Why Enterprise Security Requires A Decentralized Zero Trust Architecture

Imagine having a burglar live inside your house for months before you even found out that something was stolen. This is precisely how it feels when a data breach comes to light. From the attack on Target in 2013 to this month’s Cathay Pacific breach which exposed 9.4 million customers’ data, Advanced Persistent Threats (APT) have consistently been able to spread laterally without being detected for months. Considering the extent of damage malware can inflict on enterprises, there is an immediate need to contain and restrict it from spreading across the network – whether it is within a data center, or within campus/office environments, or between remote user and data center environments or between campus/office and the data center environments. Implementing a zero trust architecture ensures that all network accesses are made on a need only basis, which reduces the attack surface by blocking all unnecessary accesses to a critical resource.

What Makes Enterprises Vulnerable to Attacks?

A typical enterprise has users in the campus/office environments and applications in the data center, with a leased line between the two, and a flat network. Remote users connect to the applications hosted in the data center over a VPN or a reverse proxy setup. Within the campus/office environment, due to uncontrolled and unmonitored cyber hygiene, inadvertent actions of the users (for example: opening attachments they shouldn’t or clicking on links opening malicious websites) combined with a BYOD environment makes malware infections highly likely. These can spread from one device to another (like WannaCry) and infect other user devices in turn. They can also hop across subnets to infect the servers in the data center, which in turn can infect other servers. However, these vulnerabilities can be tackled by implementing a zero trust defense that is comprehensive – zero trust access of resources within the office networks, zero trust access of resources between office and data center and within the data center.

Zero Trust Architecture in the Current Security Scenario

Zero trust is a concept where no connection is trusted unless they have been explicitly allowed. A zero trust architecture is implemented by first segmenting the network as per the enterprise security needs and then applying security policies to control network communications across these segments. With digital transformation and cloud adoptions on the rise, enterprise ecosystems are becoming increasingly dynamic. To meet the enterprise security needs, the cybersecurity industry is filled with point products that mostly do one thing and one thing only at a specific OSI layer. This causes multiple issues:

• The policies need to be kept consistent across the products
• The products need to interact and interface with each other without causing policy deviations
• The security events need to be correlated across these products

Many zero trust architectures require a centralized segmentation gateway separating the users from the data center network. This approach is typically used for remote users accessing data center resources, thus being a VPN replacement and can be stretched to handle office users connecting to the DC.

The Limitations of a Centralized Approach to Zero Trust

A centralized gateway can only cater to just one vector – malware spreading from users to the data center network. Being a necessary intermediary, this centralized gateway cannot enforce zero trust between:

• User devices: User device interactions in the office environment, nor can it enforce zero trust between
• Servers: Server interactions in the data center environment

This approach dooms the solution to be another point solution as it caters only to ‘north-south’ traffic protection while being completely open about ‘east-west’ traffic protection. Additionally, the centralized gateway approach for internal / office users often requires a network transformation effort to separate the currently flat enterprise network. Hence, users in the office need to proxy via the gateway to access the data center servers. This requires changes to routing, to DNS and the firewalls. This also creates a bottleneck at the gateway, which means multiple clustered gateways are required to alleviate performance and fault tolerance concerns. Furthermore, to provide context to the applications (to differentiate web access and database access), it requires L7 inspection capabilities, requiring a DPI engine further impacting performance. Subsequently, it is now required that the data center servers are completely accessible by the gateway, hence breaking the cardinal rule of zero-trust.

Decentralized Approach to Zero Trust is the Way Forward

Zero trust can also be achieved using a decentralized peer-to-peer model. This works very well on flat networks, where resources can directly connect without an intermediary, like a gateway. A host-based firewall enforces policies on the endpoints (servers or user devices), which were orchestrated by an agent on these endpoints connected to a central policy orchestrator.  The agent, residing in the system, provides the application-level context to the network flows, thus eliminating the need for L7 inspection products. The decentralized approach is robust and works for East-West traffic – both within the campus and within the data center and between office users and the data center. Advantages of a Decentralized Approach to Zero Trust

• The decentralized approach makes zero trust deployments easier to accomplish
• The pace and scope of the network transformation is now more in the control of the enterprise
• There is no need to re-architect the network
• There is no single point of failure for the data plane

When taking a zero trust approach to fortifying security, enterprises need to take capital expense, operational complexities, and implementation time into consideration. A decentralized approach to zero trust affords a security structure that is robust enough to meet security needs and flexible enough to meet your dynamic business needs. Learn how ColorTokens can help you create a decentralized zero trust architecture.