The Zero Trust Model of Information Security
Download as PPTX, PDF5 likes6,158 views
The document presents a discussion on the zero-trust model of information security, emphasizing new threats and the inadequacies of current trust models. It highlights a significant case of identity theft perpetrated by an insider, underscoring the need for enhanced security protocols. Recommendations include adopting a data-centric security approach and implementing stricter access controls while designing networks with zero-trust principles.
The Zero Trust Model of Information Security
- 1. The Zero Trust Model of Information Security
- 2. John Kindervag Forrester Research Cindy Valladares Tripwire, Inc.
- 3. Today’s Speakers Senior Analyst
- 4. No More Chewy Centers: The Zero-Trust Model Of Information Security John Kindervag, Senior Analyst 4 © 2010 Forrester Research, Inc. Reproduction Prohibited 2009
- 5. Agenda New threat landscape Something’s broken New trust models Summary 5 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 6. Agenda New threat landscape Something’s broken New trust models Summary 6 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 7. What do they have in common? 7 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 8. New threat landscape Question: “Why do you rob banks?” Answer: “Because that’s where the money is.” 8 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 9. Where the money is . . . Credit card theft Identity theft/fraud SPAM/botnets Web 2.0 (user-generated content) 9 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 10. The “Philip Cummings” problem Philip Cummings was a help desk staffer at TeleData Communication, Inc. (TCI), 1999 to 2000. TCI is a software provider for credit bureaus such as Experian and Equifax. Cummings had access to client passwords and subscription codes. 10 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 11. The “Philip Cummings” problem (cont.) Cummings was offered $60 per credit report by Nigerian nationals (organized crime). Cummings provided a laptop preprogrammed to download credit reports from Experian, Equifax, and TransUnion. The crimes took place between 2000 and 2003 (Cummings left his job in 2000). 11 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 12. The “Philip Cummings” problem (cont.) Discovered by Ford Motor Credit Company in 2003 30,000 identities stolen At least $2.7 million loss (FBI data) Cummings sentenced to 14 years in prison and $1 million fine Biggest identity theft in US history 12 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 13. 13 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 14. 14 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 15. Agenda New threat landscape Something’s broken New trust models Summary Other item 15 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 16. Plenty of controls Home Users Internet Business Parters Remote Wireless Users IDS Tap Router Firewall IPSEC VPN SSL VPN Two-Factor Switch IDS Tap Web Application Authentication Firewall Web Server Farm IDS Tap Patch RNA Console Management IDS Tap IDS Tap Content Filtering FTP Server Email Server Intrusion Security Switch Detection Information Server DMZ Console Manager Switch Wireless Gateway Wireless Anti-Virus Management Console IDS Tap Console Internal Users Management Segment Corporate Wireless Network Internal Server Farm 16 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 17. What’s broken? 17 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 18. Which one goes to the Internet? UNTRUSTED TRUSTED 18 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 19. “Trust but verify?” 19 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 20. What’s broken? Trust model 20 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 21. 2010 breaches — malicious insider 21 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 22. The cost of a breach Source: April 10, 2007, “Calculating The Cost Of A Security Breach” Forrester report 22 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 23. TJX accrued expenses (10k) — 2008 Source: January 11, 2010, “PCI Unleashed” Forrester report 23 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 24. How do we fix it? 24 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 25. Agenda New threat landscape Something’s broken New trust models Summary 25 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 26. Zero trust UNTRUSTED UNTRUSTED 26 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 27. Concepts of zero trust All resources are accessed in a secure manner, regardless of location. Access control is on a “need-to-know” basis and is strictly enforced. Verify and never trust. Inspect and log all traffic. The network is designed from the inside out. 27 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 28. Inspect and log everything IPS WAF IPS Web IPS Server farm farm WLAN GW IPS DAM DB farm IPS SIM NAV MGMT DAN server WAN 28 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 29. 29 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 30. 30 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 31. Agenda New threat landscape Something’s broken New trust models Summary 31 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 32. Strong perimeters = new threat vectors The threat landscape is changing — beyond the perimeter. Organized crime is bribing insiders. Security must become ubiquitous throughout your infrastructure. 32 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 33. Recommendations New paradigm — data-centric security Zero trust — “Verify, but don’t trust!” Inspect and log all traffic. Design with compliance in mind. 33 © 2010 Forrester Research, Inc. Reproduction Prohibited
- 34. A blueprint for making it real The next 90 days • Eliminate the word “trust” from your vocabulary. • Find your critical data, and map your data flows. • Tell people you will be watching their data access activity. • Review who should be allowed specific data access. 34 34 contents © 2010 Forrester Research,Reproduction Prohibited Entire © 2010 Forrester Research, Inc. Inc. All rights reserved.
- 35. A blueprint for making it real Longer term • Create a data acquisition network (DAN). • Segment your network to ease your security and compliance burden. • Begin rebuilding your network to reflect the zero-trust concepts. 35 35 contents © 2010 Forrester Research,Reproduction Prohibited Entire © 2010 Forrester Research, Inc. Inc. All rights reserved.
- 36. Thank you John Kindervag +1 469.221.5372 jkindervag@forrester.com Twitter: @Kindervag www.forrester.com © 2009 Forrester Research, Inc. Reproduction Prohibited
- 37. John Kindervag www.tripwire.com Forrester Research E-mail : jkindervag@forrester.com