May 2022 Summaries

Zero Trust Network Access (ZTNA) is a future of network security that is being adopted by organizations to replace traditional VPNs. ZTNA is based on three core principles: assume breach, verify explicitly, and least privilege. It creates direct connections between users and resources, regardless of location or network type. ZTNA has several benefits, including unified access control, securing development environments, universal multi-factor authentication, and improved security through granular role-based access controls. However, it also presents challenges such as building a case for adoption, learning to manage identities, and addressing implementation gaps. Additionally, ZTNA introduces new risks, including single point of failure, breaches of servers or devices, and compromised privileged credentials. To successfully adopt ZTNA, organizations must carefully plan their migration project, choose the right vendor, and address these challenges and risks.

Twingate is announcing a new feature called Device Security that makes it easy to consistently and securely establish "device trust" as part of a Zero Trust architecture. This feature allows companies to define what constitutes a trusted device and incorporate these definitions into access policies, ensuring that only users on secure devices can access protected resources. Twingate's approach to device trust is based on three key principles: comprehensively, consistently, and granularly. The company aims to make consistent, straightforward device security a reality for its customers, enabling them to adopt Zero Trust principles easily. Device Security allows admins to define trusted devices, configure specific Trusted Profiles that grant access when more security is required, and associate these profiles with Resource Policies to ensure only the right devices can access sensitive resources. This feature will be rolled out over the next few weeks and will enable customers to expand on their trust methods as needed.

An identity-based Zero Trust Architecture is the only way to deliver secure access to resources and workforces distributed far beyond the office walls. This modern security paradigm never assumes that a user, device, or network can be trusted due to the increasing number of modern security threats. To mitigate this, every incoming connection request must be verified explicitly and users' identities confirmed, which is known as Zero Trust Authentication. The principle of "assume breach" lies at the heart of Zero Trust and informs its approach to authentication and authorization, including Zero Trust Authorization based on the principle of least privilege, limiting access to verified users to the bare minimum they need to do their work. Identity Providers play a critical role in making this modern security paradigm work across today's distributed networks by creating a single federated identity that applies to on-premises and cloud-based resources. However, while identity is essential, it is only one element in a Zero Trust Architecture, which also considers context and device posture when implementing least privileged access policies. Twingate offers a secure access solution that makes Zero Trust as simple as possible for every stakeholder, including transparent client apps and browser-based consoles to enforce security policies without user involvement.

An identity provider (IdP) is a service that manages a single identity across many networks, services, and applications. This simplifies access control by giving users seamless access to multiple resources with one login credential. Identity Providers are critical in Zero Trust adoption, which requires both authentication and authorization to protect resources while allowing users to get work done. IdPs help solve problems such as unsecure passwords, privacy risks, and more attack vectors that arise from managing multiple user credentials across distributed resources. By providing a single identity for access to various resources, Identity Providers reduce the complexity of managing access policies and enhance security in a cloud-based and distributed environment.

Pulumi, a leading multi-language infrastructure as code platform, has partnered with Twingate to make it easier for developers to deploy and manage Twingate connectors programmatically across various public cloud environments. This partnership allows developers to automate their infrastructure using languages they are already proficient in, such as Python, TypeScript, JavaScript, Go, or .NET, making infrastructure management simpler and more accessible. The first phase of the partnership involves a step-by-step guide on deploying Twingate connectors via Pulumi, which includes installing Pulumi, initializing a new project, setting up Twingate configuration parameters, automating the process, and executing the automation using commands such as `pulumi up`. This enables developers to rapidly implement modern Zero Trust networks that are more secure and maintainable than traditional VPNs.

TwinGate has earned 15 G2 Spring 2022 Awards in various categories, including Cloud Security, Software-Defined Perimeter, Zero Trust Networking, and Virtual Private Network. The awards recognize Twingate's ease of use, simplicity, customer relationships, and overall performance. Reviewers praised Twingate for its seamless implementation, granular role-based permissions, and affordable pricing. The company's solutions are designed to simplify Zero Trust access for organizations at every scale, from small businesses to large enterprises. With a focus on consumer-grade usability and enterprise-grade services, Twingate aims to provide a modern, secure, and maintainable Zero Trust network that replaces traditional VPNs.

Inbal Zelinger, a software engineer at Twingate, explains how to build a SAML service provider using PySAML2. She provides an overview of the Security Assertion Markup Language (SAML) and its use in single sign-on (SSO). The article covers the user flow for SP-initiated SSO integration, configuration settings, and implementation details. Inbal shares her team's findings on building a multi-tenant service provider using Django and PySAML2, including creating a custom metadata loader and configuring the `saml2.config.Config` class. She also provides Django views for SAML endpoints, including login and assertion consumer service views. The article concludes with instructions on how to create a new SAML app in an IdP and integrate it with a Django server.