Next-gen firewall appliances have been used for years to secure the network perimeter, allowing admins to set policies that determine who can access the network. Identity provider (IDP) services provision users and make it easier to manage passwords and authorize access based on contextual controls. By focusing on identity, they play an integral role in providing all employees, contractors, and partners with access to the information and apps appropriate to their functions.
But, with all the buzz around zero trust security, given the adoption of hybrid and multi-cloud environments, it’s important to understand that enterprises, to achieve zero trust security, must actually decouple application access from network access altogether.
This means that firewalls that take a network-centric approach are no longer effective, and IDP providers that focus solely on identity must be combined with other solutions. Instead, teams should look to redefine private application access with a software-defined perimeter (SDP) service—technology that Gartner calls zero trust network access (ZTNA).
The concept of zero trust security was first created eight years ago by Forrester Research and it was about embracing a new model for application access—one that treats all users and networks as untrusted. Zero trust requires IT to rethink network security, shifting from a network perimeter–based mentality to a more user- and application-centric one. Unfortunately, some analysts and vendors today are describing zero trust the way it was done eight years ago: placing users on the network, allowing for inbound connectivity to apps, and, thus, exposing app IP addresses to the internet.
Given that internal apps are moving to cloud and users are accessing them from outside the LAN, the need for zero trust has never been greater. To achieve it, there are five factors that IT must now consider in addition to password security via IDP.
Never allow inbound connections to internal apps: Exposing app IP addresses to the open internet leaves them vulnerable to DDoS and internet-based external attacks. Zero trust ensures that apps are completely invisible to the internet and involves creating an isolated environment around each and every internal application.
Segmented access at the app level: Also referred to as micro-segmentation, this requires the use of secure and encrypted micro-tunnels that are spun up on demand and on a per-session basis. Micro-segmentation is a modern alternative to the unnecessary and complex layers of network segmentation done in the past.
Never place users on-net: Access to applications should no longer require access to the network. By decoupling apps from the network, the internet can be used as the new corporate network, providing a more secure, perimeter-less approach to application access.
The zero trust model requires an integrated ecosystem of modern security technologies. At the heart of this ecosystem is a software-defined perimeter (SDP) solution. This term, now known by Gartner as ZTNA, describes cloud-based technologies that securely connect users to internal apps via the internet instead of network firewalls and appliances. Here is a look at some of the other zero trust security ecosystem players:
Identity providers (such as Azure AD, Okta, Ping, Centrify): These password and authentication providers integrate with SDPs and are used to centralize identities, simplify management, and provide authorized access to apps by creating and passing SAML attributes.
When looking to adopt a zero trust model, remember to keep the ecosystem—and its heart, the software-defined perimeter—in mind. Don’t misconstrue zero trust for what it was eight years ago. What you need, instead, is a model like Gartner's zero trust network access.
Learn how National Oilwell Varco, Perdue Farms, and MAN Energy Solutions have all made zero trust possible through software-defined access with Zscaler. Videos are available at http://www.zscaler.com/products/zscaler-private-access
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Christopher Hines is head of product marketing for Zscaler Private Access and Zscaler App