COVID has changed how businesses operate. Companies have embraced remote work to conduct business at a scale that was never previously imagined. Most businesses have accepted remote working as the way of the future, however, a handful has chosen to stick with the hybrid approach. Operating in the remote world exposes you to security dangers such as ransomware, supply chain threats, cloud threats, API threats, and so on.
What are these threats, exactly? There are AuthN/AuthZ challenges that perimeter security cannot solve, leaving even the most secure networks vulnerable to hacks. Zero Trust is a security architecture for enterprises both inside and outside their network. No user in the network should be trusted by default. All users should be continually authenticated, approved, and validated for security configuration and posture using strong and dynamic cryptographic identity before providing access to applications or data. Tetrate, an application networking company, has partnered with NIST to define and promote the standards for zero trust. NIST special publication 800-207 defines zero trust architecture. The SP 800-204, 800-204A, and 800-204B, co-authored by Tetrate, offer deployment recommendations. We partner with Tetrate to implement the core recommendations for Zero trust such as:
NGAC, or Next Generation Access Control for application authentication, which is an advanced implementation of RBAC, developed by NIST scholar David Ferraiolo.
Enable Mutual TLS - mTLS is a type of mutual authentication in which two parties authenticate each other using a TLS protocol. This ensures message authenticity and integrity with a click of a button across all environments.
Time-bound Access – Access is only granted for a limited time with the least possible privileges, even for trusted identities.
Continuous Monitoring - The integrity and security posture of all resources is continuously monitored, and policy enforcement is continuously assured. All the insights gained from the monitoring are used to improve the policy.
In May 2021, in response to an increase in high-profile security breaches, the Biden administration issued an Executive Order requiring U.S. Federal Agencies to follow NIST 800-207 as a prerequisite for Zero Trust deployment.
Given that there are different interpretations of Zero Trust, it can be intimidating to understand where to get started and challenging to figure out the right solution to meet your organization's needs. To ensure compliance with the Executive Order, the key principles to keep in mind for implementing a Zero Trust Security framework and architecture are:
Never Trust, Always Verify – The identity of all resources, devices, networks, credentials, etc., should be verified continuously. Even the ones verified previously should be reassessed if there are any changes to the context of their location or data. This is to verify that all resources on the network are continuously authenticated on the network before any communication of services or application begins. No resources should be trusted by default.
Follow Least Privilege Principle – The access privileges given to human or non-human (service accounts) should be limited to the execution of their tasks and to be reassessed before permissions should be granted or the accounts to be trusted only when verified. This will limit their access to the complete system and reduce the risk of attacks. This principle will also help minimize the risk in case of security breaches.
Shared Security Model – When working in cloud environments, security is the greatest fear since workload security is a shared responsibility between the CSP and your organization. Security policies are imposed depending on the identity of communicating workloads and are related directly to the workloads themselves in a zero-trust security architecture. Security at Rest and in-Transit protection follow the workload and are consistent even as the environment changes.
Design to Fail: Always design systems to anticipate errors and build monitoring and remediation controls to self-heal. This minimizes downtime and ensures faster recovery from security breaches.
Separate regulated and non-regulated data and provide separate controls for them.
Implement NIST guidelines for Zero Trust and security using automated DevSecOps pipelines.
VivSoft's solutions are built using the Zero Trust Security framework using technologies like Istio Service Mesh and comply with NIST 800-207 criteria. We implement industry-leading Zero Trust solutions like Tetrate in automated DevSecOps pipelines. Starting with non-critical assets, we rapidly prototype Zero Trust Security architecture for agencies trying to build capabilities to scale Zero Trust across their environments. Zero Trust security framework safeguards your company against cyber breaches, no matter where you are on your security journey.