Transcription:
Hi. Welcome to this short video to explain the principles of zero trust, Zero trust network access and why that's important in the modern era of cyber security.
We start by taking a step back and understanding the fact that maybe 5 or 10 years ago, we all used to work in offices, and these offices were deemed as secure and trusted environments. We might get access to the office through a central front door using a card system or swipe card system.
Once we were inside the office, we had access to the applications because we were trusted. Sometimes we hear this termed as ‘castle and moat’, the fact that there is a single entry point into the secure perimeter. In olden times, that would be the drawbridge, but obviously, in ‘castle and moat’, that's more a perimeter firewall, potentially, or a person checking access for credentials. Then once we're inside, we have access to the tools that we need.
We've represented that here on the board today.
We have our secure perimeter. All of our applications are inside the secure perimeter. And we have an application here, for example, application here, application here. We also have other apps that potentially aren't of use to us in terms of our role. So the fact that those applications exist in the same physical space in our analogy here, as the applications that we need in terms of performing our role, that's going to become really important when we go through why implicit trust, so once we're in the secure perimeter is no longer fit for purpose.
So let's imagine we have a laptop here.
So we have our endpoint, and this is the device that we use to access our applications, remembering that we usually enter the physical premises to be able to access those applications.
If we're working remotely, traditionally, we use something called a VPN. A VPN provides an extension of the network at home into the secure boundary, the secure perimeter here. So we might have a VPN tunnel that comes in here and terminates here.
Castle and moat with VPN and endpoint shown
And that gives us an extension of the network and allows us to use credentials, username and password, to be able to access this secure perimeter. But obviously, once we're inside the secure perimeter, we become trusted. We have verified our identity, our username and password and credentials. And now we become trusted.
Typically, when we were working in offices, we would use the applications that we needed to access. So HR personnel would access the HR application, finance the finance application, remembering that all of those reside typically in a physical premises. And this could be a physical data centre that resides elsewhere. But we are trusted now that we've been through this check. Everything was all well and good.
Unfortunately, now that cyber criminals have more advanced tooling and can steal credentials and access to this secure perimeter, we can no longer give implicit trust, because we no longer can be sure that the person on this laptop, the person on this endpoint, is the person that their credentials say that they are. So compromised credentials through phishing attacks, etc., are commonplace now.
So it might not be that ‘Darren’ is accessing the applications through ‘Darren's’ credentials. It could be a threat actor that had stolen ‘Darren's’ credentials. So the threat actor in this instance accesses the secure perimeter. And once they're verified, they now have access to all of these applications within the secure perimeter, not just the ones that potentially ‘Darren’ would need. So that's obviously a massive problem. Some of these applications contain sensitive data, information about the corporate finances, for example. And we certainly don't want the threat actor to have access to that. So how do we fix this?
Well something called zero trust network access flips this concept of implicit trust inside the perimeter, and talks to not granting any trust at all. Having zero trust. So having additional controls, not just the person here in the gate, but having further controls to say, this particular endpoint, does it have the correct security credentials? Does it have the correct anti-malware antivirus?
A number of conditional access mechanisms to say that this particular endpoint can or can't access the applications. In today's modern world, these applications aren't in a particular physical infrastructure. They could be in somebody else's data centre or in a public cloud, making sure that the endpoint is secure, making sure that the user is the person that they say they are through additional identity mechanisms such as multi-factor authentication and having a layered approach to cyber security.
That means that we understand who the person is, their job role, their identity and credentials, and making sure that user has access to the applications, and only the applications that they need. So in effect, the user could use something like this. But for my role I might only need access to the HR applications. So for me, the only thing that I see is the HR application. And all of these are obfuscated from view. I can't get access to them and therefore, the threat actor can't get access to them.
Zero Trust approach to security diagram
So, limiting the ability for the threat actor to take advantage of implicit trust, and really reducing the blast radius down to only the role, only the user, and only the security credentials, is a much more proactive way of implementing cyber security.
So, hopefully that brief whistle-stop tour gives you a flavour of the difference between implicit trust and zero trust. We'll be exploring more themes as we do more of these light bulb series in the future.
