Improve Security with a Zero Trust Model

We’ve talked about how zero trust is superior to traditional perimeter-based defenses in today’s world of cloud-based applications, off-site data storage and remote work. Let’s give some concrete, real-world examples through common kinds of security breaches. We’ll explain how zero trust principles and methodology can better defend your network from these attacks and, in the case of a breach, contain the damage.

1. Misused Passwords and Phishing

Stolen or misused credentials remain the one of the most common causes of a breach. The Verizon 2021 Data Breach Investigations Report attributed 61 percent of breaches to leveraged credentials. One common way malicious actors steal credentials are through phishing attacks — using false identities to try and pry information from someone within an organization.

Last year, a 17-year-old spoofed a Twitter employee’s phone number by SIM-swapping, created fake Okta login pages for Twitter employees and convinced one employee he worked in Twitter’s IT department. Once he gained the credentials he needed to access Twitter’s network, he hijacked and posted a bitcoin scam from Twitter accounts belonging to, among others, Barack Obama, Joe Biden, Bill Gates and Elon Musk.

Zero trust architecture reduces the surface attack area by eliminating all passwords, save for one, through single sign-on. Context-based policies trigger multifactor authentication (MFA), providing further security in the case of misused or stolen passwords. And more tools are rolling out that allow zero trust enterprises to eventually evolve to a passwordless environment.

2. Ransomware and Malware

A ransomware attack on Colonial Pipeline in May 2021 forced the fuel distribution company to eventually shut down its entire network, catapulting U.S. gas prices above $3 per gallon for the first time since 2014. Colonial Pipeline ultimately paid $4.4 million worth of bitcoin to the attackers to get their system back. The likely source of the breach was a leaked password to an old account that had access to the company’s VPN.

Beyond the additional security around passwords outlined above, a zero trust architecture eliminates the need for VPNs, which grant complete access to a network. Instead, zero trust requires providing access only to the resources that the user or device has explicit permission to access. With segmentation of network resources and data, it becomes harder for malicious code that somehow gets into one area of the network to spread to other areas of that same network. Any attempts to access a new area of the network will require authentication again, and MFA where required by your policies.

3. Denial-of-Service (DoS) and Distributed-Denial-of-Service (DDoS) Attacks

Denial-of-service attacks flood networks with traffic to cause shutdowns and distributed-denial-of-service attacks hijack other devices to send the traffic flood from multiple sources, making it harder to stop. These attacks are rising; since the beginning of the COVID-19 pandemic, DoS attacks have increased three-fold to close to 30,000 attacks per day, according to The Cambridge Cybercrime Centre. Such an attack last year shut down the New Zealand Stock Exchange.

In a zero trust environment, the continuous verification of identity and principle of least-privileged access can help protect against denial-of-service attacks, ensuring that only authorized users gain access to critical network resources. IP addresses can be verified, and behavior monitoring can ensure that traffic from a device meets acceptable limits and does not exhibit patterns of a DDoS attack.

4. Network Eavesdropping and Man-in-the-Middle Attacks

Eavesdropping attacks are just what they sound like: someone “listening in” on communications and traffic on your network to intercept and steal sensitive information. This is one reason why public and unsecured WiFi networks are unsafe — anyone else on that same network could potentially intercept traffic on that network. In 2017, Equifax had to pull its mobile app because it was discovered, after an initial secure authentication, some features of the app did not use secure, encrypted communication. That left data communicated between app users and Equifax vulnerable to interception.

Traditional security stances would encrypt communication only between data centers but not necessarily between devices inside a data center. Zero trust principles call for encrypting all internal communication, including those between devices, using Transport Layer Security (TLS) to prevent network eavesdropping. Network segmentation called for by zero trust principles also prevents someone inside one area of the network from accessing traffic elsewhere on the network.

Conclusion

Assume it's not safe! While zero trust methodology provides better defenses against these kinds of attacks, it doesn’t promise that a network breach will never occur. In fact, it’s just the opposite: zero trust assumes that a breach will occur at some point. That’s why a key component of zero trust methodology is not just trying to prevent attacks but containing them if a breach does occur. Containment through network segmentation and continuous authentication prevents lateral movement within the network, so that if a hacker is able to access one part of your network, they don’t have the ability to then access other parts of the network.