Thanks, NSA!

Ransomware gangs saw a record year last year, extorting a mind-numbing $1.1 billion in payments from victims, according to findings from Chainanalysis. As concerning as it is, the success of today’s ransomware attackers is no surprise. The attack surface continues to expand and widen at an alarming rate, fueled by hyperconnectivity and IT complexity, and organizations across industries – but especially those in critical sectors like healthcare – are regularly finding themselves caught flat-footed when ransomware attacks do occur.  

Visibility, containment and operational consistency are a few of the core tenets I’ve long believed are necessary for achieving a robust and lasting Zero Trust architectures.

To that end, I’m incredibly excited that the National Security Agency has released a new Cybersecurity Information Sheet, “Advancing Zero Trust Maturity Throughout the Network and Environment Pillar,” – which highlights and reaffirms an important but often overlooked component of Zero Trust: segmentation.

The NSA is setting a new Zero Trust benchmark for the industry

As the original creator of Zero Trust and the Chief Evangelist at Illumio, a company specializing in containment and the prevention of lateral movement across networks and hybrid IT environments via Zero Trust Segmentation, this document is particularly exciting for several reasons.

First, this document reaffirms the value of network security technologies in establishing any Zero Trust environment. Over the past few years, there has been a pronounced emphasis on the Identity Pillar of Zero Trust. Although it’s an integral pillar, the apparent focus on identity has led to very few organizations understanding the importance of network security controls in building Zero Trust environments, both on-premise and in various clouds.

In fact, in the second Zero Trust report ever written, “Build Security into your Network’s DNA” back in November of 2010, I wrote this: “…new ways of segmenting networks must be created because all future networks need to be segmented by default.”

That said, I've long believed that segmentation is how we create Protect Surfaces – the fundamental concept of Zero Trust. Identity is telemetry we consume in creating access policy to the Protect Surface. It's gratifying to see segmentation finally getting the attention it deserves. In fact, Gartner predicts less than 5% of enterprises have segmentation today, which will be up to 60% in the next 3 years.

As the attack surface widens and expands, and the digital landscape becomes increasingly interconnected, the segmentation of the network and hybrid environments becomes paramount for organizations to build resilience and establish a true and lasting Zero Trust architecture.

The power of data-flow mapping

One of the other things I'd like to give kudos to the NSA for is their call out of “Data Flow Mapping” in this Information Sheet. I’ve been advocating for flow mapping since the early days of Zero Trust, when I learned that we must first understand how a system works together to build out successfully and architect Zero Trust environments.

Back in 2022, I was honored to be appointed to serve on President Biden’s National Security Telecommunications Advisory Committee subcommittee, where I was a part of authoring and delivering a report on Zero Trust to the President. This report documents the 5-Step Model I have been promoting for several years, with Step 2 focused entirely on Transaction Flow Mapping.

When you understand how flows work, you can build a Zero Trust environment more easily.

Segmentation is needed now more than ever

In short, I’m a firm believer that this NSA guidance will greatly help various organizations worldwide more easily understand the value of the network pillar of Zero Trust.

Practitioners usually start with the identity pillar of Zero Trust and they never make it to the Network Pillar. But it’s an integral part of Zero Trust! Securing the network is Zero Trust!

For organizations grappling with ransomware, Zero Trust Segmentation is a powerful tool for stopping ransomware attacks from being successful and bringing essential services to a halt. Like this latest attack causing widespread outages in healthcare, today’s reality is that ransomware has the potential to uproot our everyday lives.

As more of the world gets connected and the attack surface expands, it becomes even more essential for organizations to define, map and secure the most important Protect Surfaces in their Zero Trust environments accordingly.

Again, kudos to the NSA. This document is an important industry validator of the power and purpose of segmentation, and a highly visible NorthStar as more organizations look to shore up their cyber resilience in the face of rising attacks.