Zero Trust network topology and its importance
Zero Trust is a security strategy, and as such, there are many different architectures that organizations can adopt depending on their specific business, network, and technology environments. It is important for security architects to have a thorough understanding of their organization’s current architecture in order to make informed decisions about the changes required for Zero Trust initiatives.
Sign up so you don't miss our weekly newsletterÂ
Enterprise architecture encompasses a wide range of elements, such as applications, access methods, data flows, network infrastructure, and the way in which various devices and systems are connected to one another. Network topology, on the other hand, refers to how these devices and systems are interconnected. Enterprise networks are often complex and include many interdependent elements such as DNS, IP address management, and routing, which are found on LAN, WAN, cloud, and SD-WAN segments. These networks may also include new types of networks, such as those found in IaaS (Infrastructure as a Service) environments.
A Zero Trust Network Access (ZTNA) project requires a thorough understanding of your network, the location of the company’s private resources, the network topology, and how these interdependent systems work. ZTNA requires thoughtful changes to how users access resources across the network, as well as changes to the network itself. The benefits of ZTNA are significant, but they must be implemented as part of a well-developed strategy.
What are the two main Zero Trust network topology models?
Il existe deux modèles principaux pour la topologie de réseau Zero Trust, qui sont “le cloud-routed” (Modèles de topologie de réseau acheminé par le cloud) et “direct-routed” (topologie de réseau acheminé directement). Gartner les désigne sous le nom de ” service-initiated et endpoint-initiated“, tandis que d’autres analystes utilisent les termes périmètre défini par logiciel (SDP) et proxy de gestion d’identité. Ils sont représentés dans les diagrammes ci-dessous, où nous utiliserons les termes standard de Zero Trust de point de décision de politique (PDP) pour représenter le plan de contrôle et point d’application de politique (PEP) pour représenter le plan de données. Notez également que, que dans cet article, nous nous concentrons uniquement sur l’accès des utilisateurs aux ressources privées de l’entreprise et non sur l’accès des utilisateurs aux ressources web publiques.
In both cases, the control plane is located within the provider’s cloud security infrastructure. This is how providers offer this as a service, handling management, monitoring, and updates for customers, which simplifies operations and reduces complexity.
Cloud-based vs. Directly Routed Network Topology Models
Dans le modèle cloud-routed, le cloud du fournisseur agit comme un endroit centralisé où les connexions se rencontrent ” au milieu”. Les utilisateurs distants se connectent au PEP du fournisseur le plus proche pour contrôler leur accès réseau aux ressources privées de l’entreprise. Les ressources, qui peuvent être des applications métier ou des données, peuvent être exécutées dans un centre de données sur site, un environnement cloud IaaS ou les deux. Le logiciel de connexion du fournisseur s’exécute à côté des ressources et établit une connexion sortante vers le PEP le plus proche dans le cloud du fournisseur. Étant donné que le connecteur établit une connexion sortante, il simplifie généralement le déploiement, mais limite souvent les cas d’utilisation à l’accès distant des utilisateurs uniquement pour les applications Web.
As for the direct routing model, with this architecture, the service provider’s cloud is used solely as a control plane. The data plane is never visible or accessible to the service provider because companies deploy the service provider’s PEPs in their own environment to operate alongside their resources. Once authenticated, users receive a security token that allows them to establish connections directly to the PEPs, hence the name “direct routing.” Network traffic flows between the user’s device and the resource via the PEP, which reduces the number of network hops and lowers latency. Furthermore, traffic routing is under the enterprise’s control, allowing it to manage data residency requirements, for example.
The direct routing model supports all network protocols (Web, non-Web, all TCP, UDP, and ICMP) and transparently handles server-initiated connections. It also supports the universal ZTNA concept because on-premises users accessing local resources will have their network traffic entirely within the local corporate network. Since the PEP must be deployed where the resources are located, firewall modifications are generally required. This architecture is better suited to support most complex and sophisticated enterprise environments.
HTBSÂ helps you secure your organization using the Zero Trust approach, which allows you to protect and secure all components of your infrastructure while also providing comprehensive visibility into your attack surface.
Source:Â AppgateÂ
