Zero Trust Access

Zero Trust in IAM: The New Approach to Security

Instasafe

Feb 26, 2021 • 4 min read

Zero Trust in IAM: The New Approach to Security

The digital security landscape has evolved by leaps and bounds in the last year. With the increasing number of employees working remotely, the traditional “boundaries” for data and communications have all but washed away. With threats like Phishing, and Lateral Movement Attacks on the rise, the need for a viable security model to combat such breaches is the need of the hour. Combined with strong Identity and Access Management , a Zero Trust Model for enterprise security can work to secure digital assets and communications.

As the Zero Trust Architectures gain popularity,, security teams are rapidly moving away from traditional tools, and implementing Identity and Access Management controls which can grant users access to the enterprise resources from anywhere while still securing them. This is what is known as Identity Centric approach to security.

Security professionals are increasingly leaning towards and professing the deployment of a Zero Trust Security Model. At its core, the model assumes there can never be implicit trust in a corporate network. Simply put, Zero Trust always assumes everything and everyone is a suspect unless thoroughly verified.

Zero Trust Security Model and Identity & Access Management

As mentioned above, the most basic requirement of an effective Zero Trust Security model is a strong Identity and Access Management architecture. In order to achieve the full effectiveness of the Zero Trust model, enterprises must start with the very basic and fundamental aspect; which is the identity of the user itself.

Creating user accounts, allocating access, and setting privileges on the network is also needed. But there has to be a strong identity governance and administration strategy in place. Companies must ensure users strictly use their own login credentials, and follow protocols while creating and safeguarding their virtual identities.

A typical Identity Strategy includes:

Identity Governance controls for Roles, Entitlements, Suitability and SOD Policies and Risk
Lifecycle Automation for Identities (Employees, Contractors, Business Partners, RPA/Bots)
Credential Management and Strong Multifactor Authentication
Privileged Account and Entitlement Management
Centralized Application Access and Self-Service fulfilment
Access Certification, Auditing and Reporting

An Identity Strategy ensures simple and secure access. It also helps reduce, if not eliminate completely, the risks associated with aspects such as entitlement creep, dormant or abandoned but still active accounts, and improper delineation of duty and suitability policies. Essentially, an Identity Strategy offers clear visibility and accountability to the following questions:

Who has access to what?
Who should have access?
What do they do with that access?

Just as an Identity Strategy offers clear answers about individual accounts, Access Management is majorly about the privileges these accounts enjoy, or in technical terms, how deep or high the accounts gain access to a secured network. Simply put, a well-established Identity and Access Management collectively help the Zero Trust Model perform optimally.

During the most basic authentication and authorization process, a Zero Trust Model attempts to ensure that a user is truly who they claim they are, use the device they should be using to access the network. However, Identity and Access Management should automatically take necessary action to prevent entry if users are accessing the network from an authorized location. It basically defines and grants the access they should have. However, it can also strip away any access that is undesirable, inappropriate or no longer needed.

How Does Identity and Access Management Help Zero Trust Policies?

As routinely mentioned in earlier coverage about the subject, Zero Trust is a significant departure from traditional network security. It follows the simple motto, “Never Trust Always Verify”. Moreover, it has evolved to continuously monitor and validate that a user and the device has the right privileges and attributes.

Zero Trust policies heavily rely on Identity and Access Management. It needs real-time visibility into common user attributes such as:

User identity
User logins
Endpoint hardware
Operating system / Firmware versions
Known Vulnerabilities and Patch levels
Applications installed
Past security or incident detections for the user credentials

Deploying Strong Identity and Access Management with Zero Trust Security Model:

Extending the aforementioned principles further, a strong Zero Trust security strategy will always include strict enforcement of user access. It will not only have control over authentication but will also monitor user behaviour and movements. In fact, the security model relies on Identity and Access Management, not just within the secured network, but also for users connecting to the Internet, remote cloud-hosted services, etc.

To deploy a reliable Identity and Access Management platform that works with Zero Trust, companies can opt for several tools. However, irrespective of the number of features, companies must make sure that the solution can work seamlessly across any platform or infrastructure. Moreover, it should be able to take immediate effect on both active and new sessions of user activity. Without these critical abilities, there can be blind spots and security gaps.

A Roadmap for Identity and Access Management:

Isolate user interactions or Micro-segmentation: Using an Active Directory User Group, intelligent micro-segmentation can isolate user access. It basically means setting up Software Defined Perimeters (SDP) based on user group, location or logically grouped applications.

Multi-Factor Authentication: Previously, ‘Two-Factor Authentication’ was considered as a very basic requirement. However, the Zero Trust Model has evolved to vetting multiple points to establish Identity and grant relevant access to areas of the network. Call it MFA, 2FA, or third-factor authentication, they are all essential for Zero Trust.

Follow Least Privilege Principles: Companies must determine where the sensitive data resides. Thereafter, grant users the least amount of access necessary for their roles.

Web Security for Blocking Potential Phishing Attacks: Even the most vigilant and cautious of employees can fall victim to a cleverly crafted phishing attack. A Zero Trust Model also includes web security gateways that block user access to any malicious websites.

User and Entity Behavior and Analytics: Employees usually have a pattern of operation and active hours in which they operate. Using Identity and Access Management, a Zero Trust Model can spot anomalous or suspicious actions carried out from legitimate accounts.