This article equips developers with the fundamentals of the zero trust security framework -- what it is, its key principles, relevant use cases and high-level capabilities that are required through solution blueprints, and wraps up with an exploration of the various IBM technical solutions that can help you implement zero trust in a hybrid cloud environment.

What is zero trust?

In this era of cloud computing and bring your own device (BYOD), workloads and applications are moving to public clouds across geos and endpoint devices are owned by users and not provided by enterprises. Mobile devices are constantly on the move, connecting to enterprise networks through the internet via VPNs. In this context, physical network perimeters don’t exist anymore and identity is now a dynamic, moving perimeter. Zero trust is a response to these modern enterprise network trends, which include remote users, BYOD, and cloud-based assets that are not located within an enterprise-owned network boundary.

Security models: perimeter vs. zero trust

The US National Institute of Standards and Technology (NIST) defines zero trust and zero trust architecture as follows:

Zero trust provides a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as compromised.
Zero trust architecture is an enterprise’s cybersecurity plan that utilizes zero trust concepts and encompasses component relationships, workflow planning, and access policies. Therefore, a zero trust enterprise is the network infrastructure (physical and virtual) and operational policies that are in place for an enterprise as a product of a zero trust architecture plan.

In simple terms, zero trust is not a product or tool, but it is a framework that’s founded on the idea that security controls must not rely on implicit trust, and must be continually evaluated for every request against every resource access every single time.

The following NIST-provided diagram provides an abstracted illustration of zero trust access. Whenever an entity (user or service) needs access to an enterprise resource (which can be data, an application, a network, or a system), access must be granted through policy decision points (PDPs)/policy enforcement points (PEPs). These PDPs/PEPs evaluate the context around a request like location, device details (like operating system and IP address), and time of a day. After access is granted, the entity is authorized to access the implicit trust zone with a particular level of access to the desired resource.

Zero trust access

Principles of zero trust

Zero trust provides a set of principles and concepts for moving the PDPs/PEPs closer to the resource. The idea is to explicitly authenticate and authorize all subjects with enough access to any enterprise data, application, system, or network with the assumption of a breach.

1. Implement least privilege

Having deny by default is the first principle, which means granting just enough short-lived permission to every access request for the intended action against a resource like an application or data. It implies that there are strong authentication and authorization mechanisms.

2. Continuous verification

Continuously evaluate the risks associated with every access request or session every time by evaluating access context issues like:

Geographic location
Device details like operating system, version, IP address, day of access,and time of access
Device states like complaint or non-complaint
BYOD or enterprise provided

This is also known as adaptive access or context-aware authentication.

3. Assume breach

Always assume that a breach has happened at every stage -- architecture, design, implementation, and operations. This principle implies proactiveness in security, and requires preparation with the appropriate set of security tools and controls from the beginning.

Achieving zero trust

The biggest challenge for any enterprise to realize zero trust in its network or environment is often determining where to start. In a typical enterprise, the IT environment usually consists of thousands of endpoints which can include:

Laptops
Mobile devices
Servers or workstations hosting databases and applications on intranets
Virtual networks with multiple cloud players

Usually, a typical enterprise cannot implement a zero trust framework to its entire IT environment at once. This process can be extremely difficult and error-prone, and it can interfere with business as usual if it is not planned well.

Two decisions are important before jumping into zero trust implementation. The first is identifying use cases that will bring the maximum business benefits if zero trust is implemented on them. The second is selecting technical solutions for implementing zero trust seamlessly and executing it on the chosen use cases in a continuous manner.

Zero trust use cases

IBM identifies three use cases that are important for any enterprise:

Reduce ransomware attacks
Protect hybrid cloud
Secure hybrid and remote workforce

The order of priority can vary depending on the specific industry or business needs at a given time. Let’s get into details of these use cases to understand what they are, how zero trust can help with the specific use case challenges, and what types of security controls can be used to implement zero trust principles.

1. Reduce ransomware attacks

The first use case, which is illustrated in the following diagram, is critical for any organization that aims to protect its most valuable assets, like sensitive data and business-critical applications, from ransomware attacks.

Diagram: Reduce ransomware attacks

A zero trust approach helps to isolate threats, reduce the attack surface, and insulate your most valuable resources and assets. It can also help with dynamic enforcement of security controls and automating responses to threats targeting your business.

Let's briefly walk through the components involved in this use case:

Critical Assets are crown-jewel data like trade secrets, sensitive/confidential financial data, or PII data of customers. These assets can reside in hybrid multi-clouds like hyper-scalers or on-prem servers, as well as at end-point devices like mobiles and laptops.
Enterprise Applications are business-critical applications that enable both privileged and business users to access and control critical assets in order to conduct their business.
Both the Security Operations Team and the Data Security Team pro-actively protect critical assets using security controls. They also monitor Enterprise Applications continuously for security breaches or issues using the following security capabilities.

The key capabilities needed to implement zero trust for this use case are:

Threat management:
- Security information and event management (SIEM)
- Security orchestration, automation, and response (SOAR)
- Endpoint detection and response (EDR)
- User and entity behavior analytics (UEBA) and threat analytics (TA) encryption
- Database activity monitoring (DAM)
- Data loss prevention (DLP)
Identity and access management:
- Single sign-on (SSO)
- Multi-factor authentication (MFA)
- Adaptive access
- Identity governance
- Privileged access management (PAM)

2. Protect hybrid cloud

Digital transformation relies on the hybrid cloud by deploying workloads across cloud platforms as well as on-prem resources. By enabling security controls across hybrid cloud networks, zero trust can help organizations modernize their operations and enable business by dynamically adapting to ever-changing users, datasets, and workloads throughout multiple hybrid clouds.

Diagram: Protect hybrid cloud

Let's briefly walk through the components involved in this use case:

Hybrid Cloud apps are business applications that face customers or employees. They can be IaaS, PaaS, or SaaS hosted services in multi-cloud environments as well as applications deployed in on-premises data centers.
Internet/Corporate Networks enable both Privileged Users and Business Users to access different types of hosted or deployed applications so they can conduct business over internet or virtual private network (VPN) connections.
The Security Operations Team proactively protects both Hybrid Cloud apps and Internet/Corporate Networks using security controls, plus it monitors continuously for any security breaches or issues through the following security capabilities.

The key capabilities needed to implement zero trust for this use case are:

Network security:
- Zero trust network access (ZTNA)
- Web application firewall (WAF)
- Micro-segmentation
- Cloud security posture management (CSPM)
- Cloud workload protection platform (CWPP)
- Cloud access security broker (CASB)
Identity and access management:
- Single sign-on (SSO)
- Multi-factor authentication (MFA)
- Adaptive access
- Privileged access management (PAM)
Threat management:
- Security information and event management (SIEM)
- Endpoint protection
- Endpoint detection and response (EDR)
- User and entity behavior analytics (UEBA)
Data security:
- Encryption
- Key management
- Database activity monitoring (DAM)
- Data loss prevention (DLP)

3. Secure hybrid and remote workforce

The pandemic forced enterprises to enable remote work across all lines of business and operations. As a result, employees from different disciplines like customer support, marketing, human resources, IT, supply chain, and procurement are connecting remotely to enterprise networks using mobile devices to carry out their business activities. (This is true even with crown-jewel assets that were well protected before the pandemic and access was controlled within the network perimeter.) Businesses must support this remote workforce from any location on any device connected to resources in multiple environments. Organizations empower their workforce by correlating security information across all domains to quickly enforce conditional access based on a model of least privilege. This reduces barriers to accessing resources without sacrificing security.

Diagram: Secure hybrid and remote workforce

Let's walk through the components involved in this use case:

Hybrid Cloud apps are business applications that face customers or employees. They can be IaaS, PaaS, or SaaS hosted services in multi-cloud environments as well as applications deployed in on-premises data centers.
Internet/Corporate Networks are the medium through which both Office Workers and Remote Workers access different types of hosted or deployed applications to conduct their business using endpoint devices like laptops or mobiles.
The Security Operations Team proactively protects Internet/Corporate Networks using security controls, plus it continuously monitors all endpoint devices for any security breaches or issues through the following security capabilities.

The key capabilities required to implement zero trust for this use case are:

Endpoint protection, detection, and response:
- Endpoint protection
- Unified endpoint management (UEM)
- Endpoint detection and response (EDR)
- User and entity behavior analytics (UEBA)
- Security information and event management (SIEM)
Identity and access management:
- Single sign-on (SSO)
- Multi-factor authentication (MFA)
- Adaptive access
Network security:
- Zero trust network access (ZTNA)
- Web application firewall (WAF)
- Cloud access security broker (CASB)
- Remote browser isolation (RBI)
- Secure Web Gateway (SWG)
- Data loss prevention (DLP)

Zero trust technical solutions

So far, this article has covered three key use cases that can be prioritized for zero trust implementation based on an enterprise’s critical needs. Now it's time to get into the technical solutions and details that can enable seamless implementation. As a market leader in the cybersecurity space, IBM Security offers three key solutions to help enterprises realize zero trust in a quick, cost-effective manner. These technical solutions can not only operate on their own, but they can also integrate and work with legacy security solutions and other vendor security solutions to enable enterprises to benefit from zero trust.

1. Threat detection and response solutions

IBM Security QRadar XDR and IBM Cloud Pak for Security: Built on IBM Cloud Pak for Security, the open architecture of QRadar XDR enables you to be ready for whatever the future demands. Deploy on premises, on cloud, or as a service to meet your unique needs. IBM Cloud Pak for Security can help you gain deeper insights, mitigate risks, and accelerate response. With an open security platform that can advance your zero trust strategy, you can use your existing investments while leaving your data where it is -- helping your team become more efficient and collaborative.

2. Identity and privileged access management solutions

3. Endpoint and data protection solutions

IBM Security ReaQta: IBM Security ReaQta is a sophisticated yet easy-to-use endpoint detection and response (EDR) solution that helps companies protect their endpoints against zero-day threats. It uses intelligent automation, AI, and machine learning to detect behavioral anomalies and remediate threats in near real time.
IBM Security Guardium: IBM Security Guardium is a modern, scalable data security platform that protects sensitive and regulated data across multiple cloud environments while managing compliance obligations, discovering where sensitive data lives, encrypting and monitoring what’s important, and reducing your risk while responding to threats.
IBM Security MaaS360 with Watson: IBM Security MaaS360 with Watson protects devices, apps, content, and data so you can rapidly scale your remote workforce and BYOD initiatives, helping you build a zero trust strategy with modern device management.

Conclusion

In this brief overview of the zero trust framework, you learned the zero trust principles in detail and how zero trust is very relevant and important to current security challenges posed by hybrid cloud adoption, digital transformation, and a remote workforce.

The solution blueprints described here provide a detailed view of the security capabilities required to roll out zero trust in various use cases. As a next step, consider exploring IBM Training on Security for your specific areas of interest like network security, data security, and identity and access management to gain in-depth technical understanding of the relevant product features.

Zero trust: An introduction for developers

Zero trust: An introduction for developers