Zero Trust on AWS

In my previous article (Amazon Verified Access) I mentioned Zero Trust and how we can deploy it in the AWS environment. So what is Zero Trust and how can we benefit from its advantages on AWS?

Organizations are increasingly prioritizing security. This allows for a variety of benefits, including maintaining consumer trust, increasing labor mobility, and unleashing new digital company potential. As they do so, they continue to address the age-old question: What are the best patterns for ensuring the appropriate levels of security and availability for my systems and data? Zero trust is increasingly being used to characterize the modern answer to this topic.

What is Zero Trust?

Zero Trust?is based on the principle of "never trust, always verify," requiring every access request to undergo rigorous validation, regardless of the requester's location. This approach ensures that security is maintained continuously across all points of access, effectively minimizing potential attack vectors.?

Zero trust architecture (ZTA)

Zero trust architecture (ZTA) is a conceptual paradigm and collection of techniques for establishing security controls around digital assets that do not rely exclusively or fundamentally on traditional network controls or network perimeters. Instead, network controls are enhanced with identity, device, behavior, and other rich contexts and signals to enable more granular, intelligent, adaptive, and continuous access decisions. Implementing a ZTA model allows you to accomplish a relevant next iteration in the continual growth of cybersecurity, namely defense-in-depth ideas.

Zero Trust principles

Zero trust architecture (ZTA) is built on a collection of key concepts that serve as the foundation for the security model. Understanding these principles is critical for firms seeking to implement a ZTA strategy successfully. So what are the base principles of ZTA:

• Verify and Authenticate: The verify and authenticate principle emphasizes the importance of strong identification and authentication for principals of all types, including users, machines, and devices.
• Least Privilege Access: The principle of least privilege requires principals to have the bare minimum of access necessary to carry out their duties. Organizations can enforce granular access restrictions by implementing the principle of least privilege access, which ensures that principals only have access to the resources required to carry out their tasks and responsibilities.
• Micro-Segmentation: Micro-segmentation is a network security approach in which a network is divided into smaller, isolated parts to allow certain traffic flows. You can achieve micro-segmentation by defining task boundaries and implementing strong access constraints between segments.
• Continuous Monitoring and Analytics: Continuous monitoring and analytics entail the collection, analysis, and correlation of security-related events and data throughout your organization's environment. Implementing robust monitoring and analytics systems allows your firm to review security data and telemetry in a consolidated manner.
• Automation and Orchestration: Automation and orchestration enable firms to streamline security procedures, eliminate manual intervention, and improve reaction times. By automating common security processes and leveraging orchestration capabilities, your organization can enforce consistent security standards and respond quickly to security incidents.
• Authorization: In a ZTA, each request to access a resource must be explicitly permitted by a gating enforcement point. Authorization policies should take into account more than only the authenticated identity, such as device health and posture, behavior patterns, resource classification, and network factors.

AWS Zero Trust Best Practice

AWS provides core tools for creating Well-Architected apps on the cloud. The AWS Well-Architected Framework contains ways for comparing your workload to AWS best practices and obtaining recommendations to create stable and efficient systems. The Well-Architected Framework is built on five separate pillars, one of which is security-focused. To build on this well-architected content, consider a web application as an example of applying Zero Trust to an AWS infrastructure.

Applying Zero Trust to AWS:

Could you rewrite the architecture, but protect each component as a microservice rather than as part of a broader trusted system? For example, let us look at how we may use the AWS WAF service to protect against tampering and information disclosure caused by a SQL injection attack. Customers who visit the website will access both static and dynamic content via Amazon CloudFront. While it makes sense to apply AWS WAF restrictions to the CloudFront distribution, ELB/ALB will use a public IP address that could be discovered by others. One mitigation strategy would be to apply the same WAF rules directly to the load balancer.

What about the web server and application server tiers? Those are generally regarded as "internal" components, and data passing between them is not subject to the same scrutiny. However, the Zero Trust paradigm mandates that all components and communications be deemed untrustworthy. AWS WAF may not be the best option depending on the communication protocols, however an additional layer of filtering - either host-based or network-based - would be added to validate input before it is consumed by the app tier. Furthermore, authentication and authorization of commands between these two layers would be continuous, similar to how AWS employs the AWS Signature Version 4 for API signing.

?AWS WAF rules and local input validation are successful in mitigating some assaults, but what about DDoS? AWS Shield guards against the most prevalent volumetric and state depletion assaults, but you should consider potential threats from other parts of the system. The best practice architecture does not handle the possibility of a web server instance overloading the application server with legitimate but pointless work, nor does it address an unintentionally misconfigured security group.

Key Takeaways

Nowadays, by increasing the importance of security in all organizations especially cloud environments accessing resources with authenticated specifications is very important. Zero Trust is a conceptual paradigm and related set of procedures that focus on establishing security controls around digital assets that do not rely mainly or mostly on traditional network controls or network perimeters. Instead, network controls are enhanced with identity, device, behavior, and other rich contexts and signals to enable more granular, intelligent, adaptive, and continuous access decisions. Learn about Zero Trust's key ideas, including least privilege, micro-segmentation, continuous authentication, and adaptive authorization.

References

1. Zero Trust
2. Zero Trust vs VPN
3. Zero Trust architectures on AWS
4. Exploring Zero Trust Security on AWS