Zero Trust Hardware Access

What is the Zero Trust Methodology?

Learn how HAC-1 Hardware Access Control is the missing piece of the puzzle in achieving a complete Zero Trust environment.

Zero Trust (ZT) is a security concept based on the principle of “never trust, always verify”. Essentially, Zero Trust accounts for the fact that threat exists everywhere; both within, and outside, an enterprise’s traditional perimeters. Hence, Zero Trust does just that; it eliminates the component of trust given to enterprise users and devices. Instead, access to resources is based on a dynamic policy that supports the principle-of-least-privilege (PLP) and is enforced by the Zero Trust Architecture (ZTA). In other words, when a device makes an access request for a specific resource, the Zero Trust Architecture evaluates the request by identifying the device (authentication) and referring to the access policy to determine whether said device can gain access, and to what extent (authorization).

Why Zero Trust Hardware Access is needed more than ever

The concept of Zero Trust is not new. It was actually first introduced in 1994, but, like anything, it takes a while for people to start catching on. And, as the threat landscape continuously evolves, now, more than ever, is the time to start catching on.

Typically, internal users and devices are automatically trusted. This is because it’s assumed that the secure walls of the enterprise are enough to keep out malicious criminals out.  A rooky error that IT departments are becoming increasingly concerned about, hence the desire to adopt Zero Trust.

Nowadays, one cannot assume that an internal user, or device, can be automatically trusted. Why? Well, for starters, insiders themselves might act with malicious intent. Several reasons might incentivize such action, and the employee’s insider privileges can prove beneficial in causing maximum damage. However, more worrisome is that enterprises struggle to provide comprehensive security due to a lack of visibility and control.

Securing Hardware in Organizations

The working environment is becoming increasingly expansive in terms of assets and perimeters. And, subsequently, it is becoming more demanding to secure both. The more hardware assets an organization has, the more difficult it is to manage them all. This is especially due to COVID-19 causing a rise in shadow IT within enterprises.

The pandemic caused a rapid shift to remote work, which was unfamiliar territory for many organizations. And with little time to implement the relevant policies, many employees were – and still are – using personal devices for work purposes. And these BYOD devices often go unmanaged.

Shadow IoT also becomes a significant risk to the enterprise as many household-IoT devices are infiltrating the corporate network yet lack sufficient, if any, security measures, greatly expanding the attack surface.

Furthermore, with the traditional working perimeters slowly fading away, remote work often means that employees are working in less secure environments. This of course, increases the susceptibility to attack. So, with more entry points, and less control over such entry points, any device could have been compromised by a malicious actor. This provides them with insider access.

Think about a football game at Wembley Stadium. All attendees must go through physical security checks. As a result, it is assumed that no one inside the stadium is carrying any dangerous items. But it is Wembley, the biggest football stadium in the UK, and it’s guaranteed that there will be exposed entry points. Just like Wembley, when a malicious actor gains access to the enterprise’s network, they are basically free to roam wherever they wish.

The Struggle is Real

While security departments struggle, malicious actors thrive. The IT department’s job becoming more of a challenge with the rise of telework. And attackers’ tools, techniques, and procedures are becoming more deceitful.

Cybercriminals are constantly demonstrating their ability to bypass traditional network and endpoint detection and response solutions. So, the “secure walls” I mentioned early are not, in fact, that secure. In some instances, bypassing such measures is not even necessary. Attackers will use social engineering techniques to have an insider – wittingly or unwittingly – cause a cyber incident. And employees’ access privileges (granted under the assumption of trust) only make the extent of the attack more damaging.

With Zero Trust, the trust given to internal users and devices is eliminated, and resources are protected under the assumption that there has already been a breach. To do this, access is granted based on PLP – permitting access only to those resources necessary to carry out the job – and implemented by micro-segmentation. By splitting the network into smaller, more granular sections, micro-segmentation prevents lateral network movement in an effort to reduce the blast radius of an attack.

All that free roaming around that attackers love to do? With micro-segmentation, it is no longer possible. Every access request is evaluated and determined by a dynamic policy that relies on various data sources to provide real-time information. In doing so, the idea is that no malicious actor – whether internal or external – can exploit insider privileges. With the risks of today’s working environment, and the benefits of Zero Trust, 40% of organizations have increased their adoption of the security model.

Zero Trust does not mean zero challenges

Nothing is perfect, not even Zero Trust. There are several challenges associated with the model and its efficacy in securing the organization (see table below). Unfortunately, the Zero Trust Architecture’s reliance on Identity and Access Management (IAM) to evaluate access requests is challenged by a lack of complete asset visibility, which results in blind spots.

According to PulseSecure’s 2020 Zero Trust Progress Report, 71% of organizations are seeking to improve their IAM, highlighting the need for deeper visibility. Existing security solutions do not cover the Physical Layer. This means that Spoofed Devices, which operate on this layer, are able to impersonate legitimate devices and subsequently bypass Zero Trust Hardware Access protocols.

So, despite Zero Trust enabling the safe use of BYODs and “good” shadow IT and IoT, the security model is not enough to protect against such devices compromised by a Spoofed Peripheral. In fact, BYOD and shadow IT exposures are a cause for a concern among 43% and 40% of organizations, respectively. As a result of a lack of visibility, there are spillover effects that create additional challenges. Naturally, malicious actors seek to exploit the visibility blind spot and turn to hardware-based attacks (operating on the Physical Layer).

To mitigate such challenges, Sepio’s Hardware Access Control solution (HAC-1) provides Physical Layer visibility, Hardware Access Control capabilities, and Rogue Device Mitigation that enhance the overall ZTA and ZT approach. Security on the hardware level brings a panacea to the blind spots of the traditional ZT model, and the current need for a Zero Trust Hardware Access solution. And HAC-1 enables organizations to overcome the visibility challenges that hinder the efficacy of Zero Trust Hardware Access. Zero Trust Hardware Access is the missing piece of the puzzle in achieving a complete Zero Trust environment.

Zero Trust Hardware Access Control