Lack of flexibility in host placement (both physical and logical).Placing stopgaps in the network is a solid step forward from the designs of yesteryear, but it is significantly lacking in the modern cyberattack landscape. The zero trust model turns this diagram inside out. Traditional network security architecture Such an approach gives rise to an architecture that is similar to some you might have seen before, such as the one shown in Figure 1-1.įigure 1-1. For example, resources deemed more risky, such as web servers that face the public internet, are placed in an exclusion zone (often termed a âDMZâ), where traffic can be tightly monitored and controlled.
This model provides very strong defense-in-depth. Each zone is granted some level of trust, which determines the network resources it is permitted to reach. Traditional network security architecture  breaks different networks (or pieces of a single network) into zones, contained by one or more firewalls. Policies must be dynamic and calculated from as many sources of data as possible.Every device, user, and network flow is authenticated and authorized.Network locality is not sufficient for deciding trust in a network.External and internal threats exist on the network at all times.The network is always assumed to be hostile.The good news is that weâve got pretty good crypto these days, and given the right automation systems, this vision is actually attainable.Ī zero trust network is built upon five fundamental assertions: It goes without saying that this is a lofty goal.
Instead, it is possible to secure network communication and access so effectively that physical security of the transport layer can be reasonably disregarded. Zero trust aims to solve the inherent problems in placing our trust in the network. As a result, moving freely within a âsecureâ infrastructure is frequently trivial once a single host or link there has been compromised. Modern networks and usage patterns no longer echo those that made perimeter defense make sense many years ago. The assumption that systems and traffic within a datacenter can be trusted is flawed. But why? Isnât it exactly what you would do in their position? Especially if you knew that traffic there would not be encrypted? The world was shocked at the revelation that they had managed to get inside the datacenters of large organizations. Whistleblowers like Edward Snowden and Mark Klein have revealed the tenacity of government-backed spy rings. Can we trust that our internet traffic will be safe from eavesdropping? Certainly not! What about that provider you leased your fiber from? Or that contracted technician who was in your datacenter yesterday working on the cabling?
0 kommentar(er)
