that they had implemented zero trust security in its network, which led to a growing interest in adoption within the tech community.

Zero trust is not a product or a service, it is an approach to security. An approach to ensure that you ALWAYS verify before trusting. The verification should not be limited to users only. It has to extend to all devices, networks, servers, applications and even data. 

Before we deep dive further into this approach, let’s understand the castle and moat mentality.

The Castle & Moat - Traditional IT Security

The traditional IT security works as the castle and the moat. The untrusted are out on the moat while the trusted people are inside. Well, you can easily deduce that, in castle-and-moat security, it is hard to obtain access from outside the network, but everyone inside the network is trusted by default. The

problem with this approach is that once an attacker gains access to the network, they have free reign over everything inside. This concept is responsible for a lot of data breaches around the world.

Add to this vulnerable model, dollops of data residing in multiple devices and places - cloud, data centre, applications etc. which is further spread across with multiple vendors across the globe. 

The zero trust model brings equality to the picture. Whether you are inside the castle or on the moat, you need to verify yourself first to gain trust. Essentially, Zero Trust is about protecting data by limiting access to it. An organization will not automatically trust anyone or anything, whether inside or outside the network perimeter. Instead, the Zero Trust approach requires verification for every person, device, account, etc. attempting to connect to the organization’s applications or systems before granting access.

Don’t scratch your head!!! Aren’t you wondering that there is a username password mechanism of identification and verification that has been deployed by your organization, along with 2FA implemented in some applications or networks?

To answer this confusion in your mind, you need to think about how you access your organization’s infrastructure. If you use a company-provided laptop and the moment you log in, you can access any server, application or cloud environment, it simply means that the organization trusts the device by which you are logging in and even you as the user who is logging from the device.

The Framework

Zero trust frameworks are used in some organizations and that too only in small pockets. If an organization uses zero trust, it has enabled only at the perimeter of the organization. Whatever exists inside the parameter is trusted and not questioned. Some organizations have enabled zero trust only for their critical data and applications and servers hosting such applications/data.

Given the current situation, every organization must move towards implementing this approach.

Is there a standard framework available? Is there an ISO standard that I can use? The unfortunate answer is NO. Even for writing this article, I could not find a single article that has not been written by the marketing department of an organization trying to sell its version as the foolproof mechanism of implementing zero trust model.

After some Googling about Zero trust, I found a research paper - https://storage.googleapis.com/pub-tools-public-publication-data/pdf/43231.pdf which is a research paper on rethinking the traditional IT security and moving towards zero trust. Google is one such organization that has moved in this direction. Its BeyondCorp program, which Google began developing more than six years ago, demonstrates a security model that: 

• Securely identifies the device

• Securely identifies the user

• Removes Trust from the network

• Implements an inventory based access control. 

 

BeyondCorp began as an internal Google initiative to enable every employee to work from untrusted networks without the use of a VPN. BeyondCorp is used by most Googlers every day, to provide user- and device-based authentication and authorization for Google's core infrastructure.

BeyondCorp is Google's implementation of the zero trust security model that builds upon eight years of building zero trust networks at Google, combined with ideas and best practices from the community. By shifting access controls from the network perimeter to individual users and devices, BeyondCorp allows employees, contractors, and other users to work more securely from virtually any location without the need for a traditional VPN.

High-level components of BeyondCorp: Single sign-on, access proxy, access control engine, user inventory, device inventory, security policy, and trust repository.

BeyondCorp principles

1. Connecting from a particular network must not determine which services you can access.
2. Access to services is granted based on what we know about you and your device.
3. All-access to services must be authenticated, authorized, and encrypted.

This is Google’s vision and they have been quite successful in implementing it. 

Implementation Approach 

Post studying the research papers available in this domain, I present the following implementation approach for a zero-trust model. The approach needs to be customised for your organization. 

1. Identify your assets 
2. Identify your users
3. Identify the protect surface
4. Setup Authentication mechanisms
5. Verify every access attempt
6. Implement access verification at every small interval.
7. Implement zero-trust policies on network
8. Monitor all users, devices and networks.

It is important to note that a Zero Trust Framework doesn’t have to be disruptive to employees’ normal work processes, even though they (and their devices) are being scrutinized for access verification. Some of those processes can be in the background where users don’t see them at all.

What are your thoughts on this approach?