Secure Application Access with Axis Security

The Challenges

The pandemic triggered a massive shift from office- to home-based workers. Now that many people are working from home and will likely continue to do so, enterprises need to provide secure access easily and cost-effectively. However, according to ESG research, 66% of organizations say securing the network at the edge is more difficult than it was two years ago. The threat landscape is the top reason for this, followed by distributed users and mobile devices, the need to implement policies and security tools, and IT staff shortages (see Figure 1). In addition, secure access is difficult due to the complexity of disparate access systems such as VPNs, VDI, and CASB; requirements for consistent data security; the expansion of IT across on-premises and cloud data centers; and the myriad of applications and employee-owned devices.¹

Figure 1. Threats Remain the Biggest Challenge for Network Security at the Edge

You indicated that network security at the edge has become more difficult over the last two years. In your opinion, which of the following factors have been most responsible for making network security management and operations more difficult? (Percent of respondents, N=241, three responses accepted)

Current remote access methods can be expensive and difficult to deploy, manage, and support; and may not provide visibility into potential malicious activity. Many, like virtual private networks (VPNs), require endpoint agents or difficult-to-scale hardware and connect users to an organization’s networked infrastructure instead of to specific resources. This increases network exposure and the risk of compromise—access to the network is the attacker’s holy grail. When several solutions are deployed or there are too many concurrent users, performance may decrease and negatively affect productivity and user experience. Software-defined perimeters (SDPs), another form of network access, can provide secure connectivity, but adoption remains low, with only 9% of organizations using SDP extensively.²

Enterprises need a solution that replaces traditional remote access methods to make it simpler for them to provide access reliably and securely at the edge.

Built on zero-trust principles, the solution enables granular control of application permissions. Requests to connect to an application are routed through the platform where they are authenticated against an individual’s policy settings and encrypted. The platform replaces traditional one-time authorizations with continuous authorization using contextual awareness (location, device type, history, and so on), security protocol analysis, and adaptive authentication that evaluates and changes permissions and even policies in real time. All this happens behind the scenes, invisible to users, although every individual action, such as viewing a page or downloading a file, is recorded and authorized separately.

Organizations can deploy secure access at the edge, even for temporary users, with benefits that include:

Figure 2. Axis Security User Portal

Table 1. Types of Applications Supported by Axis Security.

Source: Enterprise Strategy Group

Axis Security can automatically secure peer-to-peer and VOIP applications. This provides secure access to soft phones and other popular communication apps for employees and enables administrators to control access and log activity. ESG observed a VOIP soft phone connected to the network when we logged in to Axis Security and we successfully placed a call between the soft phone and our mobile phone (see Figure 3).

Figure 3. Secure Peer-to-peer VOIP

Users that are trusted enough can add their own apps. We added remote desktop access and administrative access to a remote system with the Add an App button (Figure 4). After providing the remote system name or IP address, we initiated both web-based and native-client RDP access. Using a packet sniffer (WireShark), we observed that we had a secure remote desktop connection: communication between the RDP client and server was encrypted, and no communication from the server to other systems was observed at the client.

Figure 4. Self-service Zero-trust Secure Connection to Remote Desktop and SSH

Next, ESG assumed an IT administrator role. We started by logging in to the administrative console and viewing the insights dashboard (Figure 5). The dashboard summarizes key secure session information and provides at-a-glance understanding of the usage of the system. All dashboard items are live links, enabling an administrator to drill down for more information on session locations, session details, and applications.

Figure 5. Axis Security Insights Dashboard

The Axis Security console enables administrators to pivot while searching and exploring data. We clicked on the first item in the Latest session list and then clicked on the username to get a list of the user’s sessions. We could also get to this same data from the Users menu item. We observed that by drilling down, we could see which pages the user viewed when accessing a web-based Logistics app (Figure 6). We could also see which commands the user executed during an SSH session. We also investigated the RDP session of the user and observed that Axis Security captured all activity, including screenshots, of the RDP session. Thus, Axis Security provided both zero-trust secure access and visibility into user activity.

Figure 6. User/Session Details

Next, ESG explored configuring access and security. We started with defining policies, as shown in Figure 7. Axis Security policies are similar to firewall rules but are more easily read and understood by humans: the policies control communication for an application from a source to a destination and can include parameters to specify users and groups, time ranges, and device posture. Axis Security can leverage Crowdstrike for additional device postures, and administrators can define profiles for types of applications (RDP, SSH, Web App, Git, etc.) to simplify rule creation and management. As with firewalls, rules are processed in order, and processing stops at the first rule match. Policies are enforced for every communication transaction, not just at the start of a session. Thus, if a policy parameter changes mid-session (for example, a time-of-day boundary is crossed), the policy is still enforced, and the communication may be stopped mid-session.

Figure 7. Axis Security Policy Definition

Axis Security includes its own identity provider to manage users and groups (Figure 8). The Axis IdP supports bulk import and temporary users with automatic deletion after a specified number of days. This feature is useful to enable secure access for contractors, hackathons, and other events. Administrators can also link to Google Gsuite, Okta, Microsoft, and other providers for identity and single-sign-on services for employees.

Figure 8. Users and Identities

Axis Security never exposes applications, remote desktops, or SSH servers to the public internet. Instead, administrators install an Axis Security connector in each network segment. The connector makes an encrypted outbound connection to the Axis Application Access Cloud. Remote users also make a connection to the Axis Security cloud, and the Axis Security service connects the user to the application.

We used the Axis Security console to create a new connector. As part of the deployment process, the console created and displayed a bash script. We executed the script on a VM, and the connector was automatically downloaded, installed, and configured without requiring additional input. We noted that we could also install the connector via RPM or OVA. We were then able to use the connector to connect to multiple apps inside the zone from our remote location.

Figure 9. Deploying Axis Security Connectors