Is Zero Trust Just a Buzzword?

The movement to remote work environments has added significant changes to how organizations operate.

Employees are now accessing work-cloud environments using approved and unapproved devices through personal networks that may not be secure. Many organizations are now also becoming stewards of personal health data they previously did not collect, such as temperature checks. 

With the possibility of these changes running well into the next year, CISOs and CIOs are ramping up their security efforts and talking about new security models. One such security model, Zero Trust, is changing the way we think about security.

Zero Trust helps organizations to continue operating while providing a flexible security architecture that goes beyond traditional network boundaries.

Zero Trust has recently garnered a lot of interest among many organizations. It is an evolution of traditional security models and was coined by Forrester Research in 2010. Prior to that, Jericho Forum had also proposed similar ideas.

Source: New data from Microsoft shows how the pandemic is accelerating the digital transformation of cyber-security

Standards groups, like The Open Group and NIST, are actively working on this evolution of security. The Open Group, for instance, recently held a conference on Zero Trust architecture, and NIST released their latest draft for 800-207.

What is Zero Trust? 

It is not a technology, but rather a framework built on the assumption that all devices and systems — even those within the network perimeter — are already compromised. It uses the guiding principle to trust no one; even if they are trusted today, there is no implicit trust tomorrow. 

Traditional network-centric models of security quickly break down in this scenario. What we need to do is to move up the technology stack to focus on our application and data layers.

Zero Trust continues to expand into organizations. A 2019 IDG survey found that 47 percent of cybersecurity professionals are actively researching how to implement Zero Trust in their environments, 11 percent have employed the Zero Trust model in their environment, and a further 8 percent are piloting solutions. 

Benefits of a Zero Trust security model

There are several benefits of moving away from a network-centric model to a data-centric approach for security. It enables the creation of a loosely-coupled, fine-grained security architecture. 

This, in turn, allows business processes to utilize applications through several security parameters around user, application, and data. Even if a device is compromised, the data-centric security model prevents unauthorized access to the information. This provides more agility for many business scenarios — such as co-opetition, supply chain, and cloud computing.

Implementing Zero Trust in the cloud

Businesses are increasingly migrating to the cloud environment — whether through Software as a Service (SaaS) or as a platform for iterative software development in a microservices architecture (PaaS) that enables rapid delivery. 

In a cloud context, Zero Trust enables the rapid scaling of computing resources based on business needs while protecting the data in a third-party infrastructure. It requires visibility into three major components: the cloud apps, access rights, and the data being stored.

Applications like Office 365 and G Suite have made collaboration in the work-from-home environment much better. These offerings however also bring with them the risk of unauthorized access to data. Securing these apps requires policy enforcement as well as prevention protocols at multiple levels — only then can data remain secure.

As mentioned earlier, several organizations are moving to cloud environments to accelerate processes. However, the delivery of business solutions must also be balanced with organizational risk. This means that applications must be built within the guardrails of a Zero Trust framework. Data stored in the cloud needs to have access protocols enforced at multiple levels. In many cases, two-factor authentication and role-based permissions are required. For organizations that build their own applications, these security requirements are integrated into the code.

Developer-centric threat modeling is a Zero Trust enabler

While Zero Trust is a paradigm, a Zero Trust Architecture (ZTA) applies those principles in the form of a plan that can be applied directly to the development of enterprise software and systems. Developer-centric Threat Modeling (DCTM) allows organizations to anticipate weaknesses in an application’s technical stack an attacker could exploit, including the deployment environment, and prescribes the countermeasures developers need to implement to eliminate software vulnerabilities and weaknesses during the normal development process.

Application and data centricity

A critical aspect of ZTA is that it shifts the focus of protection from the network infrastructure to the application and data. It encompasses changes to both authentication and authorization for access to enterprise assets. Unlike perimeter-based security architectures that force enterprise applications to be deployed within a network fence, ZTA brings security into the applications and data. 

Across the DevSecOps lifecycle

Developer-centric threat modeling enables Zero Trust because of its  component centric  approach. Development teams can implement specific security requirements and use cases applicable to components across each stage of the software development life cycle. This improves developer productivity by ensuring only applicable security and compliance requirements are assigned to developers and providing just-in-time training and code samples to speed up coding tasks. 

Operations teams can benefit from infrastructure hardening guidance. DCTM solutions like SD Elements are perfectly suited to help with this process by referencing official regulations, code samples, best practices and educational content specific to  components  from a central library and identifying the items relevant to a given enterprise asset. DCTM also reduces time spent demonstrating compliance with internal security and risk policies and external standards and regulations by integrating with popular security testing tools that can provide evidence that required threat countermeasures and security controls have been implemented.

Continuous security

A key tenet of Zero Trust is the continuous monitoring and measurement of the security posture of all digital assets covered by ZTA. 

• DCTM solutions like SD Elements provide an automated and scalable process to quickly generate threat models tailored for the specific technology stack in use. This significantly decreases the time, effort, and costs required to create and maintain software threat models to support ZTA.
• DCTM focuses on a continuous process of testing and monitoring against the risk status of enterprise applications. Integration with security testing tools provides near real time visibility of known vulnerabilities in a single application or an entire portfolio. 
• This approach also collects as much information as possible about the current state of digital assets that might present a risk and uses that information to improve policies, processes, and their enforcement. 
• DCTM solutions like the SD Elements platform already offer these capabilities through pre-built integrations or custom integrations that can perform a ‘pulse check’ on the full stack applications across the DevSecOps toolchain. 

Content library for security requirements

DCTM solutions can provide DevOps teams with a mechanism to define organizational and asset level security, risk or compliance policies in a digital format that can be used to drive the requirements and monitor the status of key elements of a ZTA implementation. 

While the ZTA implementation itself would enforce the policies in a running system, a DCTM solution can ensure the rules and security logic that is required in an application are captured and assigned to the teams that build and deploy the applications in an enterprise. 

Evolving practices in Zero Trust

Zero Trust is not just a buzzword — it’s an evolutionary security framework that takes into account today’s highly distributed cloud and microservices applications. A traditional network-centric model does not scale effectively when we consider that, by itself, it does not easily address insider threats or external authentication breaches. 

We need a developer-centric approach that ensures security all the way down to the data. Ideally, organizations find solutions that enable flexibility in determining security policies, that are in line with enabling the business to accelerate development while managing security risk. Simply, it’s focused on going fast while staying safe.

Companies that currently take a developer-centric approach – one which provides software teams with the information they need to anticipate and avoid weaknesses in application – will have a head start if they decide to adopt a Zero Trust Architecture. As best practices, designs, and implementations continue to evolve for ZTA, it should be a seamless transition to include these in existing DCTM activities and monitor the implementation and effect on risk and security posture across the organization. 

If you want to learn about the business value of Zero Trust security, listen to our latest podcast.