How a Zero-Trust Cybersecurity Approach Can Protect Your Data and Ensure Data Recovery

Gartner defines zero-trust network access as a product or service that creates an identity- and context-based, logical access boundary around an application or set of applications. TechTarget puts it more simply, stating that the zero-trust cybersecurity model assumes that no users that are allowed onto your network should be trusted by default because they could be compromised.

A zero-trust approach requires identity and device authentication throughout your network—not just at the perimeter. Think of zero trust as locked doors at every access point, demanding the right key and authorization for anyone to gain entry.

That’s incredibly important, considering that 85 percent of all breaches involve the human element. All it takes is one person in your organization clicking on a malicious link or downloading an infected PDF to immediately put your network and your data at risk from malware and ransomware. With social engineering schemes becoming ever more sophisticated, a recent TechTarget article says some attacks are so well crafted that they even fool security researchers.

Zero Trust: Bolstering Your Frontline Defenses

As part of its efforts to fortify the United States against cyberattacks, the National Security Agency (NSA) recommends that organizations embrace a zero-trust security model. The NSA defines the model as “a coordinated cybersecurity and system management strategy based on an acknowledgment that threats exist both inside and outside traditional network boundaries.”

When you move to a zero-trust model, you continuously limit access by anyone to only what is needed. And zero trust includes monitoring for unusual or malicious activities, granular risk-based access controls (RBAC), and automated, coordinated system security throughout your infrastructure. You should also put an added focus on protecting critical data in real-time.

Going back to the human element, a successful zero-trust security model requires that everyone within your organization, from the top down, understands and commits to zero-trust principles.

Foundational Concepts of Zero Trust

The NSA has published high-level guidelines that should serve as the basis for your decisions as you move to a zero-trust model, including:

• Never trust; always verify
• All users, devices, apps, workloads, and data are treated as untrusted. Authenticate and explicitly authorize each to the least privilege required using dynamic security policies.
• Assume a breach has occurred
• IT teams need to start with the assumption that they have already been breached and operate and defend accordingly. Every attempt at access by every user, data flow, device, and request should be denied by default. All configuration changes, resource accesses, and network traffic should be monitored, logged, and inspected for malicious activity.
• Verify everyone
• Use a consistent, secure approach with multiple dynamic and static attributes to increase confidence that access to resources is limited based on contextual factors.

Building a Zero-Trust Solution

The NSA also shares some core concepts that should form the basis of your zero-trust strategy, including:

• Set clear objectives: Your zero-trust architecture needs to meet your organization’s specific requirements, including identifying your critical data, assets, applications, and services.
• Start inside: Your first step is to protect the components of your architecture listed above. Your next step is to secure all access to these components.
• Decide privileges: Create security policies and apply them consistently across your environments—local area networks (LANs), wide-area networks (WANs), endpoints, perimeters, users, and devices.
• Gain visibility: Put a solution in place that gives you complete visibility into all activity throughout your network architecture to enable analytics that detect suspicious activity and let you inspect and log all activity before taking action.

Zero Trust Includes Your Backup Solution

With hackers targeting backups with much greater frequency so they can prevent your organization from recovering from an attack, protecting your backups is more critical than ever. We designed Arcserve UDP to support zero-trust security strategies and minimize exposure of essential data backups to external threats.

Arcserve UDP and Zero Trust

Arcserve UDP prevents unwanted access by including extended default configuration and customizable configuration. The solution’s features also ensure that only authorized users can access your data backups and your data protection infrastructure. Arcserve UDP can enable access to local users or can be integrated with your organization’s Active Directory deployment to simplify user management.

UDP also leverages zero-trust principles throughout the platform to protect your backups, including:

• Only admins can use Arcserve UDP Agents and the recovery point server (RPS) by default, with strict authentication required for every access.
• Advanced RBAC functionality lets you assign one of the pre-defined admin, backup, restore, or monitor roles to users. Or you can choose to define a new role with a set of permissions that controls access to more than three dozen individual features. 
• In Linux environments, Arcserve UDP components can operate under non-root user IDs and use the SuperUser DO (Sudo) command when administrative privileges are required.

Beyond Zero Trust: Isolating Your Backup Infrastructure

Arcserve UDP is, for the most part, self-sufficient, designed to operate in isolated environments. This approach adds further support to your zero-trust strategy by monitoring and minimizing access to your backup data so you can recover in the event of a disaster, including:

• Exceptionally few primarily non-standard TCP ports must be open for secure communication between Arcserve UDP’s components, and all other operations are performed locally on the protected systems and RPS.
• A web-based interface operates over HTTPS and doesn’t require opening potentially unsecured ports such as remote desktop protocol (RDP).
• The only automated external internet queries are periodic checks for updates. If the environment is secure and completely isolated, the check can be disabled to prevent outbound connection attempt alerts from firewall solutions.
• Arcserve recommends that Arcserve UDP servers should not be integrated with larger Active Directories to minimize the potential attack surface of the data protection infrastructure.

Arcserve also recommends limiting direct connections between networks to required ports when backups are replicated to remote sites or the cloud—TCP/8014 to replicate data and TCP/8015 for centralized management. This minimizes exposure of secondary backup copies of your data if your primary site is attacked by hackers or locked up by ransomware.

Monitoring for Maximum Security

With advanced monitoring functionality, Arcserve UDP lets your backup admins react quickly to investigate any aspect of backup infrastructure operations—including security—by offering:

• Ad-hoc, as needed and emailed, scheduled reports regarding your Arcserve UDP deployment.
• Automated email alerts for most backup operations so you can quickly address any issues.

• Comprehensive job logs that include all necessary information required to investigate backup and infrastructure anomalies. Arcserve UDP also alerts backup admins when an issue arises without logging in to the management console.

Make the Move to Zero Trust

Arcserve is a strong supporter of the zero-trust model. To find out how you can put a zero-trust strategy in place, choose one of our expert technology partners or contact us for more product details.