by: VMware Head of Security Engineering and Architecture Brad Doctor and VMware Senior Security Architect Craig Savage
The concept of Zero Trust architecture has taken the enterprise world by storm, replacing the traditional perimeter defense approach to security. The Zero Trust model is also an excellent response to the proliferation of colleagues, devices, and cloud-based assets distributed beyond the enterprise-owned network boundary.
The Security and Resiliency teams at VMware were challenged to take security of our existing global corporate network to the next level, and that meant iterating toward Zero Trust. The term Zero Trust has many meanings in the IT industry. The National Institute of Standards and Technology (NIST) published SP800-207, Zero Trust Architecture, which lays out in a meaningful way how Zero Trust architecture is defined. The work we have been doing within VMware is very closely aligned to this architectural framework.
Based on the model of never automatically trusting anything inside or outside a company’s ecosystem, Zero Trust is one of the best ways to combat threats from any source. Zero Trust requires the authentication and authorization of colleagues, devices and assets before a session to an enterprise resource is established.
In this blog, we will share our progress with adopting Zero Trust and the first two steps we took in this journey that include building a better colleague experience throughout the process. Part two of the blog will cover steps three through seven.
- Securing Core Network Services (CNS)
VMware IT hardened, and micro-segmented, core and ancillary services required for network operation. They used VMware NSX® to micro-segment applications. VMware IT micro-segmented over 75 existing applications and requires that new apps must be micro-segmented. NSX also provides legacy environment support.
Securing Core Network Services controls bi-directional flow of data, blocks lateral movement of malware, and limits access to services. All logging goes via aggregators and back to our central security information and event management (SIEM) solution. Splitting the end-user accessible network from the Core Network is a key tenet of this new way of working and allows for much tighter control.
Next there are cloud connections for securing cloud services. VMware IT collaborated with R&D to build its own Cloud Connect-as-a-Service (CCaaS), enabling self-service for R&D by providing a managed connection to cloud services. CCaaS controls bi-directional flow, requires secure authentication, and blocks external egress from cloud platforms to prevent Intellectual Property leakage. CloudHealth® SecureState™ provides code validation and management insight. - Controlling all manageable endpoints with VMware Workspace ONE
The colleague experience is key when it comes to securing managed and unmanaged endpoints. For VMware IT the end-goal is to deliver such a delightful experience that colleagues naturally embrace the Zero Trust way.
Endpoints are where Zero Trust architecture really starts. VMware IT uses Workspace ONE® to manage its entire fleet of managed devices from a single console. Devices not managed by VMware IT must use Multi-Factor Authentication (MFA) when accessing services and applications, and never directly access core services.
Password reliance must be decreased. At VMware, sole use of a password is never an acceptable authentication method and must be combined with other authentication methods that are more secure and easier to use.
Executing on the fully managed experience includes applying the full security stack, delivering managed, pre-configured apps, and using certificates with modern push authentication. We leverage the certificate to seamlessly authenticate. The moment it’s revoked, off-boarding is instantaneous.
The unmanaged experience allows a level of access through network abstraction and Multi-Factor Authentication to deliver a functional experience. Colleagues can access what they need to do their work; however, it’s not as seamless and easy as the fully managed experience. The most common example of when unmanaged devices need to be authenticated for network access is for personally owned devices or devices that run with the Linux OS.
Standardizing the experience across managed and unmanaged endpoints is VMware’s vision of colleagues securely accessing any application, on any cloud from anywhere.
When implementing Zero Trust, VMware IT focused on making the experience a positive one for colleagues. This approach helped drive adoption and contributed to a more secure community that focuses on the work they are doing for the company.
For more details, visit the VMworld 2020 site to watch an on-demand video recording of our presentation on this topic. The title is Trusting Zero Trust: How VMware IT Reimagined Security and Resiliency, ISNS1059.
VMware on VMware blogs are written by IT subject matter experts sharing stories about our digital transformation using VMware products and services in a global production environment. Contact your sales rep or [email protected] to schedule a briefing on this topic. Visit the VMware on VMware microsite and follow us on Twitter.
