Zero Trust Access

InstaSafe’s Security Precepts for designing a zero trust architecture

Instasafe

Jan 3, 2021 • 3 min read

InstaSafe’s Security Precepts for designing a zero trust architecture

In light of the ever-evolving nature of the IT industry, it is surprising to see that certain technologies have continued to be stagnant in terms of metamorphosing to match industry needs. Foremost among these are remote-access VPNs. Though they were considered revolutionary when first introduced in the 1990s, with the development of the cloud, the traditional conception of extension of complete enterprise networks to the remote user, on which remote VPNs work, has become a cumbersome and particularly risky affair. With the deployment and maintenance of network-centric and agent-based security solutions in a dynamic, cloud-based environ becoming an increasingly complicated, and hindering cloud adoption, the need for a versatile cloud-based alternative for VPN, providing enhanced security, and better scalability at lower costs.

Given the inherent issues and challenges that are presented by the application of legacy-based systems like VPNs in cloud-based environments, it becomes imperative to address these issues. The InstaSafe team garnered market research data and did an insightful analysis of the current lacunae in the cloud security market, to recognize that some important precepts need to be kept in mind while designing security solutions that keep up with the broadening horizons of enterprises that use them. By capitalizing on the areas of concern where VPNs or other traditional perimeter forms couldn’t keep up, an all-encompassing security solution could be drawn up which drew inspiration from InstaSafe’s mission of providing seamless cloud security services that are both secure to use and instant in their installation and usage experience.

But before that, our team decided to pinpoint the most important canons that needed to be kept in mind before coming up with such a solution. Our vision for a next-gen cloud-based remote access solution stood on 3 pillars, which we refer to as the InstaSafe Security Precepts. Our belief is that any solution that is drawn up keeping the broadening realms of enterprises and dissolution of traditional perimeters in mind should belay its foundations on these 3 precepts.

Isolated, Segmented Access equals Secure Access: By isolating all network resources from the internet, and at the same time, micro segmenting access on a ‘need to know’ basis, security solutions can endeavor to heavily restrict the occurrence, and effect of potential exploitative attacks. Blacking, or rendering invisible the enterprise resources effectively creates a near-impenetrable intranet within the internet, preventing malicious actors from accessing your resources
Always Verify Before you Trust: A system of innate distrust must be the norm if an enterprise wishes to achieve a higher level of security. Further, using this ‘default-deny’ approach to frame your security policies, with regards to what assets you have to protect and secure, what applications are to be isolated, and how you will segment traffic, tends to further mitigate chances of exploitation. Further, the entire user authentication process should be dynamic, and cyclic, in that the entire process of assessing threats, adapting, and continuous authentication is to be followed for every user.
One Size doesn’t fit all: Given that each user in an enterprise is allowed access to a different quantum of resources, each of them needs to be assigned a different level of trust. This further reinforces the need for micro-segmentation, i.e. the framing of granular level security policies, which may go down to the workload level, or the device level. This will enable micro perimeters, segmenting the user traffic into contextual lanes, and practically realizing the 1st precept.

Our belief is that every enterprise needs to keep these 3 major security precepts in mind while deciding on building or rebuilding their security infrastructure. Given the current security scenario, wherein traditional perimeters are an illusion of the past, and disruptive technologies requiring functionalities in cloud environments rule the roost, the need to revamp network security with these canons in mind becomes imperative.

InstaSafe combines the disparate needs of security and access of the digital worker into a single cloud-delivered scale-out platform, which can be deployed in minutes, and managed via intuitive policy-based management. It introduces a new software-defined, Zero Trust (ZTNA) architecture that uses a trust broker to mediate connections between a specific private application and an authorized user. It allows teams to begin with zero trust, but then provide connectivity based on context (identity, device, etc.). Unlike VPNs, InstaSafe Secure Access delivers a means of application access without network access, and the ability to mask applications from the open internet.