Category: Blog

Secure Access Service Edge and Zero-Trust: The Ultimate Security Solution

With more businesses going hybrid or fully remote and data breaches on the rise, organizations are scrambling to ensure data and application security at every level. As security has become even more paramount, more and more organizations are implementing a zero-trust security model, which has slowly become the standard for cloud security.

But savvy organizations are also deploying more advanced security principles, including secure access service edges (SASE). And despite occasionally being incorrectly positioned as either/or solutions, zero-trust is actually a foundational part of a SASE architecture.

Let’s explore how this dynamic duo works together to create even more secure networks and cloud environments.

What is SASE?

Gartner coined the term SASE just a few short years ago, in 2019, to explain an emerging cybersecurity principle, which integrates security into the network architecture to deliver consistent and secure access, no matter where users, applications, or data are.

It brings together wide area networking (WAN) and network security services, including cloud access security broker (CASB), zero-trust, secure web gateway (SWG), and firewall as a service (FWaaS) into a single, cloud-delivered service model.

What is Zero-Trust?

While zero-trust and SASE are newer philosophies, zero-trust is a bit more established. Forrester Research first coined the term in 2010 to sum up the principle of least privilege (POLP) to network access.

Zero-trust is a strategy based on the idea of “never trust, always verify” that requires continual authentication and verification before granting access to your network, data, and applications. A few tenets include:

• Implementing a POLP strategy and strict access control
• Ensuring secure access to resources from anywhere
• Inspecting and logging all traffic

How do SASE and Zero-Trust Work Together?

When you think of SASE and zero-trust, think of them as parts of the same security vision. They both work to protect your data, applications, and assets in the cloud using dynamic perimeters and user verification.

SASE deploys security via the cloud, whereas zero-trust uses the POLP principle to ensure security. But instead of working separately, zero-trust is part of the SASE framework. SASE is what establishes and enables zero-trust network access (ZTNA).

SASE combines network and network security components in a single cloud-based service—one such component is ZTNA. Without ZTNA, there’s no point in deploying SASE. But once you implement ZTNA and build it into your SASE architecture, you can consistently enforce your security policies throughout your entire network, providing much stronger network security.

Together, SASE and ZTNA allow for the decentralized network distributed teams need while providing high levels of security. Users get the access they need—from any location or device—and organizations get the security they need to protect assets and data.

Ready for SASE and Zero-Trust?

Whether you’re looking to ramp up your security efforts or have implemented parts of your SASE architecture but need help rolling everything out, Lightstream is here to help. Our team of experts has decades of experience with cloud security and partner with industry leaders to deploy zero-trust and SASE solutions.

If you’re ready to get started or have questions, reach out to Lightstream.

As data breaches and cyberattacks have become commonplace, organizations are finding themselves doing more and more to defend themselves and improve their network and cloud security. One such effort includes developing and deploying a zero trust strategy, which, at its core, follows the “never trust, always verify” principle. Implementing a zero trust strategy and architecture can prevent cybersecurity attacks, including data breaches.

Zero trust is an augmentation of your existing architecture, making it simple to deploy, regardless of your technology. Implementing zero trust takes an iterative approach that allows you to learn and reflect before adding any improvements to new iterations—all of which help build a more resilient and secure environment, made up of people,  processes, and systems..

Ready to get started? Follow the 5-step method outlined below to deploy a zero trust network within your organization.

Step 1: Define the Protect Surface

As attack surfaces continue to expand, it’s no longer feasible to work endlessly to reduce them. It’s hard to define or defend against, which is why zero trust focuses on a protect surface instead. Identify the data, applications, assets, and services (DAAS) elements you want to protect and encompass them in your protect surface. Each protect surface contains a single DAAS element, and every zero trust environment has multiple protect surfaces.

Your DAAS elements help define the sensitive resources that should go into individual protect surfaces. This includes:

1. Data. The sensitive data that can wreak havoc if it’s misused or exfiltrated. Examples include payment card information (PCI), protected health information (PHI), personally identifiable information (PII), and intellectual property (IP).
2. Applications. The off-the-shelf or custom software applications that interact with sensitive data or control critical assets and business processes.
3. Assets. Often, these include information technology (IT), operational technology (OT), or internet of things (IoT) devices such as point of sale terminals, SCADA controls, manufacturing systems, and networked medical devices.
4. Services. Sensitive services that are exceptionally fragile. Examples include DNS, DHCP, ActiveDirectory®, and NTP.

Step 2: Map the Transaction Flows

Mapping the transaction flows to and from the protect surface shows how various DAAS components interact with other resources on your network, helping you determine where to place the proper controls and how to protect data. How traffic moves across the network, specific to the data in the protect surface, determines the design.

As you map your transaction flows, ask yourself:

1. Can I do this on my own?
2. Do I have the capabilities and technologies to extract the flow of information from my environment?
3. Do I have the technology in place that can do data discovery or flow identification?

Next, identify users’ density and privileges, applications, and services and map the transaction flows between your protect surfaces to document which traffic or transaction flows are active between the protect surfaces.

Step 3: Build a Zero Trust Architecture

Because zero trust frameworks are decoupled from technology, they can be completely customized—they are built around protect surfaces. The next step is to define and build a zero trust architecture, including associated security measures. Start with a next-generation firewall that acts as a segmentation gateway, creating a micro-perimeter around your protect surface.

According to Palo Alto Networks, you can enforce additional layers (all the way to Layer 7) of inspection and access control for anyone or anything trying to access the resources defined within your protect surface.

Step 4: Create a Zero Trust Policy

The next step in implementing your zero trust strategy is to create a zero trust policy. You need to instantiate zero trust as a Layer 7 policy statement, which requires Layer 7 controls. Use the Kipling Method of zero trust policy writing to determine who and what can access your protect surface.

The Kipling Method answers the who, what, when, where, why, and how questions, allowing you to define:

1. Who should be allowed to access a resource?
2. What application is used to access a resource within the protect surface?
3. When is the asserted identity allowed to access a resource?
4. Where is the resource located?
5. Why is the user allowed to access the resource within the protect surface?
6. How can a user get access and through which application?

Step 5: Monitor and Maintain the Network

The final step of the 5-step methodology is to monitor and maintain the network. It involves inspecting and logging all traffic, including through Layer 7. The telemetry this process provides doesn’t just help prevent data breaches and other significant cybersecurity events, but also provides valuable security improvement insights. Each protect surface becomes more robust and better protected over time.

Remember, zero trust takes an iterative approach, so inspecting and logging all traffic will provide insights that can help you improve your network, iteration over iteration.

Implement, Learn, and Repeat

After you’ve worked your way through this methodology, you can expand and iterate to fully move your DAAS elements from your existing network to a zero trust architecture that can better protect your data. Use this approach and the Kipling Method to get started and take your learnings from each iteration to improve. And if you need help getting started or maintaining your zero trust strategy and architecture, we’re here to help. Contact us today to get started.

Every Zero Trust strategy follows this simple principle: never trust, always verify. Building a Zero Trust architecture prevents cybersecurity attacks and data breaches using protect surfaces. Organizations build many of these protect surfaces around their most valuable data, assets, applications, and services (DAAS), significantly reducing the overall attack surface to better protect their businesses.

These 3 Simple Concepts to Consider with Zero Trust  have remained the same since John Kindervag coined the term “zero trust” in 2010. They are:

1. Trust
2. Access control
3. Logging and inspection

Let’s first explore the concept of trust.

Concept 1: Trust

The “never trust, always verify” concept centers on Kindervag’s claim that removing trust from a network makes it natural to ensure secure access to all DAAS elements, regardless of who creates traffic or where it comes from. Eliminating trust means assuming that all traffic is a threat until it has been verified that it is authorized, inspected, and secured. Kindervag suggests starting with the protect surfaces that need protection and working your way outward.

Concept 2: Access Control

The second concept, access control, should help determine who needs access to a specific resource to do their job. Many organizations give too many users access to sensitive data instead of implementing the Principle of Least Privilege. This principle states that a user should only be granted access to those privileges necessary to complete a task. If they don’t need access, they shouldn’t be given access.

In a Zero Trust architecture, a user asserts their identity and will then be granted access to a particular resource based on that assertion. They’re restricted to the resources they need to perform their job only. Kindervag suggests using the Kipling Method to create easily understandable access policies.

Concept 3: Logging and Inspection

The third concept dives into the “always verify” part of zero trust. Instead of inherently trusting users to do the right thing, you must verify they are doing the right thing. You can do this by logging and inspecting all traffic coming to and from protect surfaces for malicious content and unauthorized activity (through Layer 7).

Instead of taking a reactive approach, logging and inspection in a Zero Trust environment is proactive, acting as a foundation for real-time protection and ensuring you deploy all your protect surface policies correctly.

Ready to Deploy Zero Trust?

Are you ready to implement a Zero Trust environment in your organization? We work with partners like On2It to walk through these three concepts, the Kipling Method, and implementation to ensure your business is as secure as possible. So, if you’re ready to move to a Zero Trust architecture, contact us today to get started.