%402x%20DARK.svg){kind=icon}
Beginning in January 2024, an unauthorized entity conducted surveillance of MITRE's network systems, breached one of their VPNs by exploiting two undisclosed vulnerabilities and bypassed multi-factor authentication protocols through session hijacking techniques. Subsequently, they expanded their access horizontally across the systems and penetrated deeply into the VMware infrastructure using administrator credentials they had obtained. The attackers maintained their presence by deploying advanced backdoor access points and webshells, which they also utilized to collect authentication credentials.
Although identity and authentication credential were compromised, what saved MITRE was microsegmentation that eventually isolated the breach and contained it within affected networks, preventing further lateral movement. As soon as the breach was detected, the incident response team initiated a plan to contain and isolate the affected systems, align management and the right teams on next steps, conduct forensic and behavior analysis, remediate ongoing projects to new systems reducing downtime, and implemented constant monitoring protocols for threat and anomaly detection.
What do we learn from the MITRE attack? Microsegmentation – a part of their Zero Trust architecture – is what stopped the attack from spreading and who knows how demanding the damage would’ve been if not for this. According to an IBM report, it takes about 279 days from identifying a breach to completely containing it. Not to mention the millions of dollars it costs in disaster recovery and employee productivity and everything in between. Organizations have long battled security breaches as one of the leading causes for building and maintaining a robust and reliable IT infrastructure. Legacy systems, staff ignorance or unawareness, and shadow IT are just a handful of reasons that make your systems vulnerable to cyber-attacks.
Protecting against these vulnerabilities is no doubt a priority for every IT leader, CIO, CISO, and even MSPs or partners if you have any. Zero Trust infrastructure stands today as one of the most widely essential components of network security, ensuring that your organization remains sheltered from attacks disrupting revenue while costing unprecedented amounts in repairs, recoveries, and delays.
Traditional networks are sensitive to malware
The problem with traditional moat-and-castle architecture is that although it protects data from users outside the network, it grants unchecked access to anyone who’s within. This is a problem in today’s dynamic working environment where users are connected globally either remotely from their homes or on the go. Applications are no longer entirely on data centers and have moved across systems including clouds as SaaS, Iaas, etc., creating a hybrid environment. If an employee working from home of Friday has to connect to the data center to securely reach application within, it creates unnecessary inefficiencies that don’t make sense.
But there are bigger issues at play here that are far more concerning than network efficiencies. A legacy architecture is inter-connected and hence anyone who has access to the network is trusted with the applications within. The shared network always leaves services open to receive a connection, exploring them to imminent attacks. Criminals bypass conventional detection methods, exploiting the implicit trust that traditional systems put into their users. Outdated firewalls can’t keep up with how smart the cyberattacks have become and sooner or later, your entire system gets exposed to random attacks.
When the attacks do occur, a shared network access doesn’t limit spread but rather enables easy access to all other resources on the network, compromising more data in seconds. Without any credential protection solutions, it becomes easier for attackers to steal credentials through phishing emails and install malware on system. This malware spreads laterally throughout the network, making it extremely difficult to control and contain the attack thereafter. A single compromised machine gradually allows the malware to essentially cripple most of the system and maybe even your entire business.
Eventually, they discover high-value assets and sensitive data, encrypting and stealing it from backchannels. Once you lose this data, and they have immense leverage over you, what follows is extortion. And if you think paying the ransom will ensure restoration of your data then you’re gravely mistaken. Most ransomware attacks are irreversible, and extortion only leads to more extortion. The only thing left to do now is rebuild your IT infrastructure almost from scratch. The silver lining, however, is that you get to build it back stronger.
Nature of a Zero Trust Architecture
About 90% of all cyber-attacks stem from malicious emails. When an unaware staff or employee clicks on a phishing email, a malware loader is downloaded on the system, compromising it. Now, as this system is connected to the network, the malware moves laterally through it, identifying domain controllers and stealing credentials. Once it has the necessary credentials, it steals sensitive data and installs ransomware on compromised systems, further continuing to spread across the network as maliciously as possible. The more it spreads, the more difficult it gets to identify this malware, contain it, and recover sensitive user data. What’s worse is the money demanded in ransoms and the revenue lost from offline systems, bad reputation, and recovery time.
A Zero Trust architect doesn’t not trust the users but rather enforces a least privilege environment where a user’s identity is constantly identified. And instead of granting access to the network, a user is connected directly to the application, isolating the risk of any attacks spreading within. These applications stay hidden behind a wall and are not visible since they’re not directly connected to the network. A user simply accesses the application isolated from the network so even if they are exposed to malicious attacks, the malware remains contained within that segmented network, unable to spread to a network it can’t see.
What makes up a Zero Trust Architecture
First things first – Zero Trust isn’t a destination, it’s a process; there’s no end to it. You can think of it as more of a “security maturity” metric where the more Zero Trust principles you implement, the stronger your security becomes. If you have a smaller budget or a smaller company, you can start small. There are multiple components to think of within this infrastructure and the important thing is to plan ahead. When you think of your strategic plans, align your actions to prepare or leave room for Zero Trust implementation. To get started, let’s look at a few important components for you to consider.
Basic components of a Zero Trust Architecture
Identity and access management
The first thing when it comes to Zero Trust is establishing Zero Trust Access protocols such as to secure user credentials and their access to applications. Using a robust Identity, Credential, and Access Management (ICAM) framework that centralizes identity management across all environments, automating user provisioning/de-provisioning, and enforcing regular certification reviews. Further fortify secure identity management with advanced authentication practices like Single Sign-On (SSO) and Multi-Factor Authentication (MFA) across all applications and resources. Also, enable a context-aware authentication that incorporates sign-in risk detection to identify suspicious activities based on user behavior, location, device, and other risk signals.
There’s also the concept of least privileged access management that treats all users equally, without giving certain privileges to higher management. This coupled with just-in-time (JIT) access ensures that users can only access resources when they want to but will require their credentials every time they want access it, without privileged disparities. You can also implement stronger credential protection using passwordless options, protection against credential stuffing, password spray attacks, and comprehensive monitoring for credential theft or misuse.
You can further break down access with conditions that evaluate multiple risk factors simultaneously (device compliance, location, application sensitivity, user behavior) before granting resource access. There’s also identity analytics that detect unusual patterns, potential credential compromise, excessive privileges, and access anomalies across the entire identity infrastructure. Leverage these loopholes to improve access management protocols for your entire organization.
There are other advanced principles you can think about like dynamic risk-based access policies that continuously evaluate user context, device health, network conditions, and resource sensitivity before and during sessions, automatically adapting access permissions in real-time. Further automate lifecycle management for seamless onboarding, role changes, and offboarding processes that immediately adjust access rights based on employment status, department transfers, or responsibility changes.
Infrastructure and access control
Your infrastructure is the foundation on which Zero Trust will stand. At the core of this is replacing your legacy systems with a Zero Trust Network Access (ZTNA) architecture to essentially that provides application-level access rather than network-level access, hiding applications from the public internet and unauthorized users. What’s more, you can implement Software-Defined Perimeter (SDP) architecture that creates dynamic, one-to-one network connections between users and the specific resources they need, effectively making all other resources invisible.
It’s time to upgrade to cloud-based firewalls such as Firewall as a Service (FWaaS) with deep packet inspection, application awareness, threat intelligence integration, and user identity context to control traffic flows based on application needs rather than just ports and protocols. On top of that, mandate strong device authentication mechanisms that verify device identity using certificates, hardware attestation, or other cryptographic methods to prevent device spoofing or impersonation attacks.
Speaking of strong authentication mechanisms, mandate device registration with the identity provider for continuous device health validation which ensures only compliant, recognized, and secure devices can access corporate resources regardless of ownership (corporate or BYOD). This also extends to secure remote access solutions for third-party vendors, contractors, and partners that enforce the same security controls as internal users without requiring network-level access or excessive privileges.
To top it all off, your infrastructure should be enriched with endpoint threat detection and response capabilities with real-time monitoring, behavioral analysis, and automated remediation to protect against malware, ransomware, and advanced persistent threats.
Network segmentation and microsegmentation
Having an infrastructure that support and complements the network requirements for a Zero Trust architecture is essential. Again, you will have to transition from traditional network perimeters to identity-based network security model where access is determined by user identity and context rather than network location, effectively eliminating the concept of trusted networks.
Perhaps the most important aspect of ZTNA is enforcing a microsegmentation strategy implemented across all environments that contains lateral movement by creating secure zones around individual workloads, applications, and data repositories based on their security requirements. Another advantage of upgrading to a ZTNA architecture is that it provides secure, authenticated access to individual applications rather than network segments, effectively making the network invisible to users and potential attackers.
Microsegmentation also gives way to better monitoring and control of east-west (lateral) traffic between network segments, applications, and services with default-deny policies and explicit permission for legitimate communications only. You can also deploy capabilities to dynamically isolate network segments, devices, or applications when security incidents are detected, limiting potential damage while enabling automated or manual investigation and remediation.
What’s more, you can implement a Secure Access Service Edge (SASE) architecture that combines network security functions with WAN capabilities to support dynamic, secure access from any location to applications in any environment. A software-defined networking (SDN) approach helps direct traffic more efficiently through policy-based network controls that dynamically adjust based on real-time security telemetry and changing business requirements.
Cloud environments and hybrid security
Cloud environments and SaaS models have become the backbone of modern technology. So, it’s all the more important to secure cloud access in a multi-cloud environment and between cloud service consumers and providers. Cloud Access Security Brokers (CASB) can be used for comprehensive visibility and control over all cloud services, providing data security, threat protection, compliance monitoring, and access control across multiple cloud providers. In a multi-cloud environment (AWS, Azure, GCP, etc.), you should establish security controls with centralized policy management, unified visibility, and standardized security operations regardless of cloud provider.
In hybrid environments, it’s important to create secure gateways between on-prem systems and the cloud services. For example, you can unify identity and access management across on-premises and cloud environments with seamless authentication, consistent policies, and centralized governance. You should also establish secure connectivity between on-premises and cloud environments using dedicated links, encrypted tunnels, or SASE architecture with consistent security controls and monitoring throughout the data path.
Another challenge that IT leaders deal with is Shadow IT management which increased significantly since remote work became a thing. As orgs extended their cloud services, it became more difficult to handle the problems from shadow IT. What can be done as a part of a Zero Trust architecture is to implement discovery and risk assessment of unauthorized cloud services with automated classification, security evaluation, and integration into governance frameworks or appropriate restrictions. These restrictions, again, are least privilege and applies to your entire organization accessing the network from office or remotely.
Applications, security, and monitoring
Zero Trust works on the idea that users will have access directly to the application and not to the network. What this truly means is that your applications have to be built a certain way that enables the Zero Trust mechanism. A Zero Trust User App access for all enterprise applications with application-specific access controls, continuous validation, and granular permission management that restricts access based on user role and context. Your APIs need to be secure as well with API security controls including strong authentication, authorization, rate limiting, input validation, and continuous monitoring to protect application programming interfaces from exploitation and data exposure.
Important solutions like Security Information and Event Management (SIEM) collect, correlate, and analyze security data from all environments, providing real-time visibility into potential security incidents. Also consider implementing User and Entity Behaviour Analytics (UEBA) that establishes baseline behavior patterns for users, devices, and applications, then automatically detects and alerts on anomalous activities that may indicate compromise. With Security Orchestration, Automation and Response (SOAR) capabilities, you can automate incident response workflows, accelerate threat containment, and standardize security operations to reduce mean time to respond.
Another very important part of automated incident response is data loss prevention (DLP). With DLP controls across all channels (email, web, endpoints, cloud, removable media), you can achieve better content inspection, contextual analysis, and automated policy enforcement to prevent unauthorized data exfiltration. To further improve data protection, you can implement end-to-end encryptions for all sensitive data across all states (in transit, at rest, and in use) using strong cryptographic algorithms and key management.
Creating employee awareness programs
A lot of cybersecurity attacks happen because company employees are unaware, or worse, ignorant. You can do everything right and yet, an employee mindlessly clicking on a phishing email puts your data and network at risk of infiltration. What follows is possibly months of disaster recovery and (we don’t want to sound repetitive here but) thousands if not millions of dollars in losses. This is why your employees have just as much a part to play in minimizing risk parameters as much as all the attempts you make to build a foolproof Zero Trust architecture.
Develop role-based security awareness training program with specialized content for different job functions, regular refresher modules, and verification of knowledge retention through assessments and practical exercises. Constantly encourage, or if possible, mandate, employees to complete these training programs and take assessments to understand how prepared they are for certain scenarios. Implement phishing simulation programs that regularly tests employees with realistic scenarios, provides immediate feedback and education, and tracks improvement over time with adaptive difficulty levels.
Initiate a strong security culture through executive sponsorship, security champions programs, recognition for positive security behaviors, and integration of security into organizational values. Create guiding modules for employees to refer anytime they want, without having to depend on IT to solve their issues all the time. You can also train an AI chatbot to answer their queries in real-time if they’re in doubt of certain technical anomalies in their systems and raise alarm to your team if they so happen to find them.
Since remote work has become the norm for most companies now, establishing a secure remote work best practices program can help avoid shadow IT and improve educate employees on the potentials risks of connecting their personal devices to the network, home network security, public Wi-Fi risks, physical security of devices, and secure collaboration practices outside the corporate environment. Establish clear, accessible channels for employees to report security concerns, suspicious activities, or potential incidents with protection from retaliation and recognition for proactive reporting.
How do these components fit together?
How does a Zero Trust architecture verify users and prevent malware?
The very first step is to verify whoever wants to access the network and absolutely nobody should be allowed to access implicitly. An effective Zero Trust system should have a variety of technical features to accomplish the security checks needed for identity verification. It is recommended that you should mandate one of the following methods for identity verification:
- 2FA: 2-Factor Authentication with a card and a pin.
- MFA; Multi-Factor Authentication with a username, password, and token.
- Passwordless authentication.
Identity, Credential, and Access management (ICAM) ensures that the right people have access to the right resources at the right time and these accesses be removed when not needed. Once you verify the identity of a person, you bind it with credentials, and use those credentials as access points to assets. Coupled with this, Privilege Access Management (PAM) ensures that no one is given privileges to access resources, and everyone is treated equally in the Zero Trust framework.
Now, with ZTNA, the user has application-level access and not network-level access, so the traffic is routed directly to where the user wants to go: the application, which is hidden behind a firewall. Once you’ve verified “who” is accessing a resource, the next step is to verify “where” this access request is pointing towards. Different applications have varying levels of security mandates and access limitations. For example, accessing an app on the internet like YouTube will not have the same restrictions as accessing the ERP. When access is requested, a Zero Trust solution factors the identity of the initiator plus the context of the destination application, allowing for more granular access control. Therefore, all applications are treated equally as independent applications but are restricted based on user access level i.e. if you don’t have access to the ERP, you request will be denied.
The next step is where a Zero Trust architecture plays critical role in minimizing attacks with dynamic risk calculation. Throughout the users access to an application, a Zero Trust solution plays close attention to user behavior; a marked change in user/device posture or behavior can trigger an update on the access decision, updating the access score. With advanced ML solutions like UEBA, potential threats in the system are detected early. Based on user behavior, the solution differentiates between risky and benign decisions. This is where SIEM and SOAR capabilities can come into play as they automatically determine risks and respond to them instantly.
Inbound malware can often get encrypted and remain hidden with the bulk of traffic moving into the network. Therefore, it’s important to constantly monitor and create a transparent system where these irregularities can be instantly caught. Your Zero Trust architecture should be able to scale to function as an SSL/TLS that provides complete inbound and outbound content analysis able to immediately block threats detected anywhere in the enforcement plane. Part of the prevention protocol demands implementation of CASB for protecting the data at rest. This prevents sensitive information from being shared via open internet links or handed over to unauthorized groups. Such solutions can scan cloud apps for dangerous malware and leverage AI/ML-enabled sandboxing to quickly identify files that shouldn’t be mixed in with sensitive data. With further data loss protection (DLP) protocols across all channels, you can get automated policy enforcement for unauthorized data exfiltration. You can also leverage predefined and customizable DLP dictionaries for SaaS and public clouds like AWS.
If a malware happens to get through the security parameters and infects an application, that’s where network security features can prevent immediate spread. Because users, devices, and workloads are connected directly to destination services without being places on the routable network, the risk of lateral threat movement is removed. Resources sitting behind the Zero Trust Exchange are not discoverable from the internet or corporate network, eliminating the attack surface. Malware who are able to steal credentials and move into applications will not be able to learn, connect, or even identify network-level information. When such an attack gets isolated from segmentation, it becomes exponentially easier to identify and contain the risk within that resource. A Zero Trust system works on so many levels and with each level, it becomes even more difficult for external malware to spread viciously throughout the organization.
Your Zero Trust journey is a process, not a destination
Any organization will never completely be free from cybersecurity concerns because there are no limits to how mature a Zero Trust infrastructure can become. These implementations discussed throughout the article are components that can help you strategize an effective plan for a progressive architecture getting stronger at each phase. You can think of it as a starting point for your security efforts and keep diving deeper into the intricacies of building a truly secure organization that not only prioritizes secure protocols but also educates its employees on potential risks and how to avoid them.
