High-Level Zero Trust Best Practice Concepts (2024)

Apply consistent security everywhere, across all usecases, users, applications, and infrastructure. Consistent securitypolicy ensures that the same people have the same access to applicationsand services in every location, with the same level of authenticationand authorization, the same traffic inspection, and the same accessprivileges.

Decrypt traffic to gain visibility into it so that you caninspect it and prevent malicious activity and data exfiltration.

Continuously validate users, applications, and infrastructure.

Do not allow unknown traffic in your network.

Use Palo Alto Networks Next-Generation Firewalls (NGFWs),including VM-Series and CN-Series firewalls, as segmentation gateways.This consolidates security technologies on one platform and enables youto apply consistent security policy in all locations natively atLayer 7, based on users, devices, IP addresses, zones, URLs, services,and applications (including individual applications in application containers—forexample, not just the gmail application, but also granular applicationssuch as gmail-drive, gmail-chat, gmail-posting, gmail-uploading,etc.). The segmentation gateway segments and controls the network,provides granular access control, and secures all traffic as itcrosses microperimeters and attempts to access to an attack surface.Segment your network based on what’s valuable to your business toprevent unauthorized lateral movement.

You don’t needto change your infrastructure to create microperimeters becauseyou create microperimeters in Layer 7 security policy by allowingonly authorized users to access only the resources they need toaccess for business purposes.

Apply the principle of least privilege access to all access—notonly to access for people, but also to access for services and APIs.Allow only the exact level of access required for each user, service,and API.

Use an integrated, centrally managed platform that reduces the total cost of ownership, rather than a collection of point products that don’t work well together. Palo Alto Networks shares information among platform elements and enables centralized management and simplified operation using Panorama, GlobalProtect, and

Prisma Access

to provide consistent policy, prevention, and protection across all use cases.

Protect all endpoints, including unmanaged IoT endpoints.

Log every packet through Layer 7 that regulations, compliance,and your business practices allow you to inspect.

Create a strategy for tagging workloads to group objects and registering tags dynamically to help automate security policy.

See Also

Introducing Complete Zero Trust Network Security

Document processes, educate and train personnel, set baselines,and measure progress against the baselines.

Update your Zero Trust deployment as your business changes.For example, new applications may replace older applications, youmay upgrade your infrastructure, employees and contractors joinand leave the business, and the business itself may change overtime.

Define your desired business outcomes before architectingyour Zero Trust environment. The Zero Trust model supports and enablessecure business functions.

Design from the inside-out instead of from the outside-into protect what’s most valuable to your business first. Your mostvaluable assets are more likely to be in your data center than atyour perimeter.

Transition to a Zero Trust environment beginning with themost critical segments (propriety source code repositories, customerdata, etc.—whatever is most valuable to your business). Zero Trust segmentscoexist with legacy segments, so you can protect your most criticalassets first and then go on to protecting less critical segmentsand assets instead transitioning everything at one time.

{{ } else { }}