The National Security Agency (NSA) has just released the Cybersecurity Information brief entitled, Embracing a Zero Trust Security Model. The Cybersecurity Information brief provides an overview and recommendations for implementing Zero Trust within networks. The Zero Trust security model is a coordinated system management strategy that assumes breaches are inevitable or have already occurred.
NSA’s recommendations for adopting a Zero Trust mindset, embracing Zero Trust guiding principles, and leveraging Zero Trust design concepts include:
Adopt a Zero Trust mindset
To adequately address the modern dynamic threat environment requires:
- Coordinated and aggressive system monitoring, system management, and defensive operations capabilities.
- Assuming all requests for critical resources and all network traffic may be malicious.
- Assuming all devices and infrastructure may be compromised.
- Accept and understand that all access to critical resources incur risk and being prepared to perform rapid damage assessment, control, and recovery operations.
Embrace Zero Trust guiding principles
A Zero Trust solution requires operational capabilities that:
- Never trust, always verify – Treat every user, device, application/workload, and data flow as untrusted. Authenticate and explicitly authorize each to the least privilege required using dynamic security policies.
- Assume breach – Consciously operate and defend resources with the assumption that an adversary already has a presence within the environment. Deny by default and heavily scrutinize all users, devices, data flows, and requests for access. Log, inspect, and continuously monitor all configuration changes, resource accesses, and network traffic for suspicious activity.
- Verify explicitly – Access to all resources should be conducted in a consistent and secure manner using multiple attributes (dynamic and static) to derive confidence levels for contextual access decisions to resources.
Leverage Zero Trust design concepts
When designing a Zero Trust solution:
- Define mission outcomes – Derive the Zero Trust architecture from organization-specific mission requirements that identify the critical Data/Assets/Applications/Services (DAAS).
- Architect from the inside out – First, focus on protecting critical DAAS. Second, secure all paths to access them.
- Determine who/what needs access to the DAAS to create access control policies – Create security policies and apply them consistently across all environments (LAN, WAN, endpoint, perimeter, mobile, etc.).
- Inspect and log all traffic before acting – Establish full visibility of all activity across all layers from endpoints and the network to enable analytics that can detect suspicious activity.
Visibility and tracking of activity are critical Zero Trust design concepts. Infoblox’s security solution, BloxOne Threat Defense, provides continuous and complete visibility and assessment of all DNS activity. DNS is the cornerstone to the great majority of external communications, especially those that represent a threat to your organization. BloxOne also provides extensive visibility through the IPAM database. IPAM is the administration of DNS and DHCP, which are the network services that assign and resolve IP addresses to machines in a TCP/IP network. IPAM is a means of planning, tracking, and managing the Internet Protocol address space used in a network. Tools such as DNS and DHCP are used in tandem to perform this task although IPAM will connect these services together so that each is aware of changes in the other (for instance DNS knowing of the IP address taken by a client via DHCP, and updating itself accordingly).
BloxOne Threat Defense can support your Zero Trust initiatives by:
- Using a “walled garden” approach where devices and users are blocked from accessing malicious or potentially malicious websites.
- Enabling a “No Unknown model” where in addition to any blocked categories, users are not allowed to resolve domains that have no rating at all
- Leveraging machine learning and analytics to detect malicious and potentially dangerous anomalous behavior.
- Enhancing other security vendors with data feeds leveraged on other platforms so that other security controls can be better equipped to manage users access to data.
Substantially helping to reduce incident response time, so critical to breaking the attacker’s kill-chain before it can cause further harm, by automatically blocking malicious activity and providing the threat data to the rest of your security ecosystem for investigation, quarantine, and remediation.
- Leverage greater processing capabilities of the cloud to detect a wider range of threats, including data exfiltration, domain generation algorithm (DGA), fast flux, fileless malware, Dictionary DGA, and more, and enforcing protection everywhere- HQ, data center, remote offices, roaming devices.
- Reducing the number of alerts to review – foundational security can remove well over half of the threats before they can get to your firewalls, spread beyond a few endpoints, and overwhelm your other security controls.
Other NSA advisories and technical guidance can be found here:
Please find these additional references to Zero Trust on our website:
- Zero Trust on our Cybersecurity Frameworks Page:
- Download our Zero Trust white paper here: https://info.infoblox.com/resources-whitepapers-an-introduction-to-zero-trust
Check out our blogs on Zero Trust:
- https://blogs.infoblox.com/tag/zero-trust-network-architecture/
- https://blogs.infoblox.com/security/dns-security-is-critical-to-zero-trust-network-architecture/
- https://blogs.infoblox.com/security/dns-privacy-in-the-age-of-zero-trust/
If you want to know more about our products and services, please reach out to us directly via https://info.infoblox.com/contact-form.
