world tour:
Join us for a live look at how Menlo’s Secure Enterprise Browser puts you ahead of attackers
The ABCs of zero trust security in the enterprise
Zero trust turns the traditional detect-and-remediate approach to cybersecurity on its head. Instead of trusting everything except for known threats, zero trust assumes that all traffic – regardless of whether it originates from a trusted source – is untrustworthy. This forces web sites, web apps, Software-as-a-Service (SaaS) platforms and even email content to be treated as if it is malicious. It then needs to be authenticated continuously, before each interaction with a user, device or application on the network.
Traditional security strategies are built to authenticate entities (a user, device or application) once at the edge of the network and then give them access to everything inside the network. This worked well when enterprise networks were set up in a hub and spoke model where there was little mobility. Users tended to log in from corporate headquarters behind a robust firewall that could control traffic flowing in and out of the data center.
Today’s networks, however, are highly-distributed and mobile. Users, devices, apps and data are spread out across private and public cloud infrastructures where they are spun up and down on demand. This decentralized architecture hasn’t so much eliminated the perimeter as it has expanded it to anywhere users do business – whether it is a remote office, a home office, a customer site or on the road. The perimeter is everywhere – making it impossible to stop breaches. Zero trust, on the other hand, continuously authenticates entities at the perimeter and inside the network, ensuring that nothing gets through the cracks.
A zero trust security strategy begins with no access as the default. No user, device or application – regardless of location or status – can access anything without being granted access and authenticated first. From there, access has to be earned through continuous authentication. This prevents a malicious actor from getting access to an end device and then spreading through the network in search of a more valuable target.
Accelerated digital transformation has pushed everything out the edge of the network. Modern applications are no longer monolithic stacks in a single data center. They’re now split up into thousands of microservices spread out across multiple cloud infrastructures. This improves application experience and enables business agility, but it has essentially broken traditional security strategies that were built for the hub and spoke model where security is attached to static infrastructure. The new, modern way of working needs a modern security approach–and zero trust is ideal for securing users, devices, applications and data in the multi-cloud world.
Secondly, the threat landscape has evolved and grown tremendously over the past several years. Enterprises are sending usernames, passwords and multifactor authentication tokens all around the Internet, providing more opportunity for an attacker to intercept and steal those credentials. Enterprises are also sharing resources with the general public, and, therefore, malicious actors. The CEO of a Fortune 50 company likely has a Microsoft 365, Google Productivity Suite or Box account. So, too, does every hacker. It’s fairly easy to spin up a legitimate-looking email communication to trick a user into giving way credentials. Zero Trust stops lateral movement and safeguards other applications inside the network.
Zero Trust Access
It’s important to note that zero trust is not a solution. It’s not a product. It’s not something you can turn on and off. Zero trust is a mindset that needs to be implemented throughout the organization from the management team to the IT team to individual users. It requires a complete re architect of your network.
The first step for implementing zero trust is to know what resources you have and who needs to connect to them. This catalog serves as a trusty road map for granting authentications. What applications do you have? Who needs access? How do you request and get access? What kind of access does each user need? Read only? Read/write? What behaviors are allowed and what should be blocked? Knowing the answers to these questions allows you to build rules around zero trust security that can be implemented effectively.
A clientless approach that goes through the browser allows you to extend control to devices that you don’t manage – including personal devices, partners, customers and other third parties. Some applications will continue to require an agent–and that’s fine. But starting with a clientless by default approach to zero trust eliminates these gaps and allows you to offload a lot of bandwidth off your VPN onto the public Internet – which improves performance and lowers networking costs.
Zero Trust isn’t just about the user and their device. It’s about application to application connectivity. It’s about data. It’s about IoT devices. It’s about external collaborators, All these entities need to be who they say they are and have a legitimate reason for connecting to each other and the network.
Today’s applications – whether they are Microsoft 365 or Salesforce – require continuous connectivity to enable real-time collaboration. Someone makes an update to a customer record or edits a shared document, every users’ view is reflected in real time. As you make the shift to zero trust, you need to put in place a system of continuous analysis of everything that’s happening.
You might see that an end user connects in and they start behaving strangely. They start downloading a whole lot more than they did. Normally that might be a red flag, and you might want to do something about that.
You might see that the application at the other end is actually connected to something different than it was before. Maybe there’s one other entity or maybe another app connected into that app that didn’t exist there before. That might be a sign that there’s something suspicious or potentially malicious going on with the application.
And then finally, you would want to be able to look at data coming through. Because again, if we’re not going to trust the user and their device, we’re not going to trust the application. We’re not going to trust the data. We need to make sure that the data coming down from those applications to the end user is also not malicious.
Without a doubt, an approach that places browser security at the core of the security stack is the most effective and efficient zero trust strategy. Browser security and Secure Cloud Browsing is the secret sauce that pulls everything together, acting as a central technology framework through which all security services can be delivered safely and securely in the cloud.
Secure Cloud Browsing works by creating a protective layer around users as they navigate the web and applications, blocking not only known and existing threats but unknown and future threats as well. Secure Cloud Browsing needs to be applied consistently across the organization, not disrupt user productivity, give the security team complete visibility and control over web-based traffic and scale instantly to any user in any location around the globe.
When done right, Secure Cloud Browsing makes security invisible, happening behind the scenes where it can’t inhibit productivity for today’s remote workforce. Email clients and web browsers should continue to work as intended. There should be no clients to install or hardware to ship, and common browsing functionality such as shortcuts, cutting, pasting and printing work needs to be preserved. The right browser security solution makes sure employees access the Internet with all of the features and functionality they’ve come to expect. No pixelated screens or read-only web pages. Everything should work for your users as intended no matter where business takes them.
Menlo Security secures enterprise browsers. Menlo Security manages browsers, protects your users, and secures application access and enterprise data, providing a complete enterprise browser solution from any browser. Menlo Security secures browsers while preserving user choice and providing a familiar, easy-to-use experience. You can deploy browser security policies in a single click, secure SaaS and private application access, and protect enterprise data down to the last mile. At the core is the Menlo Secure Cloud Browser which runs within an elastic and orchestrated cloud-native platform, fetching content and delivering safe, decomposed and reconstructed, content to a local browser. Cloud content inspection keeps threats off the endpoint and protects against internet-born phishing and evasive malware. The AI-powered cloud content inspection works with the safe cloud document and archive viewer, browser isolation, and other protections. The Secure Cloud Browser scales globally and can deliver a risk-free local-browsing experience for every user, every tab, and every web session within and across your enterprise.
Learn more about Zero Trust Access
