Zero Trust Networks: In Theory and In Practice

Zero Trust Networks: In Theory and In Practice

Presented at BSides Las Vegas 2017: http://sched.co/BNEw

The world is changing, but our network security models are having trouble keeping up. In a time where remote work is regular and cloud mobility is paramount, the perimeter security model is showing its age -- badly.

We deal with VPN tunnel overhead and management. We spend millions on fault-tolerant perimeter firewalls. We carefully manage all entry and exit points on the network, yet still we see ever-worsening breaches year over year. The Zero Trust model aims to solve these problems.

Zero Trust networks are built with security at the forefront. No packet is trusted without cryptographic signatures. Policy is constructed using software and user identity rather than IP addresses. Physical location and network topology no longer matter. The Zero Trust model is very different, indeed.

In this talk, we'll discuss the philosophy and origin of the Zero Trust model, what it brings to the table, and how to think about building one.

A97a75c945507f70992f579a730b0657?s=128

Doug Barth

July 25, 2017
Tweet

Transcript

  1. Evan Gilman, Doug Barth @evan2645 @dougbarth Zero Trust Networks

  2. 7/25/17 @evan2645 @dougbarth About Us Zero Trust: Building Systems in

    Untrusted Networks
  3. 7/25/17 @evan2645 @dougbarth DC-A DC-B DC-C C* C* C* Zero

    Trust: Building Systems in Untrusted Networks
  4. @evan2645 @dougbarth iptables

  5. @evan2645 @dougbarth

  6. @evan2645 @dougbarth IPsec VPN

  7. 7/25/17 @evan2645 @dougbarth DC-A DC-B DC-C Zero Trust: Building Systems

    in Untrusted Networks VPN VPN VPN
  8. @evan2645 @dougbarth IPsec VPN

  9. 7/25/17 @evan2645 @dougbarth DC-A DC-B DC-C Zero Trust: Building Systems

    in Untrusted Networks VPN VPN VPN
  10. 7/25/17 @evan2645 @dougbarth DC-A DC-B DC-C Zero Trust: Building Systems

    in Untrusted Networks
  11. 7/25/17 @evan2645 @dougbarth Emergent Properties All Flows Authenticated and Encrypted

    All Flows Asserted as Authorized No Inherent Value in IP Address Zero Trust: Building Systems in Untrusted Networks
  12. 7/25/17 @evan2645 @dougbarth Emergent Properties No Centralized Firewalls No Network

    Gateways No Private Network Zero Trust: Building Systems in Untrusted Networks
  13. @evan2645 @dougbarth BeyondCorp

  14. @evan2645 @dougbarth Zero Trust Philosophy: No Trust In Network

  15. @evan2645 @dougbarth Zero Trust Philosophy: Every Flow Is Expected

  16. @evan2645 @dougbarth Zero Trust Philosophy: Symbolic Policy

  17. @evan2645 @dougbarth Zero Trust Philosophy: Network Agent

  18. @evan2645 @dougbarth Zero Trust Philosophy: Automate!

  19. @evan2645 @dougbarth Visibility

  20. @evan2645 @dougbarth Start Early

  21. @evan2645 @dougbarth Manifestation

  22. 7/25/17 @evan2645 @dougbarth Control Plane Services Zero Trust: Building Systems

    in Untrusted Networks User Inventory Device Inventory Data Plane Servers Servers Servers Servers Servers Phones Servers Servers Laptops
  23. 7/25/17 @evan2645 @dougbarth Control Plane Services Zero Trust: Building Systems

    in Untrusted Networks User Inventory Device Inventory Config Mgmt Data Plane Servers Servers Servers Servers Servers Phones Servers Servers Laptops
  24. 7/25/17 @evan2645 @dougbarth Control Plane Services Zero Trust: Building Systems

    in Untrusted Networks User Inventory Device Inventory Config Mgmt Authentication Services Data Plane Servers Servers Servers Servers Servers Phones Servers Servers Laptops
  25. @evan2645 @dougbarth Examples

  26. @evan2645 @dougbarth Server-Side

  27. 7/25/17 @evan2645 @dougbarth PagerDuty Chef Cookbook for Initial Implementation Zero

    Trust: Building Systems in Untrusted Networks
  28. 7/25/17 @evan2645 @dougbarth PagerDuty Chef Cookbook for Initial Implementation Maturation

    brought Specialization Zero Trust: Building Systems in Untrusted Networks
  29. 7/25/17 @evan2645 @dougbarth PagerDuty Chef Cookbook for Initial Implementation Maturation

    brought Specialization Topology-Manager Zero Trust: Building Systems in Untrusted Networks
  30. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted

    Networks Control Plane Data Plane Server Agent Contained Workload Server Agent Contained Workload Enforcement
  31. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted

    Networks Data Plane Control Plane
  32. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted

    Networks Data Plane Control Plane Authorized User
  33. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted

    Networks Data Plane Control Plane Provisioner Authorized User
  34. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted

    Networks Data Plane Control Plane Provisioner Device Inventory Authorized User
  35. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted

    Networks Data Plane Control Plane Provisioner Device Inventory User Inventory Authorized User
  36. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted

    Networks Data Plane Control Plane Provisioner Device Inventory User Inventory Authorized User
  37. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted

    Networks Data Plane Control Plane Provisioner Device Inventory User Inventory Config Mgmt Authorized User
  38. 7/25/17 @evan2645 @dougbarth Topology-Manager No Trust In Network Zero Trust:

    Building Systems in Untrusted Networks
  39. 7/25/17 @evan2645 @dougbarth Topology-Manager No Trust In Network Compute Can

    Be Bootstrapped Anywhere Zero Trust: Building Systems in Untrusted Networks
  40. 7/25/17 @evan2645 @dougbarth Topology-Manager No Trust In Network Compute Can

    Be Bootstrapped Anywhere All Flows Get Strong AuthN/AuthZ Zero Trust: Building Systems in Untrusted Networks
  41. @evan2645 @dougbarth Client-Side

  42. 7/25/17 @evan2645 @dougbarth Google Large Network, Large Perimeter Zero Trust:

    Building Systems in Untrusted Networks
  43. 7/25/17 @evan2645 @dougbarth Google Large Network, Large Perimeter Many Remote

    Employees Zero Trust: Building Systems in Untrusted Networks
  44. 7/25/17 @evan2645 @dougbarth Google Large Network, Large Perimeter Many Remote

    Employees Perimeter + Remote Access Untenable Zero Trust: Building Systems in Untrusted Networks
  45. 7/25/17 @evan2645 @dougbarth Google Large Network, Large Perimeter Many Remote

    Employees Perimeter + Remote Access Untenable BeyondCorp Zero Trust: Building Systems in Untrusted Networks
  46. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted

    Networks Control Plane Data Plane Corp. Client
  47. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted

    Networks Control Plane Data Plane Corp. Client
  48. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted

    Networks Control Plane Data Plane Access Proxy Corp. Client
  49. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted

    Networks Control Plane Data Plane Access Proxy Corp. Client Enforcement
  50. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted

    Networks Control Plane Data Plane Access Proxy Corp. Client Backend Backend Backend Enforcement
  51. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted

    Networks Data Plane Control Plane User Inventory
  52. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted

    Networks Data Plane Control Plane SSO User Inventory
  53. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted

    Networks Data Plane Control Plane SSO Device Inventory User Inventory
  54. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted

    Networks Data Plane Control Plane Access Control Engine SSO Device Inventory User Inventory
  55. 7/25/17 @evan2645 @dougbarth BeyondCorp No Trust In Network Zero Trust:

    Building Systems in Untrusted Networks
  56. 7/25/17 @evan2645 @dougbarth BeyondCorp No Trust In Network Users Safely

    Roam Free Zero Trust: Building Systems in Untrusted Networks
  57. 7/25/17 @evan2645 @dougbarth BeyondCorp No Trust In Network Users Safely

    Roam Free All Requests Get Strong AuthN/AuthZ Zero Trust: Building Systems in Untrusted Networks
  58. 7/25/17 @evan2645 @dougbarth BeyondCorp No Trust In Network Users Safely

    Roam Free All Requests Get Strong AuthN/AuthZ Zero Trust: Building Systems in Untrusted Networks
  59. @evan2645 @dougbarth Mature Zero Trust

  60. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted

    Networks Data Plane Control Plane Access Control Engine SSO Device Inventory User Inventory Trust Engine
  61. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted

    Networks Control Plane Data Plane Access Proxy Corp. Client Backend Backend Backend Score Score
  62. 7/25/17 @evan2645 @dougbarth Mature Zero Trust Zero Trust: Building Systems

    in Untrusted Networks Trust Engine User Data Device Data
  63. 7/25/17 @evan2645 @dougbarth Mature Zero Trust Zero Trust: Building Systems

    in Untrusted Networks Trust Engine User Data sFlow Device Data
  64. 7/25/17 @evan2645 @dougbarth Mature Zero Trust Zero Trust: Building Systems

    in Untrusted Networks Trust Engine User Data sFlow Accounting Device Data
  65. @evan2645 @dougbarth UX is Important

  66. @evan2645 @dougbarth Earth is Calling…

  67. @evan2645 @dougbarth Current State

  68. @evan2645 @dougbarth

  69. @evan2645 @dougbarth

  70. @evan2645 @dougbarth

  71. 7/25/17 @evan2645 @dougbarth Just The Facts Industry Moving Towards Deep

    Authn/Authz Industry Converging on Zero Trust Model More Secure, More Operable Keep an Eye Out! Zero Trust: Building Systems in Untrusted Networks
  72. Evan Gilman, Doug Barth @evan2645 @dougbarth Zero Trust Networks