Zero-trust architecture, while widely recognized as essential to modern security, has earned a reputation as a daunting undertaking. John Kindervag, who is credited with defining the zero-trust approach in 2010 when he was a principal analyst at Forrester Research, would like to bust that myth.
Granted, zero trust is not a quick fix. “People want to buy a product, and they want it to be easy, and they want to do just one thing — that’s human nature,” said Kindervag, who’s now Chief Evangelist with Illumio, which provides solutions for network segmentation. “But cybersecurity is a phenomenally complex system, and it’s a system of many parts that all have to interact to be successful.”
A 5-Step Process
If agencies take a methodical approach to zero trust, they are likely to find that it is more manageable and less expensive than they think, he said. With that in mind, Kindervag has developed a five-step process for implementing zero trust:
- Determine the protect surface, which includes data, applications, assets and services (DAAS).
- Map the transaction flows, looking at how the different elements interact and how data flows through the network.
- Once you understand how the network works, create the zero-trust architecture, implementing the controls to safeguard your protect surface.
- Define the policies for enforcing zero trust.
- Monitor and maintain it.
Note that the first step is to identify what you need to secure — that is, your protect surfaces. Rather than building a comprehensive zero-trust architecture, agencies can begin small by focusing on specific DAAS elements, Kindervag said.
“You take a single DAAS element, you put it into a single protect surface, and you build out your zero-trust environment one protect surface at a time,” he said. “In this way, zero trust becomes incremental.” Many organizations make the mistake of trying to deploy zero trust across their entire organization, he added, “and that will never work.”
The Foundation: Network Segmentation
Kindervag says the foundation of this approach is network segmentation. The idea is to implement security controls within the network, breaking up the protect surface into “bite-sized chunks” that make it easier to control access to those DAAS elements. Segmentation plays a critical role in the event of a network breach. Traditional security measures lean hard on identity management and multifactor authentication to manage the perimeter, but credentials can be stolen or trusted individuals can go rogue, which lets malicious actors roam freely. You can block that lateral movement by breaking the network into small segments and limiting who has access to each segment.
By taking a methodical approach to building their security architecture from the ground up, agencies can go a long way to making zero trust both manageable and effective, Kindervag said. “I’ve been doing this for a long time too, for a lot a different systems,” he said, “and it’s something that translates to every single DAAS element that I’ve run across.”
This article appeared in our guide, “Government Gears Up for a Better Cyber Future.” To see more about how agencies are keeping on top of security basics, while staying agile enough to respond to emerging threats, download it here:
