Zero Trust Security: 5 Reasons it’s Not Just About Passwords
by Christopher Hines
Identity provider (IDP) services provision users and make it easier to manage passwords and authorize access based on contextual controls. By focusing on identity, they play an integral role in providing all employees, contractors, and partners with access to the information and apps appropriate to their functions. But to achieve zero trust, you’ll need more than just IDP.
Zero trust security first created eight years ago by Forrester Research, is about embracing a new model for application access—one that treats all users and networks as untrusted. Zero trust requires IT to rethink network security, shifting from a perimeter-based mentality to a more user- and application-centric one.
What’s needed to make zero trust security a reality?
Given that internal apps are moving to cloud and users are accessing them from outside the LAN, the need for zero trust has never been greater. To achieve it, there are five factors that IT must now consider in addition to
password security via IDP.
The zero trust ecosystem
- Never allow inbound connections to internal apps: Exposing app IP addresses to the open internet leaves them vulnerable to DDoS and internet-based external attacks. Zero trust ensures that apps are completely invisible to the internet and involves creating an isolated environment around each and every internal application.
- Segmented access at the app level: Also referred to as micro-segmentation, this requires the use of secure and encrypted micro-tunnels that are spun up on demand and on a per-session basis. Micro-segmentation is a modern alternative to the unnecessary and complex layers of network segmentation done in the past.
- Never place users on-net: Access to applications should no longer require access to the network. By decoupling apps from the network, the internet can be used as the new corporate network, providing a more secure, perimeter-less approach to application access.
- Monitor suspicious activity and stream to SIEM: IT must have a way to view user activity—in real time—to reduce the potential for security exposure. The ability to automatically stream logs to a SIEM allow teams to leverage the power of their SOC immediately, instead of relying on batch cron jobs with limited visibility (IP and port-centric only) that are sent from legacy tools like VPNs.
- Discover unknown apps: Zero trust should not only apply to known applications, but to unknown applications as well. This is why it is critical for teams to be able to discover previously unknown applications and apply the same zero trust access policies to them as they do to all known apps.
The zero trust model requires an integrated ecosystem of modern security technologies. At the heart of this ecosystem is a software-defined perimeter (SDP) solution. This term, coined by Gartner
, describes a set of cloud-based technologies that securely connect users to internal apps via the internet, not network appliances.