How to create a Zero Trust network

Organizations no longer keep their data in one centralized location. Users and assets responsible for processing data may be located outside the network, and may share information with third-party vendors who are themselves removed from those external networks.

The Zero Trust approach addresses this situation by treating every user, asset, and application as a potential attack vector whether it is authenticated or not. This means that everyone trying to access network resources will have to verify their identity, whether they are coming from inside the network or outside.

What are the Zero Trust principles and concepts?

The Zero Trust approach is made up of six core concepts that work together to mitigate network security risks and reduce the organization’s attack surface.

1. The principle of least privilege

Under the Zero Trust model, network administrators do not provide users and assets with more network access than strictly necessary. Access to data is also revoked when it is no longer needed. This requires security teams to carefully manage user permissions, and to be able to manage permissions based on users’ identities or roles.

The principle of least privilege secures the enterprise network ecosystem by limiting the amount of damage that can result from a single security failure. If an attacker compromises a user’s account, it won’t automatically gain access to a wide range of systems, tools, and workloads beyond what that account is provisioned for. This can also dramatically simplify the process of responding to security events, because no user or asset has access to assets beyond the scope of their work.

2. Continuous data monitoring and validation

Zero trust policy assumes that there are attackers both inside and outside the network. To guarantee the confidentiality, integrity, and availability of network assets, it must continuously evaluate users and assets on the network. User identity and privileges must be checked periodically along with device identity and security.

Organizations accomplish this in a variety of ways. Connection and login time-outs are one way to ensure periodic monitoring and validation since it requires users to re-authenticate even if they haven’t done anything suspicious. This helps protect against the risk of threat actors using credential-based attacks to impersonate authenticated users, as well as a variety of other attacks.

3. Device access control

Organizations undergoing the Zero Trust journey must carefully manage and control the way users interact with endpoint devices. Zero Trust relies on verifying and authenticating user identities separately from the devices they use. For example, Zero Trust security tools must be able to distinguish between two different individuals using the same endpoint device.

This approach requires fundamental changes to the way certain security tools work. For example, firewalls that allow or deny access to network assets based purely on IP address and port information aren’t sufficient. Most end users have more than one device at their disposal, and it’s common for mobile devices to change IP addresses. As a result, the cybersecurity tech stack needs to be able to grant and revoke permissions based on the user’s actual identity or role.

4. Network micro segmentation

Network segmentation is a good security practice even outside the Zero Trust framework, but it takes on special significance when threats can come from inside and outside the network. Microsegmentation takes this one step further by breaking regular network segments down into small zones with their own sets of permissions and authorizations.

These microsegments can be as small as a single asset, and an enterprise data center may have dozens of separately secured zones like these. Any user or asset with permission to access one zone will not necessarily have access to any of the others. Microsegmentation improves security resilience by making it harder for attackers to move between zones.

5. Detecting lateral movement

Lateral movement is when threat actors move from one zone to another in the network. One of the benefits of micro segmentation is that threat actors must interact with security tools in order to move between different zones on the network. Even if the attackers are successful, their activities generate logs and audit trails that analysts can follow when investigating security incidents.

Zero Trust architecture is designed to contain attackers and make it harder for them to move laterally through networks. When an attack is detected, the compromised asset can be quarantined from the rest of the network. Assets can be as small as individual devices or user accounts, or as large as entire network segments. The more granular your security architecture is, the more choices you have for detecting and preventing lateral movement on the network.

6. Multi-factor authentication (MFA)

Passwords are a major problem for traditional security models, because most security tools automatically extend trust to anyone who knows the password. Once a malicious actor learns a privileged user’s login credentials, they can bypass most security checks by impersonating that user.

Multi-factor authentication solves that problem by requiring users to provide more information. Knowing a password isn’t enough – users must authenticate by proving their identity in another way. These additional authentication factors can come in the form of biometrics, challenge/response protocols, or hardware-based verifications.

How to implement a Zero Trust network

1. Map out your attack surface

There is no one-size-fits-all solution for designing and implementing Zero Trust architecture. You must carefully define your organization’s attack surface and implement solutions that protect your most valuable assets.

This will require a variety of tools, including firewalls, user access controls, permissions, and encryption. You will need to segment your network into individual zones and use microsegmentation to secure high-value and high-volume zones separately.

Pay close attention to how your organization secures its most important assets and connections:

• Sensitive data. This might include customer and employee data, proprietary information, and intellectual property that you can’t allow threat actors to gain access to. It should benefit from the highest degree of security.
• Critical applications. These applications play a central role in your organization’s business processes, and must be protected against the risk of disruption. Many of them process sensitive data and must benefit from the same degree of security.
• Physical assets. This includes everything from customer-facing kiosks to hardware servers located in a data center. Access control is vital for preventing malicious actors from interacting with physical assets.
• Third-party services. Your organization relies on a network of partners and service providers, many of whom need privileged access to your data. Your Zero Trust policy must include safeguards against attacks that compromise third-party partners in your supply chain.

2. Implement Zero Trust controls using network security tools

The next step in your Zero Trust journey is the implementation of security tools that allow you collect, analyze, and respond to user behaviors on your network. This may require the adjustment of your existing security tech stack, and the addition of new tools designed for Zero Trust use cases.

• Firewalls must be able to capture connection data beyond the traditional IP, port, and protocol data that most simple solutions rely on. The Zero Trust approach requires inspecting the identities of users and assets that connect with network assets, which requires more advanced firewall technology. This is possible with next generation firewall (NGFW) technology.
• VPNs may need to be reconfigured or replaced because they do not typically enforce the principle of least privilege. Usually, VPNs grant users access to the entire connected network – not just one small portion of it. In most cases, organizations pursuing Zero Trust stop using VPNs altogether because they no longer provide meaningful security benefits.
• Zero Trust Network Access (ZTNA) provides secure access to network resources while concealing network infrastructure and services. It is similar to a software-defined perimeter that dynamically responds to network changes and grants flexibility to security policies. ZTNA works by establishing one-to-one encrypted connections between network assets, making imprecise VPNs largely redundant.

3. Configure for identity and access management

Identity-based monitoring is one of the cornerstones of the Zero Trust approach. In order to accurately grant and revoke permissions to users and assets on the network, you must have some visibility into the identities behind the devices being used.

Zero Trust networks verify user identities in a variety of ways. Some next-generation firewalls can distinguish between user traffic, device traffic, application traffic, and content. This allows the firewall to assign application sessions to individual users and devices, and inspect the data being transmitted between individuals on networks.

In practice, this might mean configuring a firewall to compare outgoing content traffic with an encrypted list of login credentials. If a user accidentally logs onto a spoofed phishing website and enters their login credentials, the firewall can catch the data before it is transferred off the network. This would not be possible without the ability to distinguish between different types of traffic using next-generation firewall technology.

Multi-factor authentication is also vital to identity and access management. A Zero Trust network should not automatically authenticate a user who presents the correct username and password combination to access a secure account. This does not prove the identity of the individual who owns the account – it only proves that the individual knows the username and password. Additional verification factors make it more likely that this person is, in fact, the owner of the account.

4. Create a Zero Trust policy for your IT environment

The process of implementing Zero Trust policies in cloud-native environments can be complex. Every third-party vendor and service provider has a role to play in establishing and maintaining Zero Trust. This often puts significant technical demands on third-party partners, which may require organizations to change their existing agreements. If a third-party partner cannot support Zero Trust, they can’t be allowed onto the network.

The same is true for on-premises and data center environments, but with added emphasis on physical security and access control. Security leaders need to know who has physical access to servers and similar assets so they can conduct investigations into security incidents properly. Data centers need to implement strict controls on who interacts with protected equipment and how their access is supervised.

How to operationalize Zero Trust

Your Zero Trust implementation will not automatically translate to an operational security context that you can immediately use. You will need to adopt security operations that reflect the Zero Trust strategy and launch adaptive security measures that address vulnerabilities in real-time.

• Gain visibility into your network. Your network perimeter is no longer strictly defined by its hardware. It consists of cloud resources, automated workflows, operating systems, and more. You won’t be able to enforce Zero Trust without gaining visibility into every aspect of your network environment.
• Monitor network infrastructure and traffic. Your security team will need to monitor and respond to access requests coming from inside and outside your network. This can lead to significant bottlenecks if your team is not equipped with solutions for automatically managing network traffic and access.
• Streamline detection and response. Zero Trust networks mitigate the risks of cyberattacks, malware, ransomware, and other potential threats, but it’s still up to individual security analysts to detect and investigate security incidents. The volume of data analysts must inspect may increase significantly, so you should be prepared to mitigate the issue of alert fatigue.
• Automate Endpoint Security. Consider implementing an automated Endpoint Detection and Response (EDR) solution that can identify malicious behaviors on network devices and address them in real-time.

Implement Zero Trust with AlgoSec

AlgoSec is a global cybersecurity leader that provides secure application connectivity and policy management through a unified platform. It aligns with Zero Trust principles to provide comprehensive traffic flow analysis and optimization while automated policy changes and eliminating the risk of compliance violations.

Security leaders rely on AlgoSec to implement and operationalize Zero Trust deployments while proactively managing complex security policies.

AlgoSec can help you establish a Zero Trust network quickly and efficiently, providing visibility and change management capabilities to your entire security tech stack and enabling security personnel to address misconfiguration risks in real-time.

Book a demo now to find out how AlgoSec can help you adopt Zero Trust security and prevent attackers from infiltrating your organization.