Zero Trust in Reverse: Why the Current Definition of Zero Trust is Only Half Full
- Zero Trust is a must for securing your applications and data
- We need to reverse the Zero Trust model to stop trusting all applications and data
- Isolation technology is the key to having end-to-end, bi-directional Zero Trust
With the shift to hybrid work and a cloud services first approach to business applications and data, Zero Trust security architecture has thankfully gained adoption as it is a key element in reducing the risk of data exfiltration due to a breach. In this post I will detail why the current definition for Zero Trust security is only 50% complete and why we need bi-directional Zero Trust to reduce the attack surface and risk of breach.
What is Zero Trust
Zero Trust has already been well defined, but I’ll give a quick layman’s summary. Zero Trust is a security approach where users and devices are not automatically granted access to data or applications simply because they are on a given device or network or have successfully authenticated once. With Zero Trust every connection that is made to an application or data service is re-evaluated and reauthenticated to ensure that the user and connection should be authorized.
To understand how Zero Trust provides protection let’s imagine this scenario. A user clicks on a malicious link and malware gets loaded onto their PC. In a legacy environment any process the threat actor starts (which can run hidden) will automatically be running on the user’s device as the user. This means the threat actor can access any data or application services and it appears as if the user is doing it. Worse yet, because of implicit trust and legacy SSO, none of the applications or data repositories prompt for authentication so the threat actor is free to do what they want. In a proper Zero Trust environment the new process started by the threat actor would be prompted for reauthentication, which would hopefully prevent the remote threat actor from accessing the application or data.
For a more detailed definition by people much smarter than me, check out NIST standard SP-800-207 that has been written for Zero Trust.
Why Today’s Zero-Trust is Only Half the Story
Today’s Zero Trust definition and architecture is myopically focused on protecting your applications and data from a device or user credentials that have already been breached. Zero Trust says that the application or data repository should not trust you or your device by default. However, why can’t we flip the Zero Trust approach around, so you and your device do not trust web applications or data by default?
In today’s world the majority of breaches start with a user on a PC. The user clicks a link, the user opens an email attachment, the user opens a file from USB drive, etc. In these situations the user is introducing an application or content onto their PC, which turns out to be malicious. Performing these normal user activities is like inviting someone into your house. Imagine your PC is your home. Every time you click on a link, download a file from the Internet, or open an email attachment, you are inviting that content into your house. Imagine if all the things you click on and view on the Internet were real people, would you trust them to enter your home?
Zero Trust principles can be used to solve this problem and prevent many of the initial breaches from occurring in the first place. Why are you opening that email attachment on your PC and letting it have access to your device? Why are you clicking on that random link and letting that webpage run on your PC? Have you made a decision that you explicitly trust that email attachment or link?
Implementing Isolation for Complete Bi-directional Zero Trust
Isolation technology is the missing component that can complete Zero Trust and turn it into bi-directional Zero Trust. With Isolation technology we can implement a security architecture that does not implicitly and automatically trust every website, email attachment, or file and allow it to run natively on your PC.
There are several ways in which Isolation technology can be implemented to achieve Zero Trust principles on your endpoints. The methods involve running untrusted content inside a disposable container. Whether it is a website, file download, or email attachment, the content can be opened inside a container. The container is isolated from the true operating system context of your PC and has no access to your PC or any of your data. Allowing the content to first run in a container provides the user with safe access to the content. If the website or file download turns out to be malicious, it is the disposable container that is comprised, not the user or the PC. The container can simply be thrown away along with the malware that is isolated inside. These containers can run securely on your PC or can be run in the cloud.
Here at HP we have been developing and continually enhancing our Isolation technologies that we acquired as part of our Bromium acquisition in 2019. Today, our Sure Click isolation technology is part of our Wolf Pro Security offering for small businesses, and available in an enterprise version for larger or more mature organizations. Using our Sure Click software, we can run secure containers seamlessly on Windows 10/11 endpoints, including Windows PCs not manufactured by HP. By running containers on the endpoint, we are able to provide a more seamless end user experience and also protect content and threat vectors that go beyond web and email such as files on USB drives. Check out the following demo video that highlights how our Sure Click Enterprise isolation technology works.
Whether you implement a technology like Sure Click to run isolation containers on your endpoints or you are implementing cloud-based isolation containers using cloud proxy solutions, making Isolation a part of your Zero Trust strategy is how you will take Zero Trust from being one-directional to being a true bi-directional Zero Trust architecture that makes the glass full!
Tags
About the Author
