The Missing Piece in the Zero Trust Model

With rapid adoption of cloud, IoT and DevOps automation, the traditional approach of trusting devices within a network perimeter is no longer applicable. There is a growing need for a new model capable enough to provide enhanced security for modern enterprises. Hence, the zero trust model has emerged as a possible solution that is being widely adopted.

At a high level, the zero trust model assumes a no trust approach for both internal and external users, systems and services. It is a collection of concepts and ideas designed to reduce uncertainties in enforcing accurate, per-request access decisions in information systems and services in the face of a network viewed as compromised.

Zero Trust model holds that devices cannot be trusted by default even if they belong to a managed corporate network or have been verified before. Access is limited (and not assumed) by micro segmentation or small security zones at the host, application and at the data layers.

For example, at AppViewX, the product architecture supports a zero trust model where traffic between the services in the mesh is encrypted, connections within our mesh are explicitly permissioned and so on. Since the product was built with a microservice and cloud first design, this was a possibility, unlike legacy and monolithic architectures where everything is connected and one compromise can get to all resources.

Companies adopting zero trust model start with segmentation, implementing privilege access management, multi-factor authentication, vulnerability and patch management and security analytics. But they miss out on one key area, which is about managing machine identities through digital certificates and keys. This is the missing piece in this model. It ignores the risk with compromised encryption tunnels while focusing heavily on access controls.

The number of machines, cloud workloads, containers, IoT and mobile devices that access resources are very high and are increasing at a rapid pace. At the same time, errors related to machine identity management such as expiry of certificates, weak cipher suites, compromised or fake certificates and keys are causing significant risks for businesses across the world.

Hence implementing a next gen certificate lifecycle automation solution is a key initiative towards achieving a fully functional zero trust model. This will bring in a policy driven approach to machine identities management and a mature process automation for BAU (business as usual) as well as incident response scenarios. It also enables organizations to digitally transform by supporting DevOps and multi cloud architectures.

With a rapid and progressive adoption of machines over cloud networks, certificate lifecycle automation solutions have become an integral part of the zero trust network crucial for an organization to achieve cybersecurity resilience.

The post The Missing Piece in the Zero Trust Model appeared first on AppViewX.

*** This is a Security Bloggers Network syndicated blog from Blogs – AppViewX authored by Anand Purusothaman. Read the original post at: https://www.appviewx.com/blogs/the-missing-piece-in-the-zero-trust-model/