Part 1 : Zero Trust Network Access (ZTNA)

Overview

In a traditional security model assumes that everything on the inside of an organization’s network can be trusted, but given increased attack sophistication and insider threats, new security measures need to be taken to stop them from spreading once inside. Because traditional security models design to protect the perimeter, threats that get inside the network are left invisible, uninspected and free to morph and move wherever they choose to successfully extract sensitive, valuable business data.

10 years ago, the zero-trust model was created to improve application security. It seemed straight forward, ensure access to apps is always secure, that it’s based on least privilege and have visibility into all user activity. But network-centric technologies of the past made achieving zero trust security impossible, placing users on net, allowing access prior to authorization and limiting visibility to IP addresses and ports, not users. For a time, the model struggled to find a foothold within IT. Until now.

What is Zero trust network

1. App segmentation replaces network segmentation
2. Apps are never exposed to the Internet
3. Encrypted Tls-Tunnels become the new network
4. user experience is seamless from any device

Importance of Zero Trust Network

Zero Trust is taken from the principle of “never trust, always verify,” can achieve using micro segmentation by limiting the lateral movements between the network segments and only intended application access from outside. Applications will be invisible by default.

Trust security framework / Zero trust architecture helps you to prevent unauthorized access, contain breaches, and reduce the risk of an attacker’s lateral movement through your network.

Lateral movement defines different techniques that attackers use to move through a network in search of valuable assets and data. With traditional perimeter-based security, businesses can define sub-perimeters within their organization networks using a specific set of rules for each using context around user, application traffic direction, etc. These sub-perimeters are designed to identify the spread of an attack within an organization and stop the unrestricted lateral movement throughout the network. Remember, the point of infiltration of an attack is often not the target location, and thus the reason stopping lateral movement is so important.

For example, if an attacker infiltrates an endpoint, they may still need to move laterally throughout the environment to reach the data center where the targeted content resides, or if credential phishing is successfully used, those credentials should be authenticated against the database to reach the location of the data an attacker is seeking to extract.

Why Zero Trust Network?

1. Increased access to the internal resources since more users, devices and applications are accessing on our network from inside the network or from public network. how can you ensure that the right access is granted to each user?
2. Increased attack surface: In a traditional network the attack surface is less as the applications are hosted in a DC and the users will access those applications only from internal network. But now the applications are moved into cloud and the users are started accessing from home or on road using Laptops, BYOD devices and phones.
3. Understand the gaps in visibility how the network is architectures and how each applications and devices are talking each other.

Benefits of using ZTNA,

• Outbound Network Access
  • The Application identity will help to allow access to only specific application as per their need.
  • User identity will help to configure the rules with access control policies to access the specific user.
  • Content specific policies allow you access only specific and block malicious content when they access allowed URLs.
• Inbound network Access (VPN replacement)
  • Better user experience for accessing the applications regardless of location.
  • A centralized policy management with network/application access control, user access control with MFA.
  • ZTNA improves flexibility, agility and scalability, enabling digital ecosystems to work without exposing services directly to the internet, reducing risks of distributed denial of service attacks.
  • Allows unmanaged devices to access the applications securely.

Recommendations

• Use of User identity allows the access only to specific user or group not all subnets or specific IP ranges.
• Use of application specific access allows the user to access only required resources from internet.
• Content scanning helps to block malicious activities.
• Use application level access instead of using IP addresses to access the applications which helps to hide the internal network from users, partners and 3^rd.
• Replace the design of exposing partner facing applications and provide the access through the IDP into the specific application privately without exposing them into public network.
• Replace the traditional VPN allows the VPN user to access entire network to only intended applications.
• Increase the identity assurance using MFA.