A CONTEXT-AWARE APPROACH TO ORGANIZING NETWORK SECURITY POLICIES IN A ZERO TRUST ARCHITECTURE

Abstract

The relevance of introducing new approaches and practices for organizing and controlling access in network infrastructures is justified by the widening gap between the requirements of modern security standards and the capabilities of network security tools that operate at Layers 3–4 of the OSI model. The paper analyzes security models recommended by contemporary standards and industry best practices for information infrastructures, and explores ways to implement them using available market tools and network access control measures. The methodological basis of the proposed approach combines the Zero Trust principles outlined in NIST SP 800-207, capabilities found in the portfolios of next-generation firewall vendors, and the author’s methodologies and practices for integrating heterogeneous security systems to enrich firewall security policies with network-access context. The approach enables adherence to Zero Trust principles while maintaining operational quality and high performance of the network infrastructure, without exceeding acceptable total cost of operation and ownership of infrastructure resources. Key components and design patterns of the security infrastructure necessary to achieve these goals are identified. The scientific novelty of the approach lies in a paradigm shift in network access control—from a model centered on a corporate node’s address to a model centered on user access control coupled with verification of the security posture of the requesting device. The paper proposes contextual attributes for security policies and optimal methods for structuring host access levels within firewall configurations. The practice of collecting and enriching policy enforcement points with network context provides the flexibility and technical means required to uphold Zero Trust principles when building a corporate security model. The drawbacks of the method include operational complexity, increased cost, and dependencies on other systems that may affect network performance and expand the compromise surface of the security stack itself.