Zero Trust is a security strategy, and as such there are many different architectures companies can use depending on their specific business, network and technology environment. It is important for security architects to fully understand their current enterprise architecture in order to make informed decisions about the changes needed for Zero Trust initiatives.
Sign up so you never miss our weekly newsletter
Enterprise architecture covers a wide range of elements such as applications, access methods, data flows and network infrastructure, as well as the way the various devices and systems are connected to one another. Network topology, for its part, refers to how these devices and systems are connected. Enterprise networks are often complex and include many interdependent elements such as DNS, IP address management and routing, spread across LAN, WAN, cloud and SD-WAN segments. These networks can also include new types of networks, such as those found in IaaS (Infrastructure as a Service) environments.
A Zero Trust network access (ZTNA) project requires a good understanding of your network, the location of the company’s private resources, the network topology and how these interdependent systems work. ZTNA requires thoughtful changes to how users access resources across the network, as well as changes to the network itself. The benefits of ZTNA are considerable, but it must be deployed as part of a well-crafted strategy.
What are the two main Zero Trust network topology models?
There are two main models for Zero Trust network topology: “cloud-routed” and “direct-routed”. Gartner calls them “service-initiated” and “endpoint-initiated”, while other analysts use the terms software-defined perimeter (SDP) and identity-aware proxy. They are shown in the diagrams below, where we use the standard Zero Trust terms policy decision point (PDP) to represent the control plane and policy enforcement point (PEP) to represent the data plane. Note also that in this article we focus only on user access to the company’s private resources, not on user access to public web resources.
Cloud-routed network topology models
Direct-routed network topology models
In both cases, the control plane sits in the vendor’s cloud security infrastructure. This is how vendors deliver it as a service, providing management, monitoring and updates for customers, which simplifies operations and reduces complexity.
Cloud-routed vs direct-routed network topology models
In the cloud-routed model, the vendor’s cloud acts as a central place where connections meet “in the middle”. Remote users connect to the vendor’s nearest PEP, which controls their network access to the company’s private resources. The resources, which can be business applications or data, can run in an on-premises data center, an IaaS cloud environment or both. The vendor’s connector software runs next to the resources and establishes an outbound connection to the nearest PEP in the vendor’s cloud. Because the connector establishes an outbound connection, it usually simplifies deployment, but often limits use cases to remote user access to web applications only.
As for the direct-routed model, with this architecture the service provider’s cloud is used only as the control plane. The data plane is never visible to or accessible by the service provider, because companies deploy the provider’s PEPs in their own environment, where they run alongside their resources. Once authenticated, users receive a security token that lets them connect directly to the PEPs, hence the name direct routing. Network traffic flows between the user’s device and the resource through the PEP, which reduces the number of network hops and lowers latency. In addition, traffic routing remains under the company’s control, which lets it handle data residency requirements, for example.
The direct-routed model supports all network protocols (web, non-web, any TCP, UDP and ICMP) and handles server-initiated connections seamlessly. It also supports the concept of universal ZTNA, because on-site users accessing local resources keep their network traffic entirely within the local corporate network. Because the PEP must be deployed where the resources are, firewall changes are usually required. This architecture is better suited to supporting most of the more complex and sophisticated enterprise environments.
HTBS helps you secure your organization with the Zero Trust approach, which lets you protect and secure every element of your infrastructure while gaining global visibility of your attack surface.
Source: Appgate