Zero Trust Architecture, Practical Considerations for Implementation

In our blog post, Zero Trust Architecture: Best Practices for Safer Networks, we introduced one of the hottest topics in security today, zero trust architecture. We not only defined it, but also walked readers through the steps you should take to put a zero-trust architecture in place across your network.

This post will expand on that, walking you through the steps you’ll need to take to implement a zero-trust environment. You’ll learn:

• The problem and its challenges
• Tackling the challenges
• The capabilities of various zero-trust solutions

No two organizations are alike

Today’s cybersecurity teams face ongoing challenges when it comes to safeguarding their networks but one of the biggest issues you’ll deal with when implementing a zero-trust architecture is that no two organizations are alike. We have to accept the technological differences between organizations, the fact that some will be further in their cloud adoption journey than others and that legacy systems and services vary widely from one to the next, creating unique challenges for each of us. However there are core principles that connect all zero-trust environments and these are:

• Robust identity management architecture
• Strategically defined micro-segmentation and trust zones
• In-depth logging and event monitoring capability

The approach you’ll take will vary from how another organization will implement zero trust. It’s critically important to assess where your assets are located (users and data), then look at what technologies are available within your existing environment to support zero-trust capabilities. From there you can start to build out a roadmap of the additional functions required to work towards more complete coverage in zero-trust adoption.

Security teams must also consider how to adopt zero trust in our cloud environments, ensuring complete visibility and monitoring coverage across a hybrid operational model (cloud and on-premises). It is important to regard both our on-premises (also to include home workers) and cloud infrastructures as homogenous when implementing processes or technologies from a zero trust adoption perspective.

Reporting and monitoring

Another challenge cybersecurity teams face is transparency. Some cybersecurity teams know about zero trust, but struggle to effectively report on adoption and coverage, not least where the risks lay across the organization, in terms of visibility and monitoring of critical assets. The ongoing issue is that demonstrating your organization’s adherence to zero-trust principles can be tough: It is critical to ensure continued investment and support from leadership as you mature your adoption of zero trust. Effective  measurement of your zero trust capability and maturity model is necessary to effectively report back to your leadership team and ensure continued support and investment. Without visibility, your team also will have a hard time managing the unknowns that are always present when you’re managing a network. A business’s devices are increasingly spreading out, thanks to the steady growth of bring-your-own-device (BYOD) policies and distributed workforces. You need to be able to identify and monitor every piece of equipment on your network, but it’s tough to do so with existing tools.

Even if your team can identify every user and device, monitoring them is beyond a full-time job. You may think you know what “normal behavior” is for every user and device but detecting anomalies in a sea of connected entities can be a big challenge. 

Tackling the challenges

Most organizations turn to siloed technology tools to make sure that they have a way to track everything at once. Unfortunately, that isn’t practically feasible due to obstacles like identity management restrictions.

For organizations that want to implement zero-trust architecture, legacy infrastructure seems, on the surface, to present a significant challenge. The zero trust framework  has to be embedded into the organization’s infrastructure and security policies, which leads some organizations to erroneously assume that legacy systems are tough to bring into a zero-trust ecosystem. But by using the right data classification and segmentation setup across key data environments, cybersecurity teams can effectively implement a good standard of zero trust across the entire environment, including those legacy corners.

The solutions

Ultimately, zero trust is focused on helping organizations identify (at a user and device level), the most minute differences in activity,  enabling the identification of deviations from standard policy controls and normal activity baselines. If security teams can achieve this capability, they will be in an infinitely better position to detect and respond to malicious events early in the attack chain.

The key to effectively building a zero-trust architecture is the ability to set a baseline for what is normal. That will help you more easily identify any unusual behavior. User and entity behavior analytics (UEBA) uses the latest artificial intelligence to create a “trust profile” for every credential and device, which will build that baseline you need. It provides a technology fabric that enables organizations to connect-the-dots within a zero-trust environment, with data and content enrichment to support effective mitigation strategies.

When combined with timelines, UEBA can help cybersecurity teams easily see events in chronological order. This gives analysts the context necessary to quickly investigate incidents and get to the root of an issue. Dynamic watchlists can also give analysts the ability to home in on unusual activity for specific entities on a network to make sure an abnormality doesn’t become a problem.

Exabeam combines these tools with security orchestration, automation, and response (SOAR) technology to give analysts a practical way to incorporate zero-trust principles into their existing threat detection methods. Instead of manually responding to every untrusted event, Exabeam lets analysts take corrective action on alerts.

With the right solutions in place, cybersecurity teams can easily build a zero-trust architecture in their environment. Exabeam’s solution focuses on equipping analysts with the support they need to easily identify and take action on abnormal activity within their networks. 

If you missed the first post about zero trust, click here to read Zero Trust Architecture: Best Practices for Safer Networks.