Written by Fahad Naeem – Cyber Security Consultant (Cyberfort)
The core philosophy of modern cyber security has flipped. Never trust, always verify. Perimeter defences like traditional firewalls and VPNs are no longer enough; they leave blind spots inside your network once an attacker gets past the gate. This is where Zero Trust Architecture comes in.
What is Zero Trust Architecture?
Zero Trust Architecture is a relatively modern cyber security framework that shifts the traditional approach around securing the boundary to operating on the principle of never trusting and always verifying. There is an assumption that the threat exists both inside and outside the network. Automatic trust is removed from every user, device, application, and there is an enforcement of identity verification, device health checks, and least-privilege access controls for every user, application, or system attempting to connect to resources.
The benefit of this approach is that it reduces the possible attack surface of a threat actor as it limits their access points and minimises the risk of lateral movement by attackers, limiting the damage of any potential breaches.
Legacy Problems
Zero Trust is easy to conceptualise in a modern cloud environment; however, the challenge arises when applying to legacy systems that are deeply embedded in an organisations operation. The previous framework focused on perimeter-based security e.g. firewalls and virtual private networks, which do provide security benefits, but provides a fundamentally limited view inside the network.
Because legacy systems were built before modern Zero Trust standards existed, they present multiple security vulnerabilities. This is compounded by the fact that these systems often run outdated operating systems, creating additional attack vectors to be exploited. They also create integration hurdles, including incompatibility with single sign-on standards like SAML or OIDC, and a lack of support for endpoint detection and response (EDR) agents, which hinders device health verification.
These issues have led to significant impacts in the real world:
British Library ransomware attack – due to lack of network segmentation attackers were able to exfiltrate 600 gigabytes of data.
Target data breach – an attacker was able to compromise third party vendor credentials and because of lack of network segmentation attackers were able to steal 40 million credit card records.
Micro segmentation
One approach that can help legacy systems is micro segmentation; this allows organisations to isolate and secure legacy without having to rewrite code. By creating smaller tightly controlled network zones with least privilege access enforcement, lateral movement is limited.
A particularly difficult challenge to contend with for legacy systems is the lack of a hypervisor, which sits between physical hardware and the operating system. It is used to manage traffic, processing (CPU), memory (RAM) and storage between the virtual computers and allows them to run independently and even on different operating systems. Security tools use three methods to handle this scenario:
1. Operating system approach (internal enforcement)
with administrative access to the server’s operating system, an agent can be installed directly. The agent acts as local security that can push micro segmentation policies and routing data securely to its intended location.
2. Network port approach (external hardware enforcement)
if the server is a closed application, then you can use physical network switches in your server room. The switch becomes the security boundary and manages the data ingress.
3. Proxy/Gateway approach (identity-based delivery)
in this approach the server is hidden from the rest of the network, and the proxy or gateway sits in front of the server with the server configured only to accept traffic from the proxy. The proxy can then authenticate identities and pass device health checks.
Depending on your specific situation a combination can gain the desired segmentation.
Real world examples include:
- BUPA’s Cromwell Hospital – they utilised agentless micro segmentation to identify unmanaged devices, group them and apply identity-ware policies at the edge of the network. Resulting in all medical machinery being ring fenced minimising lateral movement risks.
- U.S. Federal Government Agency – The agency deployed a rigorous Software-Defined Perimeter (SDP) and Micro-Segmentation model; this reduced their attack surface by 85% and stopped 100% of red team’s penetration tests.
So where should you start with micro segmentation? Based on our experience at Cyberfort we collaborate with our customers on embedding a 4-step approach:
1. Inventory and risk-assess before you segment
First identify your legacy system, what they connect to, what data they handle and why they cannot be patched or replaced in the normal way, then document the risk assessment formally rather than leaving it as IT group knowledge, so the decision to compensate with segmentation (rather than remediate directly) is deliberate and auditable.
2. Choose the enforcement method the system will actually support
Check what access you genuinely have – administrative rights to install an agent, physical control of the network hardware, or the ability to front the server with a proxy, before committing to an approach. Forcing the wrong method onto a system that can’t support it (for example, trying to install an agent on a closed appliance) wastes effort and can leave gaps that look closed but aren’t. Also make sure you consider the risk of over-segmentation which can lead to operational inefficiencies and if user experience is ignored it can lead to workaround which can open the risk back up.
3. Build the zones around least privilege, not convenience
Define each segment as narrowly as the system’s function allows, and grant access only to the specific users, services and ports that genuinely need it. A segmentation zone that is still broad enough to let lateral movement happen defeats the purpose, the tighter the boundary, the smaller the blast radius if the legacy system is compromised.
4. Monitor the boundary continuously, not just at set-up
Segmentation only works if you can see when something crosses it. Feed the traffic at each zone boundary into your monitoring so unusual connections, a legacy system suddenly reaching out to somewhere it never has before, are flagged and investigated in real time, rather than discovered after the fact.
Migration Strategies
When considering your organisation and its need a practical method to move off legacy systems can be to wrap and migrate; wrapping is securing your current system so the immediate risk is minimised allowing you to continue with your functions and then migrating to more modern systems in the longer term.
Below is a high-level approach of how this can be implemented:
The first step is always to review and prioritise your system to ensure that you are focusing on what matters most to your organisation. Ask questions like:
- How critical is this system to operations? It is important to have impartial scoring as business areas will always consider themselves the most important. ISO22301 has a section around business impact assessment that can help determine the impact to the business if a system is lost and therefore determine an order of criticality.
- Does it handle or store sensitive data? This can be either personally sensitive data or sensitive company data.
- Can it be easily replaced or modernised in the short term?
Once this has been completed you know where to focus your efforts to maximise benefits. First, limit network access to validated users only. Next, implement segmentation so systems are isolated from one another, effectively limiting the blast radius of a potential attack. This also increases the life span of your solution reducing organisational waste.
Over the long term you can develop a migration strategy e.g. how to move your system off the legacy approach and to follow a zero-trust model, either on-premises or a cloud service providers environment. This might require refactoring or replacing systems, by building them yourself or by purchasing software as a service (SaaS).
Finally, once you have migrated and validation has been completed, decommission old hardware and systems following best practices to ensure safe disposal of your businesses data.
Key takeaways
- It’s not about if an attacker can breach your boundary protection it’s when.
- Consider your system and what approach works best for your organisation.
- Immediate migration is likely to be pricey and might not be the best approach in the short term.
For further reading check out Zero Trust | Zero trust architecture design principles | National Cyber Security Centre.
If you would like to find out more about Cyberfort Zero Trust Architecture services contact us at [email protected] and one of our experts will be in touch.
