NSA Pushes Zero Trust Principles to Help Prevent Sophisticated Hacks
Daniel J. Macy/Shutterstock
By
Mariam Baksh
Operating under the default position that an organization has been compromised is a pain that’s worth it, the agency said.
The National Security Agency is working with National Security Systems and Defense Department programs to pilot the implementation of Zero Trust principles and will provide more guidance in the coming months, according to a document the agency released last week.
While traditional security architectures focus on protecting the perimeter of an enterprise, a Zero Trust approach assumes the threat is already inside the network and emphasizes continuously monitoring who has access to high-value data at every step and stopping them from capturing it.
The guide NSA released Feb. 25 provides examples of how implementing Zero Trust could have foiled some of the approaches hackers used to compromise at least nine federal agencies and a hundred companies in an attack that leveraged network management company SolarWinds in combination with other avenues. The perpetrators’ focus on avoiding detection portends greater use of such tactics in the future and makes Zero Trust all the more important, NSA said.
“Several recent, highly publicized system breaches have exposed widespread vulnerabilities in systems, as well as deficiencies in system management and defensive network operations,” the guidance reads. “A mature Zero Trust environment will afford cybersecurity defenders more opportunities to detect novel threat actors, and more response options that can be quickly deployed to address sophisticated threats. Adopting the mindset required to successfully operate a Zero Trust environment will further sensitize cybersecurity defenders to recognize ever more subtle threat indicators.”
Zero Trust architectures also are more important in increasingly remote environments made necessary by the pandemic.
The guidance notes that while a traditional approach relies on validating passwords, which the SolarWinds hackers exploited to gain initial access in many cases, a Zero Trust approach would also validate devices themselves. If an attacker were to use stolen credentials but a device that is not known, "the device fails authentication and authorization checks and so access is denied and the malicious activity is logged,” NSA said.
The agency also recommends using strong multi-factor authentication, which "can make stealing the user’s credentials more difficult in the first place.”
But in some cases in the recent hacking campaign, the attackers were able to bypass multi-factor authentication by exploiting a weakness in Microsoft’s Active Directory service.
In another example, the NSA said even once the hackers were able to get into victims’ networks, Zero Trust could have helped to thwart the devices they used to set up the command and control system they used to exfiltrate the data with the help of the malware they delivered via a SolarWinds update.
“While the device may be able to download signed application updates (malicious or not), the device’s allowed network connections under a Zero Trust design would employ a deny-by-default security policy, so any attempt to connect to other remote addresses for command and control would likely be blocked,” the NSA said. “Also, network monitoring could detect and block attempted lateral movement from the device or an application not associated with an authorized access request.”
The NSA warned that implementing Zero Trust is not something that can happen overnight and that it would require full buy-in from across the organization.
“Access control decisions that may have only occurred once for each access previously will now be performed continuously as access to the resource is used, requiring a robust infrastructure for making, enforcing, and then logging these access decisions,” the guide says. “Administrators and defenders may become fatigued with constantly applying default-deny security policies and always assuming a breach is occurring.”
But the NSA said systems using Zero Trust principles should be better positioned to handle more sophisticated threats and that it will continue monitoring the technologies that contribute to the concept.