Network Monitoring
A Zero Trust Security architecture must support the demands of modern operational structures. While organizations used to rely on promoting good security habits among employees, Zero Trust has changed that mindset and replaced it with a more vigilant approach known as Zero Trust Network Access (ZTNA).
This means that organizations must take on the complex—yet necessary—responsibility of continuously verifying every device that accesses the network and monitoring metrics such as:
- Time to detect threats using current resources;
- Number of malicious events identified;
- Attack mitigation effectiveness;
- Correlation of security events with their current access control policies;
- Identification of any gaps or blind spots that attackers could exploit.
How to Monitor Networks in a Simple and Efficient Way?
Given the importance of high visibility and threat intelligence for Zero Trust, modern web platforms must offers solutions and features providing real-time information that can be integrated with SIEM or big data solutions via Data Stream and GraphQL, enabling a holistic, understandable view of the system.
In addition, those platforms also must offers orchestration features to automate/program security responses through Network Layer Protection. This helps simplifying security operations, as well as detecting and responding to potential threats quickly by following general rules and the organization’s own Zero Trust security policies.
Application Micro-Segmentation
In recent years, one of the key requirements for any Zero Trust architecture has been network microsegmentation. Essentially, it’s the practice of dividing a network into smaller, independent segments or zones, where security policies can be applied in a compartmentalized manner. It’s like a set of clusters, where all segments work together, but are managed individually.
However, due to the complexity of modern applications and the demands of modern security, microsegmentation has moved from being network-oriented to becoming application-oriented. Now, access control evolution, in terms such as granularity and limiting traversable space in the network, considers the application as a whole.
How to Implement Micro-Segmentation?
Modern web platforms provides the tools needed for ensuring high availability and granular access control for applications.
For example, a Load Balancer enables the distribution of workloads across different nodes to prevent downtime and overloaded servers, and to isolate different network parts to prevent them from impacting each other.
Since the network is just one component of the application, it’s advantageous from a Zero Trust perspective to segment the security, so that incidents don’t also affect the API gateway, DNS server, database, and other crucial components.
To enable this, a good Web Firewall allows you to enhance the load balancing with controls in line with the application’s segmentation, regardless of the complexity of the backend, using programmability features. With programmable security, you can apply business rules, logical access control, WAAP (web application and API protection), and so on.
Modern Endpoint Security
When we talk about endpoints, we consider both external and internal threats, which affect a large number of organizations every year, as a Ponemon Institute study points out. The main related risks are listed in the OWASP Top 10.
“Visibility is one of the core pillars of the Zero Trust security model” was one of the most reinforced points throughout this series. And this is even more true for endpoints, since the best way to prevent attack vectors is to analyze the events that occur in them.
How to Modernize Endpoint Security?
When applications are migrated from a cloud or on-premise infrastructure to Azion, they become edge applications integrated with a set of advanced security tools and features to:
- Identify anomalous traffic;
- Prevent zero-day attacks;
- Isolate OWASP Top 10 threats.
This way, your endpoints are covered by an infrastructure designed for the challenges of modern cyber security, without the need for additional investment in hardware and software, and can also provide visibility into endpoint events.
But data protection is as important as the collection and analysis of event data. According to ISO/IEC 27001, data can create a false sense of security when it is frequently modified or deleted.
In this regard, logs transmitted via Data Stream, for example, are end-to-end encrypted and protected by data loss prevention features at every step of the pipeline.
Authentication & Authorization
More and more organizations are strengthening user verification as they move through a session involving an asset or service. Next time you make a transaction through a mobile banking app, pay attention to how many authentication prompts you get until the transaction is completed.
With Zero Trust, it’s crucial that this same level of vigilance is applied to everything the strategy encompasses, such as access to data and tasks that require administrative privileges, in order to ensure that the journey is being conducted based on the user, device, or any other criteria established by the organization.
How to Improve Authentication and Authorization Processes?
These procedures can be enhanced with Azion through the Secure Token solution. It can be used to validate tokens generated by the application for each user request received and sent, verifying the secret key, the token expiration date, and token validity. If the conditions established by Secure Token are not met, access to the content is automatically denied.
In other words, without proof that the asset or service in the network is still being accessed by the same user who initially obtained authorization, the session will be terminated.
It’s worth emphasizing the importance of continuous authentication being complemented by best practices for identity and access management (IAM), including the implementation of sophisticated technologies such as biometrics, behavioral analysis, and artificial intelligence.
Finally, by putting into practice the four items mentioned so far—assuming the previous stages were followed to the letter—your organization will have a functioning and ready-to-evolve Zero Trust architecture.