Legacy Networks: What Was There Before Zero Trust

Designed from the outside in, 20th-century hierarchical networks have traditionally relied on classifying users as “trusted” and “untrusted.” Unfortunately, this methodology has proven to be unsecure. With increased attack sophistication and insider threats, operating on the assumption that everything inside an organization’s network can be trusted is no longer viable.

Enter Zero Trust. Rooted in the principle of “never trust, always verify,” a Zero Trust network offers a different approach to security. By taking advantage of micro-segmentation and granular perimeters of enforcement around your most critical data, Zero Trust combats the exfiltration of sensitive data and prevents threats from moving laterally within a network.

Unfortunately, the design paradigms of legacy security models leave companies reluctant to adopt Zero Trust as it’s thought to be difficult, costly and disruptive. In fact, it’s much simpler to deploy than its legacy counterparts. To shift how we think about security design and eradicate some of the stigmas around deploying Zero Trust, it’s important to understand security as it predates the introduction of Zero Trust.

We started our network designs on the outermost edge, the CPE – customer premise equipment – where the carrier handed off the network circuit to our data center. We then figured out what card needed to go into the router. At the time, there were multiple types of networks we needed to interconnect with. Once the router was installed, we focused on building an infrastructure. We installed the core switch, the distribution switches and a ton of access-layer switches. We configured all those switches, worrying incessantly about things like spanning tree, until we had a functioning network. At that point, our work was done and network users were invited to connect to the network wherever they wanted.

Eventually, threats such as worms and viruses arose, and it became clear that network security was necessary. Out of necessity, we installed Layer 3 stateful packet filtering firewalls to provide basic ingress filtering while being careful not to configure it granularly so we didn’t block “good” traffic. The overarching concern was that too much security would degrade network performance, which was perceived as a higher priority than security. Even today, organizations struggle to find a balance between efficiency and security.

This legacy model assumes that a user’s identity has not been compromised and that all users act responsibly. If a user is “trusted,” that user has access to applications and data by default. History has shown us that trust is a vulnerability that can be exploited.

Zero Trust inverts this legacy model. Network are designed from the inside out instead of the outside in, starting with the data or assets that need to be protected and designed around those elements. Zero Trust eliminates the trust model from the network and provides advanced, granular protection against data breaches and adverse network events. To properly design a Zero Trust network, designers and architects must learn to think inside out.

Read “Simplify Zero Trust Implementation Using a Five-Step Methodology" to gain an in-depth understanding of how to simplify deployment of your Zero Trust network.