Guarding the Cyber Fortress: Zero Trust vs. Segmentation

Zero trust: The comprehensive strategy

According to the Cloud Security Alliance, zero trust is a security framework that assumes threats to the network could be both external and internal. Therefore, no user or system should be automatically trusted. It can be likened to a fortress where every entry point is guarded, and no one is trusted by default — whether they're inside or outside the walls.

The core principles of zero trust, as defined by the Cloud Security Alliance, include:

• Verify xxplecitly: Always authenticate and authorize based on all available data points, including user identity, location, device health, service or workload, data classification and anomalies. This principle confirms identities as the first line of defense and ensures that access is granted only after thorough verification.
• Use least privilege access: Limit access with just-in-time and just-enough-access (JIT/JEA), risk-based adaptive policies, and data protection to help secure both data and productivity. This minimizes potential damage from compromised accounts by ensuring users and devices have only the necessary permissions.
• Assume breach: Minimize blast radius and segment access. Verify end-to-end encryption and use analytics to gain visibility, drive threat detection and improve defenses. This involves continuous monitoring to detect and respond to anomalies in real-time, ensuring that even if a breach occurs, its impact is contained.

Segmentation: A technical strategy for "assume breach"

Segmentation, particularly micro-segmentation, is a tactical approach within the zero trust framework that supports the principle of "assume breach." By dividing the network into smaller, isolated segments, this tactic ensures that even if a breach occurs, its impact is contained within a limited area. Think of it as having separate rooms within your fortress, each with its own locks and defenses, minimizing the potential damage from any single point of failure.

By assuming that breaches are inevitable, segmentation helps organizations prepare for and respond to security incidents more efficiently. It allows for quick isolation of compromised segments, preventing threats from spreading across the network and maintaining the overall integrity of the system.

While segmentation improves security by reducing the attack surface and limiting the lateral movement of threats, it does not offer identity or user validation controls. Therefore, an organization focusing solely on segmentation does not meet the principles of "verify explicitly" and "use least privilege access," which rely on identity and are essential for a comprehensive zero trust implementation.

Why "verify explicitly" and "use least privilege access" principles matter

The principles of "verify explicitly" and "use least privilege access" are foundational to the zero trust framework, ensuring that security is maintained at every level of access.

Verify explicitly is crucial because it ensures that every access request is authenticated and authorized based on all available data points. This principle is akin to having guards at every entry point of a fortress, verifying the identity and intent of each person or device seeking access. By continuously validating these credentials, organizations can ensure that only legitimate users, devices and processes are granted access, reinforcing the zero trust mantra of "never trust, always verify."

Use least privilege access is about granting users, devices and processes only the permissions they need to perform their tasks, and nothing more. This principle works in concert with segmentation to minimize the potential damage by ensuring that even if an account is compromised, it has limited access to sensitive resources. It's like giving each person in a fortress access only to the rooms they need to enter, reducing the risk of unauthorized access to critical areas. 

Together, these principles rely heavily on identity verification, which is a critical component that segmentation alone does not address. While segmentation focuses on dividing the network into isolated segments, it does not inherently consider the identity of users, devices and processes accessing those segments. What is the purpose of a heavily guarded fortress when there is no one to control who gets the keys? Emphasizing identity ensures that access is both secure and appropriate, providing a more comprehensive security strategy than segmentation alone.

Conclusion: Building a robust security strategy

While segmentation is a necessary component of zero trust, it is not synonymous with it. Understanding its role as a technical strategy within the broader zero trust framework, particularly in supporting the principle of "assume breach," is key to building a robust cybersecurity strategy. By adopting the full spectrum of zero trust principles to each of your protect surfaces, you can ensure resilience and protection against catastrophic failures in the face of evolving cyber threats.