NIST SP 800-215 日本語訳

NIST Special Publication

Ramaswamy Chandramouli

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-215

NIST Special Publication

Ramaswamy Chandramouli Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-215

November 2022

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology (NIST), nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Copyright, Fair Use, and Licensing Statements

NIST Technical Series Publication Identifier Syntax

Approved by the NIST Editorial Review Board on 2022-11-10

Chandramouli R (2022) Guide to a Secure Enterprise Network Landscape. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-215. https://doi.org/10.6028/NIST.SP.800-215

Ramaswamy Chandramouli: 0000-0002-7387-5858

sp800-215-comments@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA).

Access to multiple cloud services, the geographic spread of enterprise Information Technology (IT) resources (including multiple data centers), and the emergence of microservices-based applications (as opposed to monolithic ones) have significantly altered the enterprise network landscape. This document is meant to provide guidance to this new enterprise network landscape from a secure operations perspective. Hence, it starts by examining the security limitations of current network access solutions to the enterprise network. It then considers security feature enhancements to traditional network appliances in the form of point security solutions, network configurations for various security functions (e.g., application/services security, cloud services access security, device or endpoint security), security frameworks that integrate these individual network configurations (e.g., zero trust network access [ZTNA]), and the evolving wide area network (WAN) infrastructure to provide a comprehensive set of security services for the modern enterprise network landscape (e.g., secure access service edge [SASE]).

cloud access security broker (CASB); firewall; microsegmentation; secure access service edge (SASE); secure web gateway (SWG); security orchestration, automation, and response (SOAR); software-defined perimeter (SDP); software-defined wide area network (SD-WAN); virtual private network (VPN); zero trust network access (ZTNA).

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL.

No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

The author would like to express his thanks to Isabel Van Wyk of NIST for her detailed editorial review both for the public comment version as well as for the final publication.

The enterprise network landscape has undergone tremendous changes in the last decade due to the following three drivers:

The impacts of these drivers on the security of the enterprise network landscape include:

This document is meant to provide guidance to this new enterprise network landscape from a secure operations perspective. The adopted methodology first considers the security challenges that the new network landscape poses and examines the limitations of current network access technologies. It then shows how solutions for meeting the challenges have evolved from being security function-specific to a security framework to a comprehensive security infrastructure that provides a holistic set of security services. Specific areas addressed include:

Based on the drivers outlined above, an enterprise network in the context of this document encompasses the following:

The enterprise network landscape has undergone a significant transformation in the last decade. The drivers for this transformation are (a) enterprise access to multiple cloud services, (b) the geographic spread of enterprise-owned (on-premises) IT resources (e.g., in headquarters, multiple branch offices, and data centers), and (c) changes to application architecture from being monolithic to a set of loosely coupled microservices – often with a dedicated infrastructure (called the service mesh) that provides all application services, including security. The high-level impacts of these drivers on the security of the current enterprise network landscape are (a) the disappearance of the concept of a perimeter associated with the enterprise network; (b) an increase in attack surface due to the sheer multiplicity of IT resource components associated with computing, storage, and network appliances; and (c) the escalation of attacks across several network boundaries leveraging connectivity features. Before providing guidance for secure operations in this new network landscape, this document will consider the structural and security implications of the drivers to enhance understanding of its components and data flows.

In order to have a good structural view of the current enterprise network landscape, it is necessary to look at the current enterprise IT environment in general. The IT environment now consists of:

The above scenarios call for widespread connectivity between IT systems that now defines the current enterprise network landscape. Connectivity, in turn, involves:

Now consider the immediate security implications of these drivers on the enterprise network landscape. Subscription to multiple cloud services: Accessing cloud services from multiple cloud providers has become the norm for many enterprises. This trend is motivated not only by the need to avoid a cloud-vendor locked-in situation but also by different CSPs offering different value-added functions for different services (e.g., IaaS, SaaS). The consequence of this trend is that – from an enterprise point of view – the following networks have become extensions of the enterprise network and, thus, come under the scope of enterprise network management with attendant responsibilities for ensuring that security protections become a critical function.

Geographic spread of IT resources and users: IT resources are now widely distributed not only due to the geographic spread of enterprise premises (e.g., headquarters and branch offices) but also for reliability and disaster recovery (DR) considerations. Additionally, the applications hosted in those resources are now accessed by users from various enterprise premises (through the enterprise network) as well as from home and public locations (e.g., hotels and cafes) through multiple devices, such as desktops, laptops, and mobile phones. Ensuring secure access from these varied locations and devices becomes the responsibility of the enterprise. Changes in application architecture: Application architectures – especially those of cloud-native applications – have changed from being monolithic to being microservices-based in order to meet the deployment agility and modular scalability requirements. This, combined with DevSecOps (a paradigm covering Development, Security and Operations) primitives such as continuous integration/continuous deployment (CI/CD) pipelines for the development and deployment of software, has improved the security profile of the applications but has also introduced new threat vectors related to the CI/CD workflows themselves.

Based on the security implications discussed in the previous subsection, there is a new security scenario in the current enterprise network landscape that needs to be addressed through security guidance. Some of the salient aspects of this scenario are:

The scope of this document includes:

This guidance is intended for network design architects and network security solution architects in organizations with a hybrid IT environment (consisting of both on-premises and cloud-based applications) with a combination of legacy and microservices-based (i.e., cloud-native) applications.

The organization of this document is as follows:

Section 1 outlined the structural and security implications of the drivers for the current enterprise network landscape, which have impacted the mechanics of secure access to applications through the network. This section analyzes the security limitations of traditional network access approaches.

Early solutions for secure enterprise network access were geared toward environments with well-defined network perimeters. All enterprise IT resources were endpoints of enterprise LANs (usually defined as a floor in a large enterprise, building, or small campus), and multiple LANs connected together inside a defined building or campus constituted the internal corporate network. Entry points into this corporate network were protected using devices called firewalls. In this environment, all devices and users within firewalled LANs were totally trusted and, hence, considered safe for accessing application resources. However, the following factors have annulled the concept of that perimeter and greatly expanded the attack surface:

The increase in teleworking employees due to the pandemic has necessitated a means for secure access to IT resources inside an enterprise network in the form of VPNs. A VPN allows organizations to extend perimeter-based security across a public network. Security is enabled by setting up a secure tunnel in the public network using protocols such as Internet Protocol Security (IPSEC) and Transport Layer Security (TLS). However, there are some limitations and security risks associated with VPNs.

Multi-protocol label switching (MPLS) technology is used for enterprise WANs, but the wide geographic span of an enterprise network with multiple data centers and cloud services has imposed some limitations on its use (in addition to cost).

In the current network landscape, which consists of access to on-premises and cloud-based applications, there exist authentication infrastructures (both enterprise and cloud-based) to authenticate end users using various token-based approaches (e.g., Jason Web Tokens [JWT] or Security Assertion Markup Language (SAML) 2.0 tokens). This infrastructure by itself is not sufficient to meet the authentication needs of the environment that contains microservices-based applications, which are becoming ubiquitous in both enterprise and cloud environments. This class of application consists of loosely coupled microservices that require the generation of multiple interservice requests to complete a business process or transaction. This scenario, in turn, needs an infrastructure for also authenticating services (in addition to users) with special requirements as follows:

This section considers some new network security appliances and enhanced features in established appliances for meeting the security needs of the current network landscape. These can simply be viewed as point security solutions, but evaluating their functions and features will provide an understanding of the effectiveness of network configurations and technologies that form part of the integrated solutions that will be discussed in Sections 4 and 5, respectively.

Given the increasing subscription to multiple clouds in many enterprises, one of the most important pieces of software is the cloud access security broker (CASB). It sits on the network between the cloud service customers (CSC) and the cloud service providers (CSP). The evolution of CASB functionality can be traced as follows [3]:

The security functions in firewalls have enlarged alongside the changing network landscape. Firewalls started as hardware appliances that prevented network packets from a device with a particular network location (e.g., combination of Internet Protocol (IP) address and port) in one subnet (e.g., external network or internet) from accessing a device on another network location or subnet (e.g., intranet or Demilitarized Zone (DMZ) or corporate network). In that setup, it primarily secured a network perimeter. The evolution of firewall functions can be traced based on the following feature sets [6]:

a. Deep Packet Inspection (DPI) b. TLS decryption and inspection of packet payload c. Intrusion prevention system (IPS) feature

Network security automation tools automate the life cycle processes involved in deployment, observability/monitoring, threat intelligence gathering/reporting (e.g., generating alerts of security violations for security personnel to take timely action), and – in some instances – automatic remediation. These automated tools are an indispensable part of the current enterprise network landscape, especially those that consist of highly distributed on-premises and cloud-based IT resources. The security capabilities of network tools fall under the category of policy enforcement point (PEP) security capabilities that are extensively discussed in CISA’s TIC 3.0 Cloud Use Case [51]. Guidance for the deployment of these capabilities is also covered in that document. The intent of the material in this section is to highlight some higher-level metrics that this category of tools should satisfy in order to perform their intended functions effectively; it is not meant to be used as deployment guidance. Each higher- level metric is tagged with the abbreviation NSAT-HLM-x, where NSAT stands for network security automation tool, HLM stands for high-level metric, and x stands for the numerical sequence.

The network monitoring and observability tools and network provisioning tools are important classes of network security automation tools. The requirements and feature set for these two classes alone are discussed in the following subsections.

This class of tools gathers these data for obtaining visibility into the entire network. These data are then used to generate a dashboard that presents the topography of the enterprise network by showing all connections and presenting key operating parameters (e.g., latency, network traffic-level). Some of these data generated by this class of tool and their uses are:

As already stated, automated network resource provisioning is enabled by infrastructure-as-code (IaC) tools. The code that describes the networking infrastructure (in addition to the computing and storage infrastructure) is stored in a code repository. The initial deployment of the networking infrastructure and subsequent upgrade is automated by defining a workflow that invokes the IaC (e.g., GitOps workflow) as part of a CI/CD pipeline definition [16]. The advantages of this approach for managing the enterprise networking infrastructure for multi-cloud deployment are:

Another trend in the enterprise network landscape is that a portion of network infrastructure can be obtained from third-party providers as a leased service called a network as a service (NaaS). This service is offered using technologies such as enterprise 5G and edge computing. The advantages of NaaS are:

However, they are limited point security solutions rather than comprehensive solutions that address all aspects of enterprise security.

Any enterprise-wide secure network that consists of on-premises and cloud-hosted applications should be based on an established security framework. In turn, security frameworks consist of many basic security functions. The purpose of this section is to describe the network configurations or designs (and network communication exchanges based on them) that have emerged as the state of practice for implementing these security functions. The state of practice network configuration features (NCF) found in enterprises with hybrid application environments can be classified under the following areas [19]:

Each of the network configuration features is enumerated using the identifier of the form HAE-NCF-x, where HAE denotes a hybrid application environment, NCF denotes the network configuration feature, and x stands for the sequence number of the feature. First, consider the conceptual underpinning – critical information that is used as part of the deployment of a security functionality using a network configuration.

Section 2.4 discussed the limitation of using user identity alone to authorize application requests. However, this does not mean that identity verification can be relegated to a secondary requirement. It has been widely recognized that identity validation is the entry point (may be a highly-vulnerable point of entry into the system) to an application request [26] since all requests – whether coming from a service (or microservice), user, or device – come with a claimed identity. This identity must be verified using robust, phishing-resistant multi-factor authentication. However, other attributes associated with the user and the information associated with other entities involved in an application access request, such as devices and services, are required in current enterprise IT environments and are collectively called contextual information. This contextual information set may vary from one enterprise to another and is based on the level of trust that the organization requires for a particular access request. Since the role of contextual information in potential attacks may not be known, the set to be included in the access decision is a risk-based decision. Contextual information may broadly belong to the following five key areas [27]:

The requirements for contextual information [27]:

No application and/or data access in the modern enterprise network context can be deemed secure by ignoring relevant contextual information when the access scenario involves allowing a user, device, or service from any network channel (e.g., corporate network, home network, public network, or branch office) to access a resource located anywhere (on-premises or cloud).

With the disappearance of the network perimeter (Section 2.1) and the distribution of the application targets (being a hybrid application environment), enterprises should adopt an “endpoint is the perimeter” paradigm and have a device management system in place. HAE-NCF-1: There should be a unified endpoint management (UEM) [48] solution in place to manage and secure all endpoints that will access on-premises and cloud-based applications. The minimal managed tasks and capabilities of UEM should include: a. Ability to support endpoint devices with different operating systems b. Installation and maintenance of device and service authentication certificates c. Installation and maintenance of device health applications d. Updates of patches on the devices e. Enables admins to track, audit, and report endpoints for content and applications

HAE-NCF-2: Consistent with OMB memorandum M-22-09 [49], which outlines the federal zero trust architecture strategy:

HAE-NCF-3: Device authentication can be performed through certificate validation using appropriate protocols. A device health check may involve both its security posture (e.g., the version of an operating system it is running, the patches that have been applied, the security software that is installed) and environmental information, such as geolocation.

HAE-NCF-4: Standardized protocols, such as OAuth 2.0 [20], should be used to issue access tokens to the validated user, device, or service to enable access to cloud-based applications. HAE-NCF-5: Network configuration for microservices-based applications (on-premises or in cloud) should include capabilities such as service discovery, encryption, service authentication, load balancing, observability (visibility of network traffic at layers 3-7), and canary rollouts. Further, visibility into microservices runtime behavior (and the ability to provide more dynamic security controls) can be enabled by attaching eBPF programs [52] to tracepoint events (the entry to or exit from any function in kernel or user space).

The network configurations for attack escalation prevention are techniques used to realize ZTNA and are discussed in the next section. Two established configurations are:

原本PDFの抜粋画像

Each of the network configurations described in the previous section is for specific security functions (e.g., user authentication, device authentication). In many enterprise environments, these network configurations are not isolated implementations but rather an integral part of an enterprise-wide network that is governed by a security framework or strategy. A predominant strategy that has been endorsed by both government and industry for hybrid enterprises is zero trust (ZT). The blueprint for achieving the goals of ZT is the zero trust architecture (ZTA), and the consequent paradigm for network communication flows is Zero Trust Network Access (ZTNA). Working with many stakeholders, NIST has defined zero trust and zero trust principles as follows [33]:

NIST’s guidance on zero trust also contains an abstract definition of zero trust architecture (ZTA) and gives general deployment models and use cases where zero trust could improve an enterprise’s overall information technology security posture. From the NIST vision of ZTA and state of practice implementations [34], the following have emerged as the three building blocks of ZTA:

As already stated, the two established network configuration techniques for enabling ZTNA are microsegmentation and SDP, which are both discussed in the following subsections.

Microsegmentation is a security design practice where an internal network (e.g., in the data center, cloud provider region) is divided into isolated segments so that the traffic in and out of each segment can be monitored and controlled [21]. The primary purpose of microsegmentation is to provide a degree of isolation to prevent attack escalation.

原本PDFの抜粋画像

Capabilities enabled by microsegmentation include:

The above capabilities restrict the unauthorized lateral movement of a user or application that has either (a) breached the perimeter to enter the internal network or (b) been initiated by users within the internal network itself.

原本PDFの抜粋画像

Before discussion of microsegmentation, a discussion of a traditional network segmentation – called a segment-based approach – is in order to point out its limitations and difficulties. In this approach, the applications and service resources with similar security requirements are grouped into a unique segment, and firewall rules are created to block or allow communication with each group or segment. The segments are created using network layer abstractions, such as VLAN IDs or some other tagging approaches, while policies are defined using network address constructs (e.g., IP addresses and ports). Policies apply to subnets (e.g., VLANs) and not to individual hosts. Each segment is protected by gateway devices, such as intelligent switches and routers or next-generation firewalls (NGFWs), which should have the capacity to react and adapt in response to the threats and changes in the application workflows. Segmentation gateways monitor traffic, stop threats, and enforce granular access across east-west traffic (rarely for north-south traffic) within on-premises data centers or cloud regions. The main difficulty with this approach is in mapping the applications’ security requirements-based segments to corresponding network segments [23]. Another difficulty is change management. The mapping between applications and network identities that are being statically maintained has to continuously be kept in sync with the operational scenario where the application’s network locations are continuously changing due to performance and security reasons. A schematic diagram of the segment-based microsegmentation is shown in Figure 1. Each numbered microsegment in the figure is a unique VLAN identified by a VLAN ID. The group of applications that will run in that particular VLAN segment can be defined using different criteria, one of which is “all applications with similar security requirements”. Another criterion is that “all tiers (web front-end, application logic servers, and database servers) associated with a particular application” should run in a single microsegment, as shown in Figure 1.

Fig. 1. Segment-based Microsegmentation

The following are some approaches that are employed to implement microsegmentation [22]:

The reason that identity-based microsegmentation is to be included under the enterprise network landscape is that it enables only valid network traffic between the various component services of the application due to the mutual authentication and authorization of the service identities, thus enabling the goals of ZTNA to be met [25].

One conceptual underpinning for secure network access to IT resources is the software-defined perimeter (SDP) [31]. In SDP, the separation between networks is not defined by network address group or VLANs, making it network-agnostic. It is logically and dynamically defined for each user and each particular request. In other words, for each user request, the subset of IT resources to which the user has access is dynamically allocated irrespective of the location of the resource (e.g., corporate data center, branch office, private or public cloud). The salient principles of SDP include:

In all security frameworks for current enterprise network environments, the common principles that underlie application-specific requirements – such as low latency, high data transfer rates, and high reliability – that were applicable in previous network landscapes remain the same.

The wide area network (WAN) became an integral part of the enterprise network when organizations needed to connect their local area networks (LANs) across multiple geographically distributed locations (within the country and, in some cases, globally) starting in the 1980s. The initial WAN technology involved point-to-point (P2P) leased lines followed by frame relay. The first IP-based network was multiprotocol label switching (MPLS), which enabled multiple types of traffic – such as voice, video, and data – to travel on the same line. With the advent of technologies such as virtualization and increasing enterprise access to cloud services, enterprises have begun to adopt a new WAN technology called the software-defined wide area network (SD-WAN). SD-WAN technology removes the tight coupling between the control plane and data plane functions of the network and enables the centralized specification of various policies, such as access control, routing, and application traffic prioritization. Another development integrates all of the point security solutions provided by various network security appliances (Section 3) into a network security services infrastructure. Industry and industry consortiums use the term secure access service edge (SASE) [35] to refer to a comprehensive framework that offers wide area networking and various security services. SASE can be looked upon as the networking counterpart of the application’s service mesh, which provides a comprehensive set of application services, including security for cloud-native applications. Based on the above discussion, this section will focus on the following topics:

In addition to CSP-provided VPNs, a networking technology that provides network connectivity for accessing cloud-based services for enterprises is software-defined wide area networking (SD-WAN).

The design goals and common features in all SD-WAN offerings include:

Enterprises can gain cloud access in two ways: 1) through the VPN services provided by the cloud providers or 2) by integrating their own SD-WAN with cloud providers’ private networks, often called the cloud WAN. In both scenarios, it is possible for enterprises to enforce their enterprise networking and security policies even though the endpoint resources are located in a cloud provider’s private network.

The overall advantages of being able to orchestrate the CSP private network for the subscriber enterprise are:

An architecture has emerged for managing enterprise networks that are connected to multiple CSPs. A portion of the industry calls the collection of appliances in this architecture a cloud network platform. The requirements for this multi-cloud networking platform are [41]:

Based on the above requirements, multi-cloud networking platform offerings have emerged with the following architectural elements:

There are four industry trends [43] that may have security implications with regard to SD-WAN [44]:

An integrated security services architecture for SD-WAN has both networking and security functions integrated within it. The network access and security function capabilities are offered as a cloud service that enterprises can access through strategic network locations spread over a wide area called point of presence (PoP). In 2019, Gartner coined the term “secure access service edge” (SASE) to denote an architecture that converges networking and security functions and delivers them at a global scale as a cloud service [46]. The networking and security services delivered by an SASE are not new but simply delivered together as a single package rather than through point security solutions (Section 3). The various points of connectivity from the enterprise to SASE PoPs are called enterprise edges. The enterprise edges can be either:

The SASE network infrastructure thus becomes an integral part of the enterprise network whenever one or more of the enterprise edges are connected to various PoPs of SASE cloud services. The four primary functions delivered by SASE are [46]:

Some of the structural features of SASE offerings are:

The following are the minimal security services found in most commercial SASE offerings are:

Some of the advanced security features found in SASE offerings include:

The purpose of this document is to provide insights into the current enterprise network landscape in terms of topology, traffic flows, and security threats. It posits that changes in application architecture and technologies (e.g., monolithic to microservices-based, bare metal to virtualization/containers) and increased subscriptions to various types of cloud services (e.g., IaaS, SaaS) are drivers of the current state of enterprise networks. This document outlines the limitations of existing network access security assumptions and technologies due to changes in network topologies in modern enterprise networks. The emergence of new network appliances (e.g., CASB), enhanced features in existing appliances (e.g., firewalls), network automation tools for gathering data for visibility/monitoring, threat detection and remedial actions, and tools for automated network provisioning for different public CSP environments (enabled by IaC tools invoked as part of the smart workflows called CI/CD pipelines defined under the DevSecOps paradigm) are all discussed under point security solutions. This is followed by a discussion of various networking configurations that each implement a specific security function (e.g., user authentication, device authentication). A separate section is devoted to discussing the salient features of an evolving security framework for an enterprise-wide network called ZTNA, as well as the two predominant network configurations (i.e., microsegmentation and SDP) for preventing attack escalation to meet one of the goals of ZTNA. Finally, this document discusses the latest WAN technologies that form part of the current enterprise network landscape, as well as the features of WAN offerings with global PoP and integrated security services called SASE.

[1] Craven C (2019) What is the Difference between Edge Computing and MEC. Available at https://www.sdxcentral.com/edge/definitions/whats-the-difference-between-edge-computing-and-mec/

[2] The Monitor Issue 13 (2020) VPN Vulnerabilities Tied to Raising Data Exposure, Ransomware. Available at https://www.kroll.com/en/insights/publications/cyber/monitor/vpn-vulnerabilities-rising-data-exposure-ransomware

[3] Hardcastle JL (2018) Why CASB Is the Fastest Growing Security Category. Available at https://www.sdxcentral.com/articles/news/casb-fastest-growing-security-category-ever/2018/02/

[4] Proofpoint (2021) Getting Started with CASB. Available at https://www.proofpoint.com/us/resources/white-papers/getting-started-with-casb

[5] Lookout (2021) Embracing Zero Trust: A Guide for Agencies to Address the Cybersecurity Executive Order. Available at https://www.govexec.com/media/embracing-zero-trust-guide-agencies-address-cybersecurity-executive-order.pdf

[6] Cato Networks (2022) Network Firewall: Components, Solution Types, and Future Trends. Available at https://www.catonetworks.com/network-firewall/

[7] Palo Alto Networks (2022) Advanced URL Filtering. Available at https://www.paloaltonetworks.com/network-security/advanced-url-filtering

[8] Oswal A (2022) Cloud NGFW: Managed Next-Generation Firewall Service for AWS. Available at https://www.paloaltonetworks.com/blog/2022/03/next-generation-firewall-service-for-aws/

[9] Cato Networks (2022) Firewall Security: Understanding Your Options. Available at https://www.catonetworks.com/network-firewall/firewall-security/

[10] F5 Networks (2022) WAAP Buying Guide. Available at https://media.bitpipe.com/io_15x/io_158522/item_2439191/EBOOK-SEC-798086545-waap-buying-guide_FNL%20%281%29.pdf

[11] F5 Networks (2022) Choose the WAF That’s Right for You. Available at https://media.bitpipe.com/io_15x/io_158522/item_2439191/EBOOK-SEC-798087620-which-waf-is-right-for-you-refresh-FNL%20%281%29.pdf

[12] AT&T (2020) The essential guide to secure web gateway. Available at https://cybersecurity.att.com/resource-center/white-papers/essential-guide-to-secure-web-gateway

[13] Itential (2020) Redefining Network Configuration Management. Available at https://www.itential.com/resource/ebook/redefining-network-configuration-compliance-across-hybrid-infrastructure/

[14] McGillicuddy S (2022) Taking a Strategic Approach to Network Operations. Available at https://media.bitpipe.com/io_16x/io_161947/item_2553630/NBT002b_NetBrain-WP_Final%20%281%29.pdf

[15] Palo Alto Networks (2020) The State of SOAR Report, 2020. Available at https://media.bitpipe.com/io_15x/io_154375/item_2268964/the-state-of-soar-report-2020.pdf

[16] Aviatrix (2021) DevOps Guide to Multi-cloud Networking. Available at https://media.bitpipe.com/io_15x/io_158772/item_2444655/devops-guide-to-multi-cloud-networking%20%281%29.pdf.

[17] Itential (2021) Automating Multi-Cloud Networking. Available at https://www.itential.com/solutions/automation-use-cases/multi-cloud-network-automation/#:~:text=Automating%20Multi%2DCloud%20Networking&text=By%20leveraging%20the%20right%20automation,automate%20the%20Network%20of%20Clouds

[18] Verizon (2021) The future of networking is here. Available at https://media.erepublic.com/document/Network-as-a-Service_Solution_Brief.pdf

[19] Miller LC (2021) Data Center and Hybrid Cloud Security – E-Book. https://www.paloaltonetworks.com/resources/ebooks/data-center-and-hybrid-cloud-security-for-dummies

[20] Vertocci B (2021) JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens. (Internet Engineering Task Force (IETF) Network Working Group), IETF Request for Comments (RFC) 9068. https://datatracker.ietf.org/doc/html/rfc9068

[21] ColorTokens (2022) What is Micro-segmentation? Available at https://colortokens.com/micro-segmentation/

[22] Mandal A (2020) Microsegmentation – the quintessential architecture for Zero Trust. Available at https://medium.com/@anandadip/microsegmentation-the-quintessential-architecture-for-zero-trust-344715990c8e

[23] Kollimarla S (2021) How Micro-Segmentation for Data Centers Works. Available at https://colortokens.com/blog/data-center-micro-segmentation/

[24] Palo Alto Networks (2021) Prisma Cloud Identity-based Microsegmentation. Available at https://media.bitpipe.com/io_15x/io_157597/item_2439737/prisma-cloud-identity-based-microsegmentation.pdf

[25] Slattery T (2022) How to implement network segmentation for better security. Available at https://www.techtarget.com/searchnetworking/tip/How-to-implement-network-segmentation-for-better-security

[26] Frazier S (2021) Why the cyber EO made zero trust no longer a suggestion. Available at https://federalnewsnetwork.com/federal-insights/2021/09/why-the-cyber-eo-made-zero-trust-no-longer-a-suggestion/

[27] Brasen S (2020) Contextual Awareness: Advancing Identity and Access Management to the Next Level of Security Effectiveness. Available at https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/advancing-identity-access-management-to-next-level-security-effectiveness-pdf-7-w-7727.pdf

[28] Appgate (2020) SDP and Risky Devices. Available at https://www.appgate.com/blog/sdp-and-risky-devices-dynamic-controls-for-secure-access

[29] Srinivas S (2020) Democratizing Zero Trust with an expanded BeyondCorp Alliance. Available at https://cloud.google.com/blog/products/identity-security/google-cloud-announces-new-partners-in-its-beyondcorp-alliance

[30] Tanium (2021) Tanium Insights: It’s Time to Ditch the VPN for Zero Trust. Available at https://site.tanium.com/rs/790-QFJ-925/images/EB-ZeroTrust.pdf

[31] Scheels C (2021) VPN VS. ZTNA VS. SDP VS. NAC: What’s the Difference? Available at https://www.appgate.com/blog/vpn-vs-ztna-vs-sdp-vs-nac

[32] QTS (2020) Driving Data Center Innovation with Microservices. Available at https://media.bitpipe.com/io_15x/io_155464/item_2314862/QTS_Whitepaper_SDP.pdf

[33] Rose S, Borchert O, Mitchell S, Connelly S (2020) Zero Trust Architecture. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-207. https://doi.org/10.6028/NIST.SP.800-207

[34] Appgate (2021) 5 Steps for Successful VPN to ZTNA Migration. Available at https://d3aafpijpsak2t.cloudfront.net/docs/VPN_to_ZTNA_migration_ebook-6.pdf

[35] Shread P (2020) What is SASE and How does it Work? Available at https://www.esecurityplanet.com/networks/sase/

[36] Fortinet (2022) Required Capabilities for Effective and Secure SD-WAN: The Network Leader’s Guide. Available at https://www.fortinet.com/content/dam/maindam/PUBLIC/02_MARKETING/02_Collateral/eBooks/eb-network-leaders-guide-to-secure-SD-WAN.pdf.

[37] Mann T (2021) AWS Cloud WAN Parries Google, Microsoft. Available at https://www.sdxcentral.com/articles/news/aws-cloud-wan-parries-google-microsoft/2021/12/

[38] Mann T (2021) Is Multi-Cloud SD-WAN’s Final Destination? Available at https://www.sdxcentral.com/articles/news/is-multi-cloud-sd-wans-final-destination/2021/12/

[39] Mann T (2021) Google Cloud Drives SD-Underlays into Cisco SD-Wan. Available at https://www.sdxcentral.com/articles/news/google-cloud-drives-sd-underlays-into-cisco-sd-wan/2021/03/

[40] Mann T (2021) Fortinet Fortifies Microsoft Azure vWAN With SD-WAN Firewalls. Available at https://www.sdxcentral.com/articles/news/fortinet-fortifies-microsoft-azure-vwan-with-sd-wan-firewalls/2021/11/

[41] Aviatrix (2021) The Security Architect’s Guide to Multi-Cloud Networking. Available at https://media.bitpipe.com/io_15x/io_158772/item_2444655/security-architects-guide-multi-cloud-networking-v2%20%281%29.pdf

[42] Aviatrix (2020) Multi-Cloud Networking. Available at https://aviatrix.com/wp-content/uploads/2020/07/Multi-Cloud-Networking-by-Futuriom-July2020.pdf

[43] Robb D (2022) Top Software-Defined SD-WAN Trends. Available at https://www.enterprisestorageforum.com/networking/sd-wan-trends/

[44] TechTarget (2022) 4 Key SD-WAN Trends to Watch in 2022. Available at https://media.bitpipe.com/io_14x/io_148038/item_2494980/4%20key%20SD-WAN%20trends%20to%20watch%20in%202022.pdf

[45] Doyle L (2020) The pros and cons of SD-WAN and remote access. Available at https://www.techtarget.com/searchnetworking/tip/The-pros-and-cons-of-SD-WAN-and-remote-access

[46] Cato Networks (2021) 5 Questions to Ask Your SASE Provider. Available at https://go.catonetworks.com/rs/245-RJK-441/images/5_Questions_to_Ask_Your_SASE_Provider.pdf

[47] Spiffe.io (2021) SPIFFE Concepts. Available at https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/#trust-bundle

[48] Vmware (2022) What is Unified Endpoint Management (UEM)? Available at https://www.vmware.com/topics/glossary/content/unified-endpoint-management.html

[49] Office of Management and Budget (2022) Moving the U.S. Government Toward Zero Trust Cybersecurity Principles. (The White House, Washington, DC), OMB Memorandum M-22-09, January 26, 2022. Available at https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf

[50] Grassi P.A, Garcia M.E, Fenton J.L (2020) Digital Identity Guidelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-63-3. https://doi.org/10.6028/NIST.SP.800-63-3

[51] Cybersecurity and Infrastructure Security Agency (2022) Trusted Internet Connections 3.0 – Cloud Use Case. Available at https://www.cisa.gov/sites/default/files/publications/CISA%20TIC%203.0%20Cloud%20Use%20Case%20Draft_0.pdf

[52] eBPF (2022) What is eBPF? The Project Landscape. Available at https://ebpf.io/

[53] sdxcentral (2022) Will VPNs Survive the ZTNA, SASE Revolution? Available at https://www.sdxcentral.com/articles/analysis/will-vpns-survive-the-ztna-sase-revolution/2022/09/