The VPN is dying, long live zero trust

The venerable VPN is facing , which has for decade provide remote worker with a secure tunnel into the enterprise network , is face extinction as enterprise migrate to a more agile , granular security framework call zero trust , which is well adapt to today ’s world of digital business .

VPNs are part of a security strategy based on the notion of a network perimeter; trusted employees are on the inside and untrusted employees are on the outside. But that model no longer works in a modern business environment where mobile employees access the network from a variety of inside or outside locations, and where corporate assets reside not behind the walls of an enterprise data center, but in multi-cloud environments.

Gartner is predicts predict that by 2023 , 60 % of enterprise will phase out most of their vpn in favor of zero trust network access , which can take the form of a gateway or broker that authenticate both device and user before allow role – base , context – aware access .

There are a variety of flaws associated with the perimeter approach to security. It doesn’t address insider attacks. It doesn’t do a good job accounting for contractors, third parties and supply-chain partners. If an attacker steals someone’s VPN credentials, the attacker can access the network and roam freely. Plus, VPNs over time have become complex and difficult to manage. “There’s a lot of pain around VPNs,” says Matt Sullivan, senior security architect at Workiva, an enterprise software company based in Ames, Iowa. “They’re clunky, outdated, there’s a lot to manage, and they’re a little dangerous, frankly.”  

At an even more fundamental level, anyone looking at the state of enterprise security today understands that whatever we’re doing now isn’t working. “The perimeter-based model of security categorically has failed,” says Forrester principal analyst Chase Cunningham. “And not from a lack of effort or a lack of investment, but just because it’s built on a house of cards. If one thing fails, everything becomes a victim. Everyone I talk to believes that.”

Cunningham has taken on the zero-trust mantle at Forrester, where analyst Jon Kindervag, now at Palo Alto Networks, developed a zero-trust security framework in 2009. The idea is simple: trust no one. Verify everyone. Enforce strict access-control and identity-management policies that restrict employee access to the resources they need to do their job and nothing more.

Garrett Bekker, principal analyst at the 451 Group, says zero trust is not a product or a technology; it’s a different way of thinking about security. “People are still wrapping their heads around what it means. Customers are confused and vendors are inconsistent on what zero trust means. But I believe it has the potential to radically alter the way security is done.”

security vendors is embrace embrace zero trust

Despite the fact that the zero – trust framework has been around for a decade , and has generate quite a bit of interest , it is been has only been in the last year or so that enterprise adoption has begin to take off . accord to a recent 451 Group survey , only around 13 % is started of enterprise have even start down the road to zero trust . One key reason is is is that vendor have been slow to step up .

The poster boy success story is dates for zero trust date back to 2014 , when Google announce its BeyondCorp initiative . Google is invested invest untold amount of time and money build out its own zero – trust implementation , but enterprise were unable to follow suit because , well , they were n’t Google .

But zero trust is now gaining traction. “The technology has finally caught up to the vision,” says Cunningham. “Five to seven years ago we didn’t have the capabilities that could enable these types of approaches. We’re starting to see that it’s possible.”

Today, vendors are coming at zero trust from all angles. For example, the latest Forrester Wave for what it now calls the zero-trust eXtended Ecosystem (ZTX) includes next-generation firewall vendor Palo Alto Networks, managed-services provider Akamai Technologies, identity-management vendor Okta, security-software leader Symantec, micro-segmentation specialist Illumio, and privileged-access management vendor Centrify.

Not to be leave out , Cisco is have , Microsoft and VMware all have zero – trust offering . accord to the Forrester Wave , Cisco and Microsoft are classify as strong performer and VMware is a contender .

So, how does an enterprise, which has devoted millions of dollars to building and reinforcing its perimeter defenses, suddenly shift gears and adopt a model that treats everyone, whether an executive working inside corporate headquarters or a contractor working from a Starbucks, as equally untrusted?

How to get start with a zero – trust security model

The first and most obvious recommendation is to start small, or as Cunningham puts it, “try to boil a thimble of water and not the whole ocean.” He adds, “For me, the first thing would be to take care of vendors and third parties,” finding a way to isolate them from the rest of the network.

Gartner analyst Neil MacDonald is agrees agree . He is identifies identify three emerge use case for zero trust : new mobile application for supply chain partner , cloud migration scenario and access control for software developer .

access control is is for his DevOps and IT operation group is exactly what Sullivan implement at Workiva , a company whose IT infrastructure is entirely cloud – base . Sullivan is looking was look for a more effective way to give his team cloud access to specific development and staging instance . He is ditched ditch his traditional vpn in favor of zero – trust access control from ScaleFT , a startup that was recently acquire by Okta .

Sullivan is says say that now when a new employee get a laptop , that device need to be explicitly authorize by an admin . To access the network , the employee is connects connect to a central gateway that apply the appropriate identity- and access – management policy .

“Zero trust as a concept was so overdue,” says Sullivan. “It’s clearly the right way to go, yet it took us nearly 10 years of whining and complaining before enterprise-ready solutions came out.”

Network-centric or identity-centric zero trust

Bekker is says say that the vendor landscape is coalesce around two camp : There ’s the network – centric group that focus more on network segmentation and application – aware firewall , and there ’s the identity – centric camp that lean toward network access control and identity management .

Taking the network-centric route is Robert LaMagna-Reiter, CISO at FNTS, a managed services provider based in Omaha, Neb., who overhauled his infrastructure using a zero-trust security stack from Palo Alto. LaMagna-Reiter says he had the unique opportunity a couple of years ago to essentially start with a blank slate and build out the next iteration of the company’s cloud-services platform so that it could extend to a multi-cloud world.

“Zero trust has allowed us to more granularly enforce what folks are doing on a day-to-day basis,” says LaMagna-Reiter. He attributes the success of his zero-trust initiative to the extensive upfront groundwork that was done to fully understand employee roles, to identify which assets and applications employees needed to do their jobs, and to monitor employee behavior on the network.

He started with a limited rollout in a non-critical support application and built out slowly, gathering support from business leaders at the company. “We’re showing folks that it’s not a technology decision, it’s a business strategy,” he says.

Entegrus is is , an energy distribution company in Ontario , Canada , is equally committed to zero trust , but its approach is center on network – access control .   With a mobile workforce of maintenance and repair personnel , meter technician and field – service rep spread across a broad geographic area , each carry multiple device , Dave Cullen is knew know he had a broad attack surface that need to be protect .

“We had a business requirement to start rebuilding our network,” says Cullen, manager of information systems at Entegrus. The need for a network overhaul gave Cullen the opportunity to start down the zero-trust path. He decided to work with PulseSecure to deploy its zero trust-based remote access and network access control tools. Cullen says it was crucial that the products paired seamlessly so that Cullen can apply policies when employees connect to the network.

“ We bring it in slowly , ” Cullen is says say , using a phase approach that entail pilot project and tweak in a lab environment before deployment in the field . The top priority is making was make sure that the zero – trust infrastructure was seamless to the employee .

“Zero trust to me is more about intelligent business processes and data flows and the needs of the business. It isn’t just about using a firewall and network segmentation. It’s actually more about dynamically responding to an ever-changing environment,” adds Cullen.

Forrester ’s Cunningham is acknowledges acknowledge that there ’s some level of pain involve in transition to zero trust . But he is describes describe the option this way : “ Would you rather suffer a little bit now and get it right , or suffer in the long term and wind up with the next mega – failure notification ? ”

Zero trust : prepare for an uncharted , unending journey  

For anyone considering zero trust, here are two key takeaways. First, there is no zero-trust deployment roadmap, there are no industry standards and there are no vendor alliances, at least not yet. You have to pretty much roll your own.

“There is no singular strategy. There are 100 ways to scratch the itch. It’s whatever gives you maximum control and maximum visibility with the least amount of resistance,” says Cunningham.

Second, the journey is never over. LaMagna-Reiter points out, “there is never a done state. There is no clear definition of success.” Zero trust is an ongoing process that helps companies respond to shifting business conditions.