Zero Trust · Public and private-sector IT
We move internal network security off the perimeter and onto a Zero Trust model that continuously verifies users, devices and access context and minimises access between systems, so a breach is contained early before it spreads.
Our assessment tool, built on the CISA Zero Trust Maturity Model (ZTMM), evaluates 45 items across six pillars. Maturity is rated in four stages for each area.
1Identity
2Device
3Application
4Network & Infrastructure
5Data
6Telemetry & Analytics, Automation & Orchestration
Core premise
Establish centralised privilege management through IAM, SSO and PAM
In addition
Introduce and embed specialised solutions, such as Micro Segmentation, that segment systems, workloads and processes
This case combined Micro Segmentation with an existing IAM, SSO and PAM-based centralised privilege management framework, extending user authentication and privilege control into control of the communication between live systems, workloads and processes.
01Visibility into internal traffic
Agents on servers, cloud workloads and user devices collect the actual traffic flows and identify server-to-server connections, application- and process-level communication, and unregistered assets
Considerations
Put enough effort into traffic-flow analysis to reduce the risk of business disruption when blocking policies are first applied
02Business-based logical grouping
Attributes such as department, business function, application, OS, server role and criticality are defined as labels, sorting a complex IP and network structure into logical groups that carry business meaning
Considerations
When attaching labels, cross-check them against business and asset-management records to confirm consistency
03Linking central privilege data to communication policy
Existing user, login ID, role and privilege data are used to build ACLs of the URLs, IPs and target systems each user may reach, so central privilege management is reflected in Micro Segmentation policy in real time
Considerations
Keep the link managed so that joiners, movers, leavers and role changes reach IAM privileges and ACLs quickly
04Least-privilege control per workload and process
Only the communication needed between servers, applications, workloads and processes is allowed; administrator access is narrowed to designated devices, access paths, target servers, ports and processes, blocking outside intruders, unauthorised internal access and lateral movement to adjacent systems
Considerations
Manage critical business and administrator access through controlled policies covering approval, exceptions and expiry dates
05Phased policy rollout and maturing operations
Labels, policy templates and automatic policy recommendations ease operational complexity and lay the groundwork for AI-based policy management and automated detection and response later
Considerations
Collect policy-violation, lateral-movement and unauthorised-access events in the SIEM, and link repeat responses to SOAR playbooks
Outcomes
01Use and connect existing controls
Success factor
Existing IAM, SSO and PAM data served as the common policy basis and was extended to workload access control
Implication
When introducing Micro Segmentation, aim for a Zero Trust design: an integrated policy structure that shares existing Identity and Risk data
02Internal visibility first
Success factor
Actual traffic and application dependencies were mapped first, and simulation before enforcement confirmed business impact and exception traffic
Implication
Avoid a company-wide rollout in one go; define protected zones starting with the business functions a breach would hurt most, and expand in stages
03Policy managed around meaningful business context
Success factor
Static ACLs built on IPs and ports were shifted to ones built on business functions, applications, roles and processes
Implication
Business, security and infrastructure teams settle labelling and allowed-traffic policy together, and agree expiry and re-approval rules for exceptions
04Link policy decision to enforcement
Success factor
IAM and PAM decide who holds which privileges; the solution connects how far those privileges reach across workloads and processes
Implication
Connect communication-policy violations to detection and response (violation events consolidated in the SIEM; high-risk scenarios automatically isolated, blocked and investigated in SOAR)
05Make containing breach spread the first goal
Success factor
Rather than complete prevention, the focus was on controlling spread to adjacent systems after a breach, keeping critical-business protected zones intact even under threat
Implication
Measure the effect by risk reduction (e.g. the rate at which unnecessary communication paths are removed), not by the number of policies written
We move internal network security off the perimeter and onto a model that continuously verifies users, devices and access context and minimises access between systems.
End-Point
PDP Policy decision
Identity-based risk assessment
PEP Policy enforcement
Resource
The projects below were carried out by Gwangmyung Maritime members at their previous organisations. They are not engagements of Gwangmyung Maritime as a company; we list them to show the range of our members’ experience.
Next-generation information security architecture for a leading regional bank in the Yeongnam and Honam regions
Zero Trust implementation plan proposed
Information security advancement strategy plan for a mid-to-large public financial institution in Seoul
Zero Trust implementation plan proposed
We design it with you, from assessing where you stand today to the target architecture and a phased transition plan.