Zero Trust Access

The Role of mTLS And SSL Inspection in Crafting A Zero Trust Model

Instasafe

Jan 5, 2021 • 4 min read

The Role of mTLS And SSL Inspection in Crafting A Zero Trust Model

As the world gets increasingly reliant on the remote workforce, sensitive and valuable corporate data that once safely resided within protected networks, is flowing outwards. Simply put, the enterprise perimeter has not only expanded, but it has also become much more distributed and complex.

In the new world, employees, clients, and customers are connected to the internet in one way or another. Hence the illusion of data being located at a secured and impenetrable network has been shattered. Enormous amounts of data are being exchanged. From healthcare to the education sector and from corporate to the government, everyone is using the internet to provide easy access to services and information.

All this has put tremendous pressure and responsibility of ensuring data safety and integrity on cybersecurity teams. Moreover, there is no such thing as closed network anymore, and threats are not just limited to network intrusion from the outside. Hence it is important to take every request for network and data access with an adequate level of suspicion.

Can A Zero Trust Model Help?

Modern-day Advanced Persistent Threats (APTs) can penetrate otherwise secure networks. Attackers then move laterally within a network appearing as authorized users. Essentially, there can be threats from both inside and outside the organization, through any trusted business partner, supplier ecosystem, and even through employees working remotely.

In present-day networks, there is no longer an “inside” and “outside” ecosystem. In other words, the traditional concepts of secured zones, perimeters, network segments have been rendered outdated. People who appear to have legitimate access could be attackers using stolen credentials.

A Zero Trust model essentially adopts the approach of “trust nobody”, be it “inside” or “outside” the network. Cybersecurity policies and strategies rely on four key principles:

Create network micro-segments and micro-perimeters to restrict lateral traffic flow and always limit excessive user privileges and access.
Build stronger incident detection and response using persistent analytics and automation.
Integrate solutions across multi-vendor networks so they can work together seamlessly. This boosts compliance and unified security. The solutions should be easy to deploy, adopt, and adapt.
Obtain and maintain comprehensive and centralized visibility into users, devices, data, networks, and workflows.

While the principles and methodology may appear straightforward, it is often not the case. The Zero Trust model is effective only when cybersecurity teams have full visibility of users and their activities. If anything is invisible, protected, or encrypted, digital security teams and software tools cannot ensure safety and security of operations.

Needless to add, with modern-day operating systems and software, there’s widespread use of encryption. This means the majority of the data flows, users, and even their activities, are heavily obscured by multiple layers of protection. Google reports that over 90 per cent of the traffic passing through its services is encrypted. While this trend has significantly boosted privacy, it is a security nightmare for companies. As encryption renders network traffic invisible to legacy solutions, a network’s security stack essentially becomes near ineffective.

Importance of mTLS and SSL inspection in crafting a Zero Trust Model:

Mutual TLS or mTLS and SSL inspection is an effective method to maintain encryption and still ensure the Zero Trust Model keeps protecting the network. While SSL encryption has been succeeded by Transport Layer Security (TLS), the terms are often used interchangeably.

A centralized and dedicated decryption or inspection solution at the heart of the Zero Trust model offers the benefits of both the approaches to security and privacy while effectively eliminating the “blind spots” created by the increasing use of encryption.

A centralized mTLS and SSL inspection solution, complemented by a multi-layered security approach for optimal protection, is crucial for the majority of companies. A good platform must take “decrypt once, inspect many times” approach. The platform should allow security infrastructure to inspect all traffic in clear text, at fast speeds. The system must be optimized to minimize performance penalties and try its best to reduce complexity.

Here are some of the features of a reliable and efficient mTLS/ SSL Inspection Solution that are must while implementing a robust Zero Trust Model:

Full Traffic Visibility: The mTLS and SSL inspection platform needs to be enabled for the entire security infrastructure to have complete and clear visibility. This means the Zero Trust Model should be able to inspect all traffic to ensure that no encrypted attacks or data breaches can slip through the defences.
Flexible deployment and integration: The platform should be vendor-agnostic and be easily integrated with security devices already deployed within the network. This reduces additional costs, upgrades, and needless overheads.
Ease of use: The chosen mTLS and SSL inspection platform should be simple and quick to implement without causing any network outages or disruptions.
Multi-Layered Security Services: The mTLS and SSL inspection platform should offer additional security services, including URL filtering, application visibility and control, threat intelligence and threat investigation. These help in bolstering the security of the entire network.
User Access Control:The platform should be able to thoroughly enforce authentication and authorization policies. It should be able to restrict unneeded access, log access information and provide the ability to apply different security policies based on user and group IDs.
Micro-Segmentation: The mTLS and SSL inspection platform should facilitate micro-segmentation. Simply put, the platform should provide granular traffic control, user and group ID-based traffic control, and support for multi-tenancy.