The network as a master key
The classic remote access model is simple: whoever connects to the virtual private network (VPN) enters the network, and from there can reach almost everything inside. It worked when all the systems were in one office. With systems spread between your own infrastructure and several clouds, it becomes a problem: to give access to one server you have to open an entire network, and a stolen credential opens everything.
Per-application access
The alternative, known as zero trust access, changes the question. Instead of 'is it inside the network?', each connection answers:
- Who is it? Corporate identity with a second factor, the same as always (one identity for every cloud).
- From which device? A managed, updated and encrypted machine.
- Which specific system does it want to reach, and is it entitled to? According to its role and the policy.
If it all adds up, a connection is opened only to that system, encrypted, and it is logged. The user never 'enters the network'; the network is never exposed to the internet.
What you gain
- A stolen credential does not open everything: at most it opens what that person was permitted, and from a device that is also checked.
- There are no administration ports open to the internet: the connection goes out from inside to the broker, not the other way round.
- Every access is logged, with who, from where, to what and when.
- It works the same for your own infrastructure and for each cloud, which is exactly the hybrid case.
A transition, not a big bang
You start with the most sensitive access (production administration, systems holding confidential data) and with third parties (suppliers who need to reach one specific thing). The traditional private network shrinks gradually until it is left, if at all, for very narrow cases.
Protecting well does not stop things happening. The last part of the series is about what happens then, starting with what has to be logged.
How we apply it: Cybersecurity.