Zero Trust Design

In today’s evolving threat landscape, Zero Trust Architecture has emerged as a significant security framework for organizations. One influential model in this space is the Zero Trust Model, attributed to John Kinderbag. Inspired by Kinderbag’s model, we explore how our advanced solution can effectively align with the principles of Zero Trust.

Let’s dive into the key points of mapping the Zero Trust Model with AlgoSec’s solution, enabling organizations to strengthen their security posture and embrace the Zero Trust paradigm.

My approach of mapping Zero Trust Model with AlgoSec solution is based on John Kinderbag’s Zero Trust model (details) which being widely followed, and I hope it will help organizations in building their Zero trust strategy.

Firstly, let’s understand what Zero trust is all about in a simple language. Zero Trust is a Cybersecurity approach that articulates that the fundamental problem we have is a broken trust model where the untrusted side of the network is the evil internet, and the trusted side is the stuff we control. Therefore, it is an approach to designing and implementing a security program based on the notion that no user or device or agent should have implicit trust. Instead, anyone or anything, a device or system that seeks access to corporate assets must prove it should be trusted.

The primary goal of Zero Trust is to prevent breaches. Prevention is possible. In fact, it’s more cost effective from a business perspective to prevent a breach than it is to attempt to recover from a breach, pay a ransom, and the deal with the costs of downtime or lost customers.

As per John Kinderbag, there are Four Zero Trust Design Principles and Five-Step Zero Trust Design Methodology.

The Four Zero Trust Design Principles:

The first and the most important principle of your Zero Trust strategy is know “What is the Business trying to achieve?”. Second, start with DAAS (Data, Application, Asset and Services) elements and protect surfaces that need protection and design outward from there. Third, determine who needs to have access to a resource in order to get their job done, commonly known as least privilege. Fourth, all the traffic going to and from a protect surface must be inspected and logged for malicious content.

1. Define Business Outcomes

2. Design from the inside out

3. Determine who or what needs access

4. Inspect and log all traffic

The Five-Step Zero Trust Design Methodology

To make your Zero trust journey achievable, you need a repeatable process to follow. The first step in the Zero trust is to break down your environment into smaller pieces that you need to protect (protect surfaces). The second step for deploying Zero Trust in each protect surfaces is to map the transactions flows so that we can allow only the ports and the address needed and nothing else. Everyone wants to know what products to buy to do Zero trust or to eliminate trust between digital systems, the truth is that you won’t know the answer to that until you’ve gone through the process. Which brings us to the third step in the methodology: architecting the Zero trust environment. Ultimately, we need to instantiate Zero Trust as a Layer 7 policy statement. Use the Kipling Method of Zero Trust policy writing to determine who or what can access your protect surface. The fifth design principle of Zero Trust is to inspect and log all traffic, for monitor and maintain, one needs to take all of the telemetry – whether it’s from a network detection and response tool, or from firewall or server application logs and then learn from them. As you learn over time, you can make security stronger and stronger.

1. Define the protect surface

2. Map the transaction flows

3. Architect a Zero trust environment

4. Create Zero trust policies

5. Monitor and maintain.

How AlgoSec aligns with “Map the transaction Flows” the 2nd step of Design Methodology?

AlgoSec Auto-Discovery. analyses your traffic flows, turning them into a clear map. AutoDiscovery receives network traffic metadata as NetFlow, SFLOW, or full packets and then digest multiple streams of traffic metadata to let you clearly visualize your transaction flows. Once the transaction flows are discovered and optimized, the system keeps tracking changes in these flows. Once new flows are discovered in the network, the application description is updated with the new flows.

Outcome:

• Clear visualization of transaction flows.

• Updated application description.

• Optimized transaction flows.

How AlgoSec aligns with “Architect Zero Trust Policies” – the 4th step of Design Methodology?

With AlgoSec, you can automate the security policy change process without introducing any element of risk, vulnerability, or compliance violation. AlgoSec allows you to ingest the discovered transaction flows as a Traffic Change request and analyze those traffic changes before they are implemented all the to your Firewalls, Public Cloud and SDN Solutions and validate successful changes as intended, all within your existing IT Service Management (ITSM) solutions.

Outcome:

• Analyzed traffic changes for implementation.

• Implemented security policy changes without risk, vulnerability, or compliance violations. 

How Algosec aligns with “Monitor and maintain” – the 5th step of Design Methodology?

AlgoSec analyzes security by analyzing firewall policies, firewall rules, firewall traffic logs and firewall change configurations. Detailed analysis of the security logs offers critical network vital intelligence about security breaches and attempted attacks like virus, trojans, and denial of service among others. With AlgoSec traffic flow analysis, you can monitor traffic within a specific firewall rule. You do not need to allow all traffic to traverse in all directions but instead, you can monitor it through the pragmatic behaviors on the network and enable network firewall administrators to recognize which firewall rules they can create and implement to allow only the necessary access.

Outcome:

• Critical network intelligence, identification of security breaches and attempted attacks.

• Enhanced firewall rule creation and implementation, allowing only necessary access.