For the past 40 years or so, and more recently with the use of next-gen firewalls and secure web gateways, there has always been an outwards vantage point for security. The reactive processes and technologies have revolved around deterring bad actors from infiltrating organizations, data, and applications. Perimeter-based security intrinsically trusts everyone inside, affirming that if an address originates from a “trusted” virtual private cloud or network segment, the communication and actions were free of malicious intent.
As traditional constructs of on-site employees and on-premises solutions fade, and critical applications and data are moved to the cloud, security teams are left to question the effectiveness of perimeter security. The former sense of trust and control is evaporating, as policies are unable to keep pace with dynamic, scalable, and distributed multi-cloud environments.
How perimeter security fails today
The complexity of today’s business ecosystems has driven industry experts to insist that the corporate perimeter is obsolete, even dangerous. That's why many organizations are transforming their infrastructures to escape legacy networks full of “security debt.” Instead of bolting on security to fill the holes that perimeter security measures fail to protect, enterprises have the opportunity to build in entirely new methods and rethink their approach:
- Heterogeneous environments have more work and less security – Many organizations work within a hybrid cloud environment, maintaining on-premises solutions in tandem with cloud-based resources and workloads. The problem with securing bifurcated architectures lies in the fact that modern cloud workloads are elastic and, in many cases, serverless. Yet, organizations continue to attempt to operate security policies with controls that were not designed to dynamically scale and adapt instantaneously. To reconcile, security teams must conduct an increased amount of synchronization tasks and maintenance overhead.
- Virtualization concentrates risk – As applications and data become co-mingled, the attack surface becomes unwieldy as organizations struggle to manage policies and enforce least privilege. Under the guise of perimeter-based security, all users and administrators inside the network are “trusted” with their access to cloud-based applications, regardless of whether or not privilege is properly maintained. Malicious actors use these oversights and management challenges to deliver a myriad of attack mechanisms. A single successful phishing attack of an authorized insider or spoofing an address can provide a foothold for attackers to move laterally within the network, and into the cloud for unfettered access to business-critical data and applications.
Even though most modern networks are broken into “trust zones,” or segmented areas surrounded by access controls, these perimeters remain ineffective since attackers can gain enough information to piggyback on authorized network access policies.
- It’s impossible to protect what you don’t know – Cloud deployments remain opaque. Using traditional security tools with only a view through networking concepts like IP addresses, ports, and payloads, security teams become impeded by blind spots. With a perimeter-focused security setup, the issue is compounded since a gap exists between what is enforced and what actually needs protecting. Attackers understand this weakness and exploit the gap to infiltrate, and then traverse through the network until they land on the intended target.
The inability to properly secure or see into the network allows attackers to dwell for an average of over 200 days, despite best efforts. In that time, they have free range to deliver malicious payloads, establish a presence, and ultimately explore until they are ready to exfiltrate data.
Zero trust segmentation – a more effective method
Traditional security constructs that relied on trusted addresses are giving way to the zero trust model in order to fix the perils of the new network paradigm. Through the guiding principle of “never trust, always verify,” it is assumed that the network is by default a hostile place, with not only external threats to deal with, but also internal. This shift in approach dictates that trust is only established once the secure identity of the applications, users, and hosts controlling the addresses are authenticated. By allowing only trusted applications to communicate over approved network paths through zero trust segmentation, organizations gain better security that extends beyond the network.
With reliance on homogenous security controls throughout the environment, zero trust segmentation allows for consistent policies, while remaining independent from the underlying network topology. As cloudfronts scale dynamically in real time, established controls and protection policies are able to adapt for instant, consistent security.
Zscaler has embraced zero trust segmentation and has operationalized it with machine learning, enabling us to stop compromise and attack progression of internet-borne threats. Learn more about Zscaler Workload Communications, a key component of the Zscaler Cloud Protection solution.
