Introduction to Zero Trust

Key Takeaways

are you looking to implement or evolve zero trust deployments inside of your organization then stay tuned because in this episode of the aure essential show we're going to look at zero trust and how to start implementing it into your [Music] organization welcome back to the Azure essential show I'm Thomas and I'm here with Brandon principal customer engineer at Azure to chat about zero trust guidance for networking in the first episode of this two-part series on zero trust we will get an overview of Zer trust explore the free design principles behind zero trust and find out how Azure can help you in your own zero trust Journey the next episode we will look at ways you can begin to implement zero trust before we jump into the conversation make sure to check out the description below to find all the links to all the resources we are talking about today make sure you hit the like button and subscribe to the Azure Essentials show so you don't miss out on any future episodes and if you have any questions be sure to leave a comment below and we will come back to you Brandon thanks for joining us today to walk us through zero trust thanks for having me Brandon can you explain the concept of zero trust to our viewers sure thing Thomas zero trust isn't a product or a service it's an approach for how to design and Implement your security it's a security strategy that assumes everything your in your environment is at risk zero trust means there's no such thing as a trusted asset or environment everything deserves to be validated it's all about being prepared to detect and respond to Modern cyber threats think of zero trust as a Integrated Security philosophy that extends throughout your entire digital estate this is an in to-end strategy that adapts to the complexities of today's environment it Embraces the mobile work force and protects user accounts applications and data wherever they're located yeah I mean this is fantastic especially in the hybrid world we living in where we have workers remotely or inside um versus where we still had these castles right around our environments so um we talked about a little bit about how it is but can you have a look at these different uh practices sure uh at its core zero trust is about three design principles the first principle is to verify explicitly just because something originates inside our network doesn't mean it's legitimate we should look at every available data point to determine if something should be allowed just because you're coming from inside of the castle doesn't mean that you should be allowed into the treasure Vault inside of it so for example should a user have access to a file we don't want to just know if their account has access we want to know if the machine they're using is up to date with all security controls it's not a secure device we should prevent them from accessing sensitive information the next principle is to use lease privilege this means users and system should have the bare minimum of privileges to do what's needed or just enough access and this access should be given when it's needed and removed when it's not needed or just in time access this principle is also about using adaptive policies based on risk to make these decisions and protecting sensitive data so it can't be easily exfiltrated even if it is accessed the last principle is to assume breach assume that a compromise will happen or has already happened and that we need to secure against that you want to limit access between resources minimize the blast radius and verify endtoend encryption this way even if a compromise occurs you can detect and protect those are the three principles and zero trust is really just about applying each of these across all the Technologies in your environment okay so this sounds like a lot uh to consider and especially users uh today they can feel sometimes that security can get in uh their way so when we talk about um zero trust does this keep uh business users from working in the way that's best for them especially in the world of remote and hybrid work where we can basically work from anywhere yeah zero trust shouldn't stand in the ways of way of users being productive if anything zero trust should Empower that remote and hybrid work because it's about having secure connection and secure connection from anywhere what's important in these practices is that you want to build them so that you can actually use them in your organization because the easier it is for a user or device to be secure the more secure that user or device will be so Z trust is more like an enabler for remote and hybrid work in the world we are today but to stay protected you will want to apply it across your entire organization yeah you want to apply these across your whole technology stack there's a lot of discussion about zero trust as a uh tool for identity but you really want to apply them across of different things that we call pillars identity is one of them but you also have endpoints data and networking just applying zero trust practices to one pillar of the Technologies in your environment isn't going to give you the full benefit just securing one aspect isn't really adopting zero trust a unifying strategy and security policy with zero trust breaks down the different siloed Information Technology teams so that you've got better visitability and protection across your whole it stack which results in a more robust security posture it isn't just about working being secure and identity being secure and them not talking to each other it's about that all-in-one approach a zero trust approach also prioritizes routine task automation reducing the manual effort so security teams can focus on addressing critical threats okay so if a company organization now decides to implement zero trust how can they find out where they are in their zero trust journey and where do they know how they actually need to improve yeah so organizations can use a maturity model to uh figure out where they're at and where they need to improve organizations that are just beginning their Journey with zero trust are in what we call getting started they need to focus on reducing password risks with strong authentication methods simplifying and securing access with single sign on and getting visibility into their environments but more mature organizations are what we call Advanced they're using real-time analytics to make smarter decisions about what they allow looking across multiple pillars to detect Advanced threats and they're proactive about finding and fixing vulnerabilities our Mo most mature organization uh we call Optimal they are dynamically enforcing policies using automated threat detection and improving their user experience while providing the most secure environment they can so some of these sound like good security practices to take absolutely zero trust is really just about using all these good practices together it's not just one answer it's applying a lot of different uh processes so when we look at each pillar you could be at a different level of that maturity model in each pillar you could be in optimal and identity but just getting started with securing your data or applications living zero trust is about continually looking for areas to improve not about just implementing a few Technologies and calling it a day yeah so that's obviously great things to figure out where to look at to figure out the next steps in your Zer trust Journey um once you know where you want to improve how can the partnership with Azure help you to continue the implementation the evolution of zero trust within your organization yeah so Azure provides a variety of resources and tools to give your organization significant progress out of the gate we've got instructions for tools and configurations that can be used to support adoption in each pillar while there are products that you can deploy like dos protection or Azure firewall premium that help customers get visibility control there're also deployment guides for how to secure in place resources it's not just about implementing a new product but making sure what you have is uh using what's available to be secure remember it's really not about putting products into place but linking these different products together to give you a full picture because Azure products come with these principles in mind it's straightforward to integrate them with the security platform services like Sentinel to get visibility and start building automated detection and response rules when you're planning your Azure deployments you can use security design recommendations to build with zero trust first instead of having to fit it in later so Brandon um thanks for sharing so much about zero trust yeah thanks for having me on be sure to check out part two of Zer trust where we cover how to implement uh Zer trust with Azure Landing zones and thanks for watching the Azure essential show oh