One of the newest security architectures out there is Zero Trust. I’m sure you’ve heard about it. But contrary to what you might have heard, Zero Trust isn’t really a “thing” – it’s a concept. This means there is no “one” solution, but lot’s of possible interpretations and implementations. While this makes the concept flexible, it also creates the real probability that your Zero Trust implementation might leave some good “aspects” out of the design. In other words, you might have just created some unexpected pitfalls (traps) that could sabotage your network. Here's a look at some common pitfalls that you might want to keep in mind.
First, while Zero Trust is often referred to as a nebulous long and winding journey, any reliable implementation is going to need a visibility architecture as the foundation. If you can’t reliably see both the data and the threats traversing your network, then there is no way you can build an effective security architecture to protect your agency or business. You need to implement a visibility architecture that includes taps (to access data across your network) and packet brokers (that aggregate and filter traffic so that your security tools get the exact information they need). Your architecture can’t be successful if there are blind spots. You need to see every part of your network to eliminate hidden threats and performance problems.
Second, you need packet visibility. While flow data is good, it only provides general trend information. Log data is also useful, but it can be corrupted or even erased by malware. Only packet data gives you all of the details you need, like who, what, when, and how. This level of detail is needed to ensure both data integrity and to perform various security functions, like threat hunting.
Third, you need to create a way to constantly validate your architecture. Things change with new software and hardware updates, new malware released into the wild, new zero-day flaws discovered, and so forth. Your architecture needs to be continually validated to ensure that it still works as designed and is also still effective. The world moves on, and your network must continue to be effective as things change.
Finally, security and Zero Trust is not just about prevention. You need to be able to respond quickly with cyber resilience tactics and threat detection techniques if your network is attacked. It’s not a question of if your network will be attacked, but when will that happen. During the course of the attack, your network may be compromised, either superficially, catastrophically, or somewhere in between. In any of those situations, you need to be able fix your network and reset it to a normal state as fast as possible. That’s only going to be possible if you build in resilience, which is actually part of the NIST Cybersecurity Architecture guidelines anyway.
If you want more information on these topics, read this whitepaper.