What is Zero Trust Cloud Access?

Cloud platforms such as Microsoft 365 have transformed the way businesses work. Your business can access files, emails, systems, and applications from the office, at home, on the move, simply and easily from both personal or company devices.  

The flexibility that cloud platforms have presented to businesses has created huge opportunities to allow teams to work from wherever they are able, increase hybrid working environments, empower remote workers to work as they would in the office, and far more. 

However, the rise in the usage of cloud platforms, and their ability to be used from anywhere across any device has also presented its own cyber security challenges. 

Traditional security solutions were built around the idea that if somebody was inside your business network, they could be trusted. But as the tools that people use, and the environment in which they use them have changed, that approach is no longer enough. 

To adapt to these changes, businesses need more control over who can access what, where, when and from which devices, not just across cloud systems but all systems throughout your business. By doing so, businesses can assess whether that access should be trusted at all. 

This is where Zero Trust Cloud Access comes in. 

 

What is Zero Trust Cloud Access? 

Much like other policies of Zero Trust, Zero Trust Cloud Access operates on a “never trust, always verify” approach. Zero Trust Cloud Access controls access to your business cloud applications (and cloud data) based on strict user, device and connectivity verification. Instead of automatically trusting a user because they have the correct login credentials, multi-factor authentication, or are connecting from a familiar location, access is assessed against a strict set of rules. 

Much like other Identity Access Management solutions, those rules can look at who the user is, what device they are using, where they are connecting from, and whether that device meets your security standards (such as operating system and security patch versions). Unlike other Identity Access Management solutions, Zero Trust Cloud Access authorises the user and their device, but also routes traffic through a trusted cloud broker. Meaning that even if someone was to gain access to a user’s Login Credentials (Username/Email & Password), bypass or gain their multi-factor authentication, or complete session tokens, they still would not be able to access your cloud data or services as their device is not authorised and the connection is not authorised via the trusted cloud broker. 

This gives businesses far more control and security over access to cloud platforms such as Microsoft 365, business applications, file storage, and many other online services. 

 

What is a Trusted Cloud Broker? 

A trusted cloud broker acts as a secure gateway between a user device and the cloud service that your user is connecting to. 

Think of it this way, rather than a car being able to drive directly into a business car park, instead it has to drive along a gated road owned by the business, with secure entry points and a security check point along the way. Without being able to access the road, and having the right security credentials, you can not get through. 

This means that the broker can verify the user, the device and the connection all meet the rules that your business has set before a user can gain access to the cloud services, and that all connectivity will run through the broker’s “road” and “security check point”. 

If a device is not authorised, the connection to the brokers “road” is not authorised, blocking “unauthorised vehicles” from accessing your business. 

Make sense? 

Essentially, it adds an additional layer of protection by only authorising known users and devices that meet strict security controls. By doing so, it prevents access to anything that does not meet these controls. 

 

Why do cloud access controls matter? 

The past decade has seen a drastic shift in business migrating from “local” or “on-premise” tools to cloud based tools and storage. However, access to those platforms is often still protected by traditional methods that lack visibility and security controls to access them. 

The problem is that these traditional tools do not always provide enough visibility or control once a user (or their device) is connected. Even with many Identity and Access Management controls in place, if a user account is compromised, or if somebody signs in from an unmanaged or insecure device, your business and your cloud services/data could still be exposed. 

Zero Trust Cloud Access helps reduce that risk by limiting and controlling access based on context, not assumption. Rather than simply allowing or blocking a connection, Zero Trust Cloud Access applies controls based on the level of risk involved and parameters set out by a business to ensure that only trusted users, trusted devices and trusted connections can access cloud storage and services by routing those connections to your cloud tools through trusted brokers that verify connectivity controls. 

 

How is Zero Trust Cloud Access different from traditional security controls? 

In the vast majority of cases, traditional access tools focus on the connection itself. 

Traditional Example 

Traditionally, a VPN (Virtual Private Network) creates a secure path into your business network, once connected a firewall can control traffic of data that is routed through that network. However, a firewall does not always understand whether a user should be accessing a particular cloud application or service in that moment, or even if a user should be able to access other data that they could be connecting to, instead routing all traffic through its standard rule set. 

Zero Trust Cloud Access 

Zero Trust Cloud Access takes a more modern approach to connectivity security. 

Instead of trusting the network, it focuses on the user, the device, and the cloud service that they are connecting to.  

Think of it this way; 

A user device has a number of different applications for different services they may use on a daily basis for both work and pleasure. 

When connecting to services such as Facebook, Instagram, Amazon, BBC News and others, they do not need to be authorised by your business identity access policies, as such all of that traffic is routed directly to the internet. 

However, business cloud services such as Microsoft 365 are configured to only allow connections if the device is trusted and authorised, and only if the user device is connected for traffic to route Microsoft 365 traffic through the trusted cloud broker. 

This makes it particularly effective for reducing unnecessary access, especially from personal devices, and protecting sensitive data in cloud platforms. 

 

Why is Zero Trust Cloud Access better for modern businesses? 

One of the biggest benefits of Zero Trust Cloud Access is a stronger control over cloud application access and business data. Businesses can decide exactly who should be able to access each platform, under what conditions, what actions they are allowed to take and over only trusted connections to those services. 

That is especially important if account credentials are compromised. By limiting access to cloud services to only trusted devices and accounts over trusted connections, it means that even if attackers steal credentials or clone an active session token, they cannot access your services. 

This supports and secures hybrid working much more effectively. Staff can work securely from different locations without the business having to worry about trusted networks or trusted connectivity. Businesses also gain a clearer picture of who is accessing cloud services, from where, on what device, and whether that activity should be considered normal or risky. 

The added benefit for businesses is that this also supports compliance with standards such as Cyber Essentials, Cyber Essentials Plus, and even ISO/IEC 27001 for Data Security as part of your business Information Security Management System (ISMS). 

 

How can TwentyFour IT Services secure your cloud environments? 

At TwentyFour IT Services, we work with businesses to provide a holistic and modern approach to their cyber security that is compliant with UK recognised standards for cyber and data protection. This means looking beyond traditional access methods and helping businesses to build stronger control around the platforms and tools that they rely on every day. 

Zero Trust Cloud Access forms an essential part of that strategy. It helps businesses reduce the risk of their cloud services and better protects users, systems, and data across an increasingly cloud-first environment. 

If your business relies on cloud applications such as Microsoft 365, Google Workspace, Salesforce, Hubspot and many other cloud services, now is the right time to review whether traditional access controls are still enough. 

Book in a free cyber security review with us to see if you are prepared to defend from modern cyber security threats. 

Enquire Here