Good evening everyone.
Thank you so much for joining us today here and welcome to the last session from Security
Devroom.
Let me start with a question.
How many of you think that the internet work within the premise or the organization
you are working is secured?
If you are unsure, that's why exactly I am here and all of you are here.
So, my name is Sam vidna.
I work as a senior staff member in IBM and I am all the way I have come here for
for first time to gain knowledge to share knowledge with all of you from India Bangalore.
The first question comes is why zero trust rate?
So, this is like a very, you know, moving from the traditional castle at mode
model.
Very, it is considered that the perimeter based security approach no longer can apply.
Why zero trust is a very simple question?
And in that when you think about it, the rising threat in form of the cloud
involvement, in form of the remote work, in form of the various, you know,
the perimeter less communication that we are having today.
It is impossible to have a perimeter based security in which anything beyond or within a premise,
within a network is considered as stored.
That is not going to work in today's, you know, environment.
And that is why the key drivers that are driving the zero trust are something, for example,
related to all the products slowly and slowly moving to the cloud environment.
We have the workforce, which is not only, you know, you can see them every day.
It's all, you know, consist of remote workforce.
And finally, there are a lot of regulatory compliance that requires all of our security controls
to be very strong.
And to meet all of them, to meet all of them, we need to have the, at least,
to have the attack surface limited.
And to achieve that attack surface limited, zero trust is the action, which not only helps you
to reduce the surface by considering some of the factors, but also have the impact
overall, in case of breach, less, you know.
And then, you know, we will go through some of the actionable items that will help you
achieve zero trust in your work.
So in the left side, you see the traditional perimeter based defense, wherein the castle
wall actually represent the idea of security in which once you are beyond that castle, you
are in a secured environment.
But now there is a concept of layered security, in which you can see that each and every
point based on the context, based on the behavior, based on the, you know, various factors.
The security is layered and you are being scanned to ensure that you are the right person
at the right time in the right context to access the information.
And the very, very common example is the modern security, which is present in the airports
these days.
Each layer is actually you are being scanned for your identity, for your purpose.
And then, finally, you know, for the future that you are going to do in the airport.
So, this is how, you know, it will look like you have an application, you have data, you have
compute, you know, very, very normal, you know, software environment.
So, all these enterprise network used to make a system or a process considered as secured,
which is a traditional way.
I log in to IBM network, I log in to a company network and I am in the secured zone.
But that is not going to work in today's era.
In today's cybersecurity environment, you need to have various policy, you need to have layered
structure, define per your application, the type of data that is going to be accessed.
And finally, the type of compute resources it is going to use.
In this one of the very, you know, known example is from one of the vendor.
Actually, what they try to do is to adopt zero trust.
They picked up the most critical data in any vendor management system.
The vendor data will be the most critical information.
And that was considered first, which was made to be zero trust modern.
Where in admin, the admin who was doing the operation day in day out operation,
even that admin was not given access to the data all the time.
When they had need just in time, they get access, they do the work.
And then, you know, the access is no longer there.
With that, the cost of the maintenance was reduced plus.
The breach time was also reduced because the admin or the person who was supposed to do the management,
they also do not have access to data all the time.
Now, think of, you know, the traditional security as you keep your door locked.
Maybe with the recent or, you know, very digitized lock, but keep all the windows open.
That is not going to help, you know, with respect to the modern security.
In the traditional security, you had implicit trust.
And that implicit trust is the vulnerable.
The zero trust will actually help to make this vulnerability convert into cyber resilience.
And for that, how it does is, it will stop or it will restrict the lateral movement.
It will also help to reduce the insider threat limited.
We cannot have something like gone forever.
But what happens is the implicit trust is what something which is exploited.
I think earlier in one of the sessions, somebody mentioned that it is not that attackers are attacking from outside.
They are logging into the system.
And that is where this zero trust actually, you know, gives you principle to how to ensure that, you know, the situation where this whole boundaries blur,
how you can achieve, you know, the security, how you can address the modern challenges,
how you can have the principle, very simple principle of, you know, never trust always verify module,
very new continuously monitor, you continuously authenticate.
And then only you actually allow that, that, you know, individual to access the system.
And finally, you reduce the attack surface.
Now, every breach tells us story.
So these three are three case study.
Wherein, first one is about healthcare industry, in that the identity was weak.
Meaning, even the MFA, forget about the complex password and policy.
The MFA itself was not adopted and that caused the, you know, the attack, actually weak access point.
The second example is on the research and development, wherein, you know, the perimeter base access was provided
in the research and development environment and that caused the attack.
And finally, the critical infrastructures attack in the energy sector.
It was because the network connectivity was compromised through the, through vulnerability in the VPN itself.
And that caused the, you know, some of the data to be leaked.
So, you know, understanding about when we talk about modern security,
three pillars comes like a very prominent to be addressed.
First is the identity setric protection.
Then we have dynamic micro segmentation and finally continuous monitoring.
So when I talk about identity-centric protection, we have all of the SSO, you know, single sign on,
all I am management, anything related to unauthorized access protection comes into picture here.
The second pillar is your dynamic micro segmentation.
Why we talk about dynamic micro segmentation is, you have considered, you know, you have divided your or into departments.
But that is not going to be static is what it will not help you.
It has to be based on the network and application type.
And at the runtime, how the data is flowing.
How this critical data is flowing in your network.
And that is what you have to dynamically micro segment your, you know, applications.
And finally, it has to be all real time.
It is not a one-time project that I release and I am done.
You have to real time actively monitor it using all idea-tune, which is possible.
Do the behavioral analysis, do the correlation.
And then you can say that, you know, I am completely adopting to zero-trust architecture.
So in a typical zero-trust architecture, you have all type of user, business user, privilege user.
They exist the corporate network through any, you know, important protection mechanism.
You have SSO and all of them in place.
Once the user gets into corporate network, they have these micro segmentation,
in which based on their role, they, you know, defined policy, fireball.
Eventually, they exist, you know, in this example, it is an hybrid cloud.
And finally, there are two important things for monitoring.
Your security operating system is for a team.
They are monitoring using it, idea, all of the activities.
And then there are some security team.
Data security team.
They manage the keys.
They manage all the certificates.
So that, you know, you have, even though you, you are part of the organization,
but your keys, your tokens should all be valid to be used.
So talking about framework is one thing, but how it is being adopted is actually when the real story begins right.
So let us talk about something on the numbers.
By, you know, over 70% of the organization, they have already on to zero-trust principles.
By 2025, I am sorry for the little late data.
Remote access deployments are already, you know, 70% mark.
And finally, when you see all these, you know, information,
you cannot enforce anything to make it, you know, more add more friction.
It has to come from as an ownership.
So it has to be divided that, yes, you are responsible to have this implemented.
You are responsible to monitor it.
If I enforce it, it will cause friction, and that is not going to help.
So that this is when you actually will, you know, think that my or my company, my product,
is at what level to adopt to zero-trust implementation.
Now, how to implement it, it has to be a phase-wise approach.
Wherein, we start with the high critical asset.
Move to the core security principle, where you bring the all identity-centric concepts.
You bring all of the micro-segmentation, you monitor them continuously.
And then you eventually, you know, adopt it to other components that you would like to have zero-trust architecture.
It's not like a really, really good idea that I give you some product or I give you some process,
but I don't take input from the user who is going to basically use it.
If I don't make it seamless, two more people are going to complain that, you know, security only is enforcing lot of policies,
lot of regulations, and lot of work on me.
How to make it seamless is so important, and that is when the user centric design.
Even if it is a button, it is a checkbox, it is a radio button, it is a simple, you know,
pop up all of them requires a user discussion, and based on the, you know, comfort label from the user,
that that design should, is what we should be adopted.
When we talk about, you know, the seamless access, I, when I'm in office,
I already have crossed one of the authentication place, and then only I reached office right.
I mean, I might have ID card or I might have some way to SX biometric data, right?
So after I reach office, my laptop should not ask me 1000 of question before I actually start doing my work.
So it can be adaptive, but when I go to home office, when I log in from cafeteria or I know any cafe on weekend,
or my relative's place, it has to ask, are you really, you know, the person who is trying to access?
So these are the things that will help to give you seamless, just in time access,
based on the perimeter where you are operating your system,
and, you know, even, even it goes for the adaptive authentication,
wherein, when you are in office environment, when you are in home environment,
the various way in which you're authenticated will give you more and more seamless access to the work that you are trying to do.
And finally, we cannot have like very complex graphical user interface or a store anything that makes the whole product.
So complex that, you know, people stop using it.
That is not the intent here.
Intent here is the security, but intent also is to make the user experience very, you know, friendly,
so that it is a popular product, it is a, you know, helpful product.
And eventually, the user is actually appreciating the fact that I'm getting a secure product,
even though, you know, there are lot of zero trust principle which are provided to you.
So, you know, there are few things that we should keep in mind when we implement any zero trust,
we should not over complicate the policy because at the end of the day,
the main goal is that we, we, as a person, you know, authenticated person,
I should have access to it.
There should be a strategy around that, you know, we should have a identity governance,
pick up the product which is like more very much clean, clear or very near to the product that you are going to implement it.
Finally, there are a lot of, you know, products which are adopting AI based analysis, AI based tools,
for the, you know, correlation activity or things like that, that will help to achieve the, you know, future.
So, just for a reference purpose, I put two to three products here from, from the open source,
which, which actually helps us to achieve some of these steps that we discuss now.
For example, click clock, it will help you to achieve single sign-on.
It is provided by Red Hat and it has a very seamless integration with MFA and a several identity federation tools.
The second one is about Pomorium.
It is, identity of a reverse proxy.
It also will provide you, you know, without the need of VPN, but still you can achieve the secure access.
Open cities, another, you know, overlay network, you know, it provides a zero trust network, which is very helpful for, you know,
stringent identity and context verification after that, it allows the user to login.
And finally, you know, I think one of the session actually was in the morning, it, it talked about the whole monitoring thing, right?
In that, it is very important to get a aggregated view.
I implement thousands of, you know, controls for you, but how many of them are actually useful?
How many of them are actually protecting any kind of breach is so important, so that you can,
in which your time money and energy into it, rather than doing all the other things, which actually,
where not, not doing much of help.
So, all those, you know, such view you can get through ELK stack and, you know, elastic says log, stash and kibana,
and all those stack will actually give you the view of all end point, how the things were accessed,
how various visualization of logs also can be done through that.
And eventually, it can be fed to any AI engine to actually, you know, give you any behavioral analysis in an automated way.
Now, finally, you know, you understood the importance of zero trust.
You also have, you know, phase wise implementation in place, and then you will have some kind of balance in your mind
to bring that robustness into, you know, security attached it with smooth user experience.
And finally, it is not about, you know, becoming too much of paranoia about, you know, zero trust and how to get it in my product or things like that.
It is about little bit of, you know, skeptical and think about security in terms of, you know, that it is going to, it is to help us,
but at the same time, how to bring that trust through a process, not, you know, through implicit trust,
that will make, you know, this whole journey as a very easy to adopt to easy to, you know, implement about.
So, always remember that the trust is very, very expensive and breach, they are always helpless.
And if you think that zero trust is actually very, you know, difficult thing to explain or understand,
just, you know, remember that it is very easy then explaining the any breach to your senior executive.
So, always, you know, keep that in mind and let us try to have the meter reading for this trust as zero.
So, that is all I wanted to share to the, thank you so much for staying so late here and have a nice rest of your day.
Thank you.
Thank you. We've got still some time for questions.