In this short blog series Stuart Charters, one of our Integration Engineers, will describe his experience learning about the Zero Trust security model.
Zero Trust sounds like the mantra of conspiracy theorists. Far from being a prediction of the downfall of society, it’s a new access management model about being proportionate and specific with trust checks. It improves not only the security but aims to improve the user experience as well. Let’s take a closer look at the problems we face and how Zero Trust can help.
What is wrong at the moment?
Data breach reports are becoming more frequent, and with over 10 billion user details breached in 2019 these attacks can have wide reaching consequences. Historically, many organisations focus on security when the user first arrives, controlling a perimeter and allowing free flowing user activity once inside.
However, this approach produces a honeypot of data that attackers can’t resist trying to get into. Zero Trust makes sure there isn’t a single pot that can be broken into. Rather it relies on checks throughout the user’s journey to provide constant trust evaluation. This moves the service towards a position where zero trust is assumed from action to action in the user journey.
If we implemented knowledge-based credential checks on every action, this would lead to a terrible user experience and no users. Although this would remove the issue of data protection it is a problem we want to solve rather than remove. Knowledge-based credentials also have the issue that we are only human, there are only so many passwords and ‘memorable’ data questions that we can remember. This information is often replicated across services and varies in strength for the sake of memorability. Ensuring the highest security shouldn’t be the responsibility of the user.
What can be done?
So, assuming we want users and to protect their data, how can we minimise friction whilst re-evaluating trust at every step?
The Zero Trust model encourages us to use a policy-driven approach where we define specific policies appropriate to the context of each request. Driving these policies are then attributes of the request and user to allow the trust signals to be assessed. There are many attributes associated with a user’s interaction that don’t require the user to input; for example we can detect anomalous user behaviour by analysing patterns over the whole customer base and on individual levels, or we can perform device profiling to understand if malicious applications are running on the device. Traditional, knowledge-based policies can still be used to reassure the customer that the system is secure. Mixing explicit with passive trust attributes also provides a broad view of security that is more difficult to crack.
Applying different policies for different request contexts makes it much more difficult for attackers to find the path through. Being contextually aware also allows trust to be assessed to the appropriate level for the action being performed. This can reduce costly checks being made for low risk actions.
How can we help?
Symphonic’s Policy Decision Point (PDP) provides a context-aware way to pull these different trust measures together using attribute based access control (ABAC). This information is gathered in real-time through easy service integration, allowing you to have confidence that the trust evaluation is current and accurate.
To understand if there is anything more we can do to improve the Zero Trust implementation, we are dogfooding Symphonic and setting up our own ‘Zero Trust framework’ for our internal development team. We will be releasing future posts here on the website, following our progress and discussing challenges as we go. If this interests you, follow us on LinkedIn to get notified when our next post comes out. Also, if there are any questions or areas that you are particularly interested in let us know and we will try to tackle them in future instalments.
Author – Stuart Charters