Zero Trust Is Necessary But Not Sufficient For Security

Zero trust security models, the latest craze in cybersecurity, are based upon enforcing the principle of least privilege, where users and applications are only granted the permissions necessary to do their jobs. Implementing user access reviews is crucial for companies who wish to maintain internal system controls and determine which systems their employees should have access to and which ones they shouldn’t.

A zero trust architecture is designed to apply and enforce these security controls. All traffic passing through the enterprise network has access control policies applied to them, and any unauthorized requests are blocked. This helps to decrease an organization’s potential exposure to cybersecurity risk by minimizing attackers’ ability to move laterally through the network or gain access to the resources needed to perform their attacks.

IMAGE: UNSPLASH

Where Zero Trust Security Falls Short

Zero trust security is a useful tool and an essential component of an enterprise cybersecurity strategy. However, despite all of its benefits, there are certain types of cyber threats and attacks that zero trust is not able to protect against.

Insider Threats

Zero trust security is designed to implement and enforce role-based access controls. Every account on the system is assigned the permissions necessary to do its job and no more. This helps to protect against lateral movement of an attacker by restricting the systems, data, and other resources that they can access.

However, zero trust is based on the assumption that an attacker lacks authorization to access the resources that are needed to achieve their objectives.  In the case where an attacker is an insider – a legitimate user on the system with access and permissions assigned based upon their role in the organization – then the malicious user may not need any additional permissions to perform their attack.

A classic example of such an attack is a departing employee bringing documents that they produced to their next position. While the documents belong to the company, the employee has full access to them. As long as that access remains, access controls provide no protection.

Malware / Phishing

Zero trust access controls are only effective in protecting against attacks where the attacker does not immediately gain the permissions required to carry out their objectives. Another example of this is a malware or phishing attack.

While ransomware may have the capability to spread through the network, it is common for ransomware to encrypt the files of the initially compromised user. Under these circumstances, where the ransomware is running with the same permissions as the user, it has all of the access and rights that it requires to encrypt that user’s files.

More generally, this is true of any phishing or malware attack whose initial access point is the desired account. Like an insider threat, these attacks only need to use the permissions that they have available to them to carry out their objectives.

Supply Chain Attacks

Zero trust security models are based upon the concept of managing access to an organization’s resources. The assumption is that threats will largely originate from user accounts, public-facing applications, or other external sources.

However, this implied assumption that certain resources are themselves trustworthy is not always a valid one. While a particular system or software may be developed by a trusted organization, it can still be corrupted via a supply chain attack.

In a supply chain attack, the attacker compromises a supplier or vendor outside of the organization and uses their trusted relationship to gain access and carry out their objectives. This trusted relationship could be an account on the enterprise network and systems or something like the ability to send executable code – in the form of software updates – to be installed and run on enterprise systems. In these cases, the supply chain attack creates an insider threat scenario or violates the assumption that certain systems are trusted.

Implementing Comprehensive Security With SASE

A zero trust architecture can help to dramatically decrease an organization’s exposure to cyber threats and cyber risks. By limiting access to an organization’s data and other resources, zero trust limits an attacker’s ability to move laterally through the network, a capability that is essential for many attacks.

However, zero trust security is not sufficient for security. Insider threats, malware, phishing, supply chain attacks, and other cyber threats have the ability to bypass the protections that a zero trust security strategy can provide.

This is why zero trust should be deployed as a complement to existing cybersecurity strategies, rather than a replacement. Zero trust limits the damage that an attacker can do with access to an enterprise network, and other cybersecurity solutions work to block an attacker from establishing that initial foothold.

Secure Access Service Edge (SASE) solutions enable an organization to deploy a comprehensive security solution. Zero trust is a core part of a SASE solution’s security stack, but it is not the only component. By complementing zero trust network access (ZTNA), with next-generation firewalls (NGFWs), secure web gateways (SWGs), and similar solutions, SASE provides a comprehensive enterprise cybersecurity solution.

If you are interested in even more technology-related articles and information from us here at Bit Rebels, then we have a lot to choose from.

IMAGE: UNSPLASH