Introduction
Cloud computing has impacted the way companies develop applications, store data and enable remote workers. Users are accessing applications from all over the world and applications are talking to one another on the cloud. With hybrid cloud workloads your security footprint has grown exponentially. There are more users, applications, devices and connections to worry about when securing your company.
Securing your company by drawing a line in the sand and stating what is on the network is safe and what is off is no longer an ideal solution. Workloads can exist outside your network and if an account is hacked you could be exposing your network. There needs to be a better method to verify who or what is trying to gain access to your network and if the criteria for access is being met.
When applying Zero Trust to the cloud there are some things to remember. You want to make sure that you are verifying explicitly and allowing the least amount of access possible. Also by applying a zero trust model you should be continuously assessing what’s happening on your network. When you apply Zero Trust to your cloud environment you are creating a uniform way to secure your cloud.
There are many moving pieces when applying Zero Trust to your cloud. Simply buying an identity platform or adding another tool won’t allow you to achieve this. Identity, workloads, data, network, visibility and governance all play a role when applying zero trust across your environment.
In this article we will cover what Zero Trust is when applied to your cloud environment. We’ll look at some of the main components to help build your zero trust architecture and give some best practices to follow.
What Is Zero Trust Cloud Security?
zero trust cloud security allows you to apply a set of principles when securing your cloud applications, infrastructure, identities and data.
According to the National Institute of Standards and Technology in NIST SP 800-207, Zero Trust Architecture, zero trust shifts security away from relying on network location and toward protecting resources. When a person or system requests access, the organization evaluates identity, the requested resource, and whether access requirements are met.
If a user logs into your company’s environment they may be allowed to access certain applications but not others. If their account is flagged for malicious activity you may want to further lock them down.
By utilizing a zero trust model you can begin to restrict user and workload access to certain applications and resources on your network.
You will want to make it difficult for a hacker to gain unauthorized access and move around your network.
Why Enterprises Need Zero Trust for Cloud Security
There are many reasons why you should consider implementing a zero trust model. Here are some of them.
1. Users Are Everywhere
Your employees, partners, contractors, applications and workloads will need to access your resources. All of these are attack vectors for your company if you’re not careful.
When you implement a zero trust model you can begin to focus on who is trying to access your resources. By having proper identity controls you can restrict their access to what they need to perform their job.
2. Multiple Environments
Companies are moving to the cloud and utilizing multiple cloud providers. These different clouds all have varying ways to secure their environment. You will want to ensure that your security policy is carried out across all of your environments. The Google Cloud Well-Architected Framework provides related guidance for operating secure, reliable, and efficient cloud environments.
3. Prevent Lateral Movement
Once a hacker has compromised one of your accounts or workloads they will try to move around your environment to gain access to more resources. If your network is flat it can become easy for them to do so.
By segmenting your network and applying access controls you can make it difficult for hackers to move around your environment.
4. Regulatory Compliance
Many industries are starting to require companies to show that they are securing their data. You will want to know where your data is located and who has access to it.
There are many benefits to Zero Trust when it comes to helping you meet your regulatory requirements. Just make sure you know what your requirements are and how Zero Trust can help you meet them.
Principles to Apply to Your Zero Trust Architecture
Below are some principles you can apply to your zero trust architecture.
Verify Explicitly
Make sure that you are asking enough questions to who or what is trying to access your resources. Utilize multi-factor authentication and verify that your devices meet your company’s security posture. When securing workloads you will also want to make sure you are authenticating those applications as well.
Least Privilege
Allow your users and workloads to have the least amount of privileges possible. Make sure that they only have access to what they need to perform their job.
Utilize tools such as privileged access management, role based access control and just in time access. If they don’t need the privileges remove them or make it time bound.
Assume a Breach
You should always assume that something or someone will break into your environment. Once that happens you want to make sure that you have controls in place to stop them from gaining access to more resources.
Segmenting your network, restricting services talking to one another and isolating privileged accounts can all help you achieve this.
Continuously Assess Access
As things change on your network you will want to reassess access to your resources. If a device is no longer up to date or a user account is acting strange you may want to reevaluate their access.
Depending on the risk of the resource you can decide how often you want to reassess. Make sure you are also monitoring and investigating these changes.
Key Components of Zero Trust Cloud Security
Here are some of the main building blocks to help you implement a zero trust architecture.
Identity and Access Management
Identity will play a huge role in your Zero Trust journey. Make sure that you know who has access to your resources and why. There are many types of identities that you will need to manage.
Make sure that you have the following controls in place.
- multifactor authentication
- role-based access control
- privileged access management
- Remove Unused Privileges
- service identities
Once you have identified who has access to your resources make sure that you have a plan to manage those identities.
Device and Workload Security
Now that you have identified your users make sure that you are securing their devices. Are your devices running the latest patch? Do they have anti-malware installed? Are they encrypted?
Similar to securing your users you will want to make sure that your workloads are also secured. You can accomplish this by looking at the configurations on your workloads. Making sure that you know what identity your workload is running under and restricting access to only what it needs.
Network Security and Microsegmentation
One of the big differences when applying a zero trust model to your environment is how you secure your network. Just because you are able to communicate with a resource doesn’t mean that you should be allowed to.
Microsegmenting your network will allow you to separate out these resources and only allow what is needed to talk to one another. You can do this by segmenting out workloads and only allowing what is needed to talk to one another.
Data Protection
What are you trying to protect in the first place? You will want to know where your data is located and who has access to it. You can do this by classifying your data and ensuring that only certain people have access to it.
Once you have your data classified you can apply policies to it. You may want to encrypt it and monitor who has access to it. Make sure that you have proper retention and purging policies in place.
Visibility and Monitoring
You want to have visibility into your identities, workloads, network and cloud. Make sure that you are collecting logs and monitoring your environment for any anomalies.
You can utilize a SIEM or other monitoring tools to help you detect and respond to attacks on your environment.
Policy and Governance
Once you have your controls in place you will want to make sure that you have a way to manage them. Make sure that you know who is responsible for managing these policies and what they are.
You can utilize policy as code to ensure that your controls are being applied. This can also help you detect when something is not meeting your standards and automatically remediate. Microsoft provides additional guidance on how to enforce cloud governance policies through automation and ongoing reviews.
How to Implement Zero Trust Cloud Security: A Practical Roadmap
You can begin to implement Zero Trust in your environment by following these steps.
Know Your Environment
Make sure that you have a good understanding of what is on your network. Identify what your crown jewels are and who or what has access to them. Microsoft also provides guidance on how to build a cloud governance team with clear sponsorship, responsibilities, and accountability.
Look for areas that you can begin to tighten your controls. You may find that you have too many privileged accounts, workloads that shouldn’t be talking to one another or lack of visibility.
Plan Out Your Zero Trust Architecture
Once you have identified your goals you can begin to plan out your architecture. You will want to know who is going to be responsible for each piece of your architecture. The AWS Cloud Adoption Framework governance perspective provides additional context for aligning cloud adoption, risk management, and business outcomes.
Make sure that you have a way to measure your progress and remove exceptions that may occur. There are many frameworks that you can use to help guide you through this process.
Start With Identity
Since identity will play such a large role in your architecture it makes sense to start here. Begin tightening your identity controls by adding multi factor authentication, removing unnecessary privileges and managing service identities.
You can then begin to apply these controls to more of your users. Make sure that you test these controls before rolling them out to your entire organization.
Protect Critical Workloads and Segment Access
Now that you have started to secure your users you can begin to look at your crown jewels. Identify what applications or workloads you want to secure and begin to map out which systems communicate with one another.
You can begin to apply these controls to your workloads and segment them out. Once you have tested your workloads you can begin to expand this to other areas of your network.
Monitor and Respond
Make sure that you have the proper visibility to detect when something is wrong on your network. Once you detect that something is wrong you will want to have a plan to respond to it.
You can automate some of these responses but make sure that you have the proper controls in place.
Measure and Continue to Improve
After you have implemented some of these controls you will want to measure if they are working. You can look at the number of privileged accounts that have elevated privileges or how many of your crown jewels are protected by Zero Trust.
You can also look at how long it takes you to respond to an incident. If you find that your users are having trouble accessing resources or you have too many exceptions you may want to dig deeper into why that’s occurring.
Continue to apply Zero Trust to your environment as it grows.
Common Challenges and How Enterprises Can Address Them
There will be roadblocks that you encounter when trying to implement Zero Trust. Here are some common ones and how you can overcome them.
- Legacy applications: There may be some legacy applications that you cannot easily apply Zero Trust to. Look at what they are communicating with and apply compensating controls if needed.
- Lack of visibility: If you don’t know what’s on your network it will be hard to implement Zero Trust. Begin collecting logs and identifying what applications and users are on your network.
- Too many tools: Having too many tools can make it difficult to apply Zero Trust across your environment. Look at what controls each tool is providing and see if you can apply them consistently.
- Business friction: If your controls are causing too much friction for your users they will find ways to bypass them. Test your controls and make sure that you aren’t locking yourself out of your own applications. For a related view of cost ownership and cloud financial management, read Cloud FinOps.
- Skills gaps: There will be many skillss needed to implement Zero Trust in your environment. Make sure that you have the proper training in place and that everyone knows what they are responsible for.
How Hexaware Can Help
Zero trust cloud security spans identities, workloads, networks, data, monitoring, and governance. Hexaware can support cloud assessment and modernization through Amaze® for application cloud transformation.
Learn how Hexaware’s AI-driven cybersecurity solutions align with NIST CSF 2.0 using Microsoft security services.
See how Hexaware helped a global beverage company fortify cloud security with microsegmentation and apply a zero trust framework in an Azure environment.
Zero trust implementation depends on the resources being protected and the risks involved. Read Mastering Cloud Operations: Key Understandings and Smart Approaches for related guidance on operating and managing cloud environments.
Applying zero trust to cloud environments can strengthen protection against unauthorized access. Read Cloud Continuum: Best Practices and Benefits for additional context on cloud adoption across different environments.
