With an increasing number of office employees working remotely, the traditional boundaries of the workplace have dissolved significantly. Companies that have been trying to work efficiently with a remote workforce now also have to deal with the security of their data and networks while being accessed remotely.
With enterprises rapidly increasing their remote workforce, the need for an entirely new approach to security is needed. Gone are the days when the company’s confidential and sensitive data was restricted to servers or physically defined perimeters.
Business, big and small, are now working with employees, clients, and others, remotely, and majorly over the internet. Hence, corporate data, resources, and confidential or sensitive information are no longer confined within office walls. And there’s Cloud Computing, which has exponentially increased the security risks for every component.
Securing Data and Authenticating Users Before Granting Access to Local Networks Is Critical in A Zero Trust Security Model:
Securing data and protecting networks has become one of the most urgent activities. As we read in previous articles, persistent security threats can attack from multiple vectors. Moreover, attackers often use Later Movement Attacks to move deeper within the network through seemingly authorized credentials.
A Zero Trust Model, wherein every request for data access is thoroughly verified and authenticated, is the need of the hour. And here comes the concept of Software-Defined WAN (SD-WAN) and Software-Defined Perimeter (SDP) solutions that is one of the critical elements of establishing a reliable Zero Trust Model.
A Software-Defined Perimeter (SDP) is essentially a secure area that’s guarded by digital sentries. Accessing this area requires relevant, and currently valid credentials. SDP replaces physical barriers with virtual or digital components. It can involve multiple protocols and standards such as PKI, TLS, IPSec, SAML and concepts such as federation, device attestation, and geo-location to enable connectivity from any clients to any information resource.
Incidentally, SDP is often called by many names such as hybrid-cloud networking, Software-Defined WAN (SD-WAN). However, it is a critical component in Zero Trust Network Access (ZTNA).
SDP or SD-WAN are often used interchangeably. For a long time, traditional SD-WAN solutions adopted one or more of the following approaches to security:
- Rely on existing security functionality without any modifications.
- Rely on traditional security framework and protocols, which is essentially virtualized and hosted at each branch office independently.
- Rely on cloud-based security functionality, such as cloud-based firewalls, secure Web gateways and Cloud Access Security Brokers (CASBs).
Needless to mention, except the last one, none of the above approaches offers any new, or more importantly, reliable security functionality in the era of increased and consistent remote working. Simply put, any major upgrade made to WAN must address this large and growing population of remote workers.
Additionally, modern-day security service platforms must intelligently secure data, users and networks, without making any distinction between or exception for location, geography or platform. A Zero Trust Platform with integrated SD-WAN or SDP must provide connectivity to any application, system or device only after each component within the chain is authenticated and verified.
How SD-WAN or SDP Platforms Should Be Evaluated for Deployment?
There are two critical objectives that companies must consider while deploying an SD-WAN or SDP. The primary objective is to add functionality that addresses the deficiencies of the current WAN. The secondary objective is reducing or eliminating the complexity of pre-existent security solutions. Complexity in establishing and maintaining a security platform often results in gaps. Such gaps are sniffed and exploited by attackers.
Companies looking towards a Zero Trust Model for security, and even the vendors offering the service, often make the mistake of assuming the enterprise has a well-defined, if not secure, perimeter. In reality, there are multiple nodes and several gateways and pathways the data and users interact with the company’s networks. This is precisely why an SDP platform that follows the user device, regardless of location or platform, is critical.
The second common misconception is everything inside of an organization’s network can be trusted. In other words, once users are authenticated at the main virtual entry-point, they are usually left unseen, uninspected, and are basically free to morph and move wherever they choose. Attackers using sophisticated techniques can obtain valid account details of employees and use them to conduct an attack, which in such case, is easy and undetectable.
A Zero Trust Security Model Needs SD-WAN or SDP For Comprehensive Network, Data and User Protection:
A Zero Trust Security Model, when used in conjunction with SD-WAN or SDP, ensures access is denied unless it is explicitly granted and the right to have access is continuously verified. A reliable Zero Trust Model usually has a wide range of access restriction systems such as single sign-on, multifactor authentication and intelligent synchronization between users and any data they access.
Some SDP or SD-WAN solutions leverage cloud-based platforms to deliver secure access to applications and network resources. These can be of good use to companies as there’s a significant reduction in operational and technological requirements to establish and maintain them.
Called Network-as-a-Service or NaaS, such solutions are preferred because they offer to free up the network as well as organizations from the complexity of configuring and managing the infrastructure. However, it is important to consider the nature of the organization, its network, users, and more importantly, the data, before opting for a NaaS platform.
A Zero Trust Security Model needs multiple parameters, including mTLS and SSL inspection, SD-WAN or SDP, and a few other platforms, to keep an eye for any suspicious activity. This is because modern-day digital threats often take efforts to mask their entry and movement within secure networks.
Leave a Comment