Zero Trust Networks: In Theory and In Practice

Presented at BSides Las Vegas 2017: http://sched.co/BNEw

The world is changing, but our network security models are having trouble keeping up. In a time where remote work is regular and cloud mobility is paramount, the perimeter security model is showing its age -- badly.

We deal with VPN tunnel overhead and management. We spend millions on fault-tolerant perimeter firewalls. We carefully manage all entry and exit points on the network, yet still we see ever-worsening breaches year over year. The Zero Trust model aims to solve these problems.

Zero Trust networks are built with security at the forefront. No packet is trusted without cryptographic signatures. Policy is constructed using software and user identity rather than IP addresses. Physical location and network topology no longer matter. The Zero Trust model is very different, indeed.

In this talk, we'll discuss the philosophy and origin of the Zero Trust model, what it brings to the table, and how to think about building one.

Transcript

1. Evan Gilman, Doug Barth @evan2645 @dougbarth Zero Trust Networks
2. 7/25/17 @evan2645 @dougbarth About Us Zero Trust: Building Systems in Untrusted Networks
3. 7/25/17 @evan2645 @dougbarth DC-A DC-B DC-C C* C* C* Zero Trust: Building Systems in Untrusted Networks
4. @evan2645 @dougbarth iptables
5. @evan2645 @dougbarth
6. @evan2645 @dougbarth IPsec VPN
7. 7/25/17 @evan2645 @dougbarth DC-A DC-B DC-C Zero Trust: Building Systems in Untrusted Networks VPN VPN VPN
8. @evan2645 @dougbarth IPsec VPN
9. 7/25/17 @evan2645 @dougbarth DC-A DC-B DC-C Zero Trust: Building Systems in Untrusted Networks VPN VPN VPN
10. 7/25/17 @evan2645 @dougbarth DC-A DC-B DC-C Zero Trust: Building Systems in Untrusted Networks
11. 7/25/17 @evan2645 @dougbarth Emergent Properties All Flows Authenticated and Encrypted All Flows Asserted as Authorized No Inherent Value in IP Address Zero Trust: Building Systems in Untrusted Networks
12. 7/25/17 @evan2645 @dougbarth Emergent Properties No Centralized Firewalls No Network Gateways No Private Network Zero Trust: Building Systems in Untrusted Networks
13. @evan2645 @dougbarth BeyondCorp
14. @evan2645 @dougbarth Zero Trust Philosophy: No Trust In Network
15. @evan2645 @dougbarth Zero Trust Philosophy: Every Flow Is Expected
16. @evan2645 @dougbarth Zero Trust Philosophy: Symbolic Policy
17. @evan2645 @dougbarth Zero Trust Philosophy: Network Agent
18. @evan2645 @dougbarth Zero Trust Philosophy: Automate!
19. @evan2645 @dougbarth Visibility
20. @evan2645 @dougbarth Start Early
21. @evan2645 @dougbarth Manifestation
22. 7/25/17 @evan2645 @dougbarth Control Plane Services Zero Trust: Building Systems in Untrusted Networks User Inventory Device Inventory Data Plane Servers Servers Servers Servers Servers Phones Servers Servers Laptops
23. 7/25/17 @evan2645 @dougbarth Control Plane Services Zero Trust: Building Systems in Untrusted Networks User Inventory Device Inventory Config Mgmt Data Plane Servers Servers Servers Servers Servers Phones Servers Servers Laptops
24. 7/25/17 @evan2645 @dougbarth Control Plane Services Zero Trust: Building Systems in Untrusted Networks User Inventory Device Inventory Config Mgmt Authentication Services Data Plane Servers Servers Servers Servers Servers Phones Servers Servers Laptops
25. @evan2645 @dougbarth Examples
26. @evan2645 @dougbarth Server-Side
27. 7/25/17 @evan2645 @dougbarth PagerDuty Chef Cookbook for Initial Implementation Zero Trust: Building Systems in Untrusted Networks
28. 7/25/17 @evan2645 @dougbarth PagerDuty Chef Cookbook for Initial Implementation Maturation brought Specialization Zero Trust: Building Systems in Untrusted Networks
29. 7/25/17 @evan2645 @dougbarth PagerDuty Chef Cookbook for Initial Implementation Maturation brought Specialization Topology-Manager Zero Trust: Building Systems in Untrusted Networks
30. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted Networks Control Plane Data Plane Server Agent Contained Workload Server Agent Contained Workload Enforcement
31. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted Networks Data Plane Control Plane
32. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted Networks Data Plane Control Plane Authorized User
33. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted Networks Data Plane Control Plane Provisioner Authorized User
34. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted Networks Data Plane Control Plane Provisioner Device Inventory Authorized User
35. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted Networks Data Plane Control Plane Provisioner Device Inventory User Inventory Authorized User
36. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted Networks Data Plane Control Plane Provisioner Device Inventory User Inventory Authorized User
37. 7/25/17 @evan2645 @dougbarth Topology-Manager Zero Trust: Building Systems in Untrusted Networks Data Plane Control Plane Provisioner Device Inventory User Inventory Config Mgmt Authorized User
38. 7/25/17 @evan2645 @dougbarth Topology-Manager No Trust In Network Zero Trust: Building Systems in Untrusted Networks
39. 7/25/17 @evan2645 @dougbarth Topology-Manager No Trust In Network Compute Can Be Bootstrapped Anywhere Zero Trust: Building Systems in Untrusted Networks
40. 7/25/17 @evan2645 @dougbarth Topology-Manager No Trust In Network Compute Can Be Bootstrapped Anywhere All Flows Get Strong AuthN/AuthZ Zero Trust: Building Systems in Untrusted Networks
41. @evan2645 @dougbarth Client-Side
42. 7/25/17 @evan2645 @dougbarth Google Large Network, Large Perimeter Zero Trust: Building Systems in Untrusted Networks
43. 7/25/17 @evan2645 @dougbarth Google Large Network, Large Perimeter Many Remote Employees Zero Trust: Building Systems in Untrusted Networks
44. 7/25/17 @evan2645 @dougbarth Google Large Network, Large Perimeter Many Remote Employees Perimeter + Remote Access Untenable Zero Trust: Building Systems in Untrusted Networks
45. 7/25/17 @evan2645 @dougbarth Google Large Network, Large Perimeter Many Remote Employees Perimeter + Remote Access Untenable BeyondCorp Zero Trust: Building Systems in Untrusted Networks
46. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted Networks Control Plane Data Plane Corp. Client
47. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted Networks Control Plane Data Plane Corp. Client
48. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted Networks Control Plane Data Plane Access Proxy Corp. Client
49. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted Networks Control Plane Data Plane Access Proxy Corp. Client Enforcement
50. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted Networks Control Plane Data Plane Access Proxy Corp. Client Backend Backend Backend Enforcement
51. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted Networks Data Plane Control Plane User Inventory
52. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted Networks Data Plane Control Plane SSO User Inventory
53. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted Networks Data Plane Control Plane SSO Device Inventory User Inventory
54. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted Networks Data Plane Control Plane Access Control Engine SSO Device Inventory User Inventory
55. 7/25/17 @evan2645 @dougbarth BeyondCorp No Trust In Network Zero Trust: Building Systems in Untrusted Networks
56. 7/25/17 @evan2645 @dougbarth BeyondCorp No Trust In Network Users Safely Roam Free Zero Trust: Building Systems in Untrusted Networks
57. 7/25/17 @evan2645 @dougbarth BeyondCorp No Trust In Network Users Safely Roam Free All Requests Get Strong AuthN/AuthZ Zero Trust: Building Systems in Untrusted Networks
58. 7/25/17 @evan2645 @dougbarth BeyondCorp No Trust In Network Users Safely Roam Free All Requests Get Strong AuthN/AuthZ Zero Trust: Building Systems in Untrusted Networks
59. @evan2645 @dougbarth Mature Zero Trust
60. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted Networks Data Plane Control Plane Access Control Engine SSO Device Inventory User Inventory Trust Engine
61. 7/25/17 @evan2645 @dougbarth BeyondCorp Zero Trust: Building Systems in Untrusted Networks Control Plane Data Plane Access Proxy Corp. Client Backend Backend Backend Score Score
62. 7/25/17 @evan2645 @dougbarth Mature Zero Trust Zero Trust: Building Systems in Untrusted Networks Trust Engine User Data Device Data
63. 7/25/17 @evan2645 @dougbarth Mature Zero Trust Zero Trust: Building Systems in Untrusted Networks Trust Engine User Data sFlow Device Data
64. 7/25/17 @evan2645 @dougbarth Mature Zero Trust Zero Trust: Building Systems in Untrusted Networks Trust Engine User Data sFlow Accounting Device Data
65. @evan2645 @dougbarth UX is Important
66. @evan2645 @dougbarth Earth is Calling…
67. @evan2645 @dougbarth Current State
68. @evan2645 @dougbarth
69. @evan2645 @dougbarth
70. @evan2645 @dougbarth
71. 7/25/17 @evan2645 @dougbarth Just The Facts Industry Moving Towards Deep Authn/Authz Industry Converging on Zero Trust Model More Secure, More Operable Keep an Eye Out! Zero Trust: Building Systems in Untrusted Networks
72. Evan Gilman, Doug Barth @evan2645 @dougbarth Zero Trust Networks