CMDB-Driven Zero Trust Segmentation With Real-Time Telemetry
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in transitioning from legacy IPSec VPNs and network-centric security to Zero Trust architectures due to the lack of seamless integration of Configuration Management Database (CMDB) data with real-time access telemetry, leading to incomplete segmentation, configuration errors, and over-permissive policies.
Innovation Solution
Automate the creation and maintenance of granular Zero Trust access policies by fusing static CMDB inventories with real-time access telemetry to detect mismatches and generate data-driven policy recommendations, refining wildcard segments and incorporating discovered elements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If manual discovery and rule authoring is used for application segmentation, then configuration accuracy can be maintained, but migration speed and productivity are reduced
Solution Approach 1:
The system performs automated discovery of applications and generation of segmentation rules without requiring manual intervention. The analytics engine automatically analyzes access patterns, correlates them with CMDB data, and generates granular access policies, enabling the system to serve itself in the configuration process.
Solution Approach 2:
The system continuously monitors access patterns and uses this feedback to refine and update segmentation rules. Real-time telemetry data is analyzed to detect changes in access behavior, and the system automatically adjusts policies to maintain accuracy while enabling faster migration.
2Reliability
If static CMDB inventories are used for application segmentation, then configuration management is simplified, but alignment with real-world usage is lost
Solution Approach 1:
The system merges static CMDB inventory data with dynamic real-time access telemetry to create a unified view of application usage. This combination allows the system to maintain the structured management benefits of CMDB while incorporating live operational context to ensure policy accuracy.
Solution Approach 2:
The analytics engine acts as an intermediary layer that processes and correlates data from multiple sources including CMDB and real-time telemetry. This intermediary component simplifies the integration complexity by providing standardized analytics outputs that can be directly used for policy generation.
3Ease of operation
If wildcard permissions are used for access control, then ease of operation is improved, but security posture deteriorates due to lateral movement risk
Solution Approach 1:
The system segments broad wildcard permissions into granular, application-specific access policies. By analyzing actual access patterns and correlating them with application metadata from CMDB, the system creates fine-grained rules that limit access to only necessary applications, thereby reducing lateral movement risk while maintaining operational ease through automation.
Data Source
AI summary
A cloud-based private access system integrates static CMDB data with real-time access telemetry to automate Zero Trust segmentation. Administrators upload CMDB files (e.g., CSV/JSON) describing applications, FQDNs, IPs, ports, protocols, ownership, and priorities. An analytics management service stages and normalizes the data, retrieves reference domain data from an in-memory cache, and queries a telemetry engine to correlate intended configurations with observed usage. The system detects mismatches, over-permissive wildcard access, and auto-discovers non-listed elements such as subdomains, ports, or protocol combinations. It then generates prioritized recommendations to refine wildcard rules, create explicit allow policies, and merge or split application groups. Administrators review, simulate, and approve updates, enabling phased rollout, rollback, auditing, and continuous policy tuning based on evolving user and application behavior.