Zero trust architecture and MIS.pdf
0 likes76 views
The document discusses Zero-Trust Architecture, highlighting its principle of 'never trust, always verify', which ensures that access to resources is authenticated and monitored regardless of location. It contrasts traditional security methods with Zero-Trust, emphasizing vulnerabilities in perimeter-based systems and outlining core components such as encryption, least privilege access, and continuous monitoring. Additionally, it explores the integration of Distributed Ledger Technology (DLT) with Zero-Trust frameworks and various consensus mechanisms to enhance security across decentralized networks.
Zero trust architecture and MIS.pdf
- 1. Zero-Trust Architecture Kawin Suwanban | GMBA R10749088 Management Information System 2022 04 20 1
- 2. Agenda ● Zero-Trust architecture ● Distributed ledger technology (DLT) ● Zero-Trust + DLT 2
- 3. Agenda ● Zero-Trust architecture ● Distributed ledger technology (DLT) ● Zero-Trust + DLT 3
- 4. What is Zero-trust architecture 4 History The term "Zero-trust" was coined in April 1994 by Stephen Paul Marsh in his doctoral thesis on computer security at the University of Stirling Concept The zero trust security model is an approach to the design and implementation of IT systems. The main concept behind the zero trust security model is "never trust, always verify” which means that devices should not be trusted by default, even if they are connected to a permissioned network such as a corporate LAN and even if they were previously verified.
- 5. Traditional vs Zero-trust architecture 5
- 6. Traditional vs Zero-trust architecture 6 Architecture Trust policy Impact from attacker Security perimeter Traditional Trust is based on network location that an access request is coming from. Enables attackers to move laterally within a network to get to the important data. Doesn’t extend security to the new perimeter Zero-trust Trust is established for every access request regardless of where the request is coming from. Secure access across companies’ applications and network. Ensure only right users & devices have access. Extends trust to support a modern companies with BYOD, cloud apps, hybrid environments & more.
- 7. Zero-Trust architecture core components 7 Components Detail Access Segmentation Every access to a resource must be appropriately segmented, in order that no single entity can access the entire network or even a large part of it. Universal Authentication All entities, including users, devices, applications, and workloads, having any form of interaction with the corporate network must be authenticated regardless of their location in the network. Encrypt as Much as Possible ZTA assumes a breach (i.e., the worst-case scenario), therefore, the network is always considered hostile, and trust cannot be inherently granted. That said, one must always assume that a potential adversary can intercept any type of communication happening throughout the network. As a result, all communications should be end-to-end encrypted The Principle of Least Privilege All entities in a ZTA must be restricted to the least amount of privilege required for that specific entity to complete its mission or operation. Continuous Monitoring and Adjusting Every entity (internal or external) in a ZTA should be monitored. In this context, all network traffic, system events, and access attempts should be monitored and recorded regardless of failure or success. These must be continuously analysed and cross- checked against the security policy. The outcome should be then used to adjust the relevant policies when needed.
- 8. Improve visibility within network Discovering and classifying all devices on the network are essential in a ZT- security strategy Faster issue resolution Inherent transparency and visibility in ZT-security networks enable IT specialists with different disciplines to spot issues faster and collaborate more cohesively Isolation of security incidents Even if one identity type is compromised, the others are not Secure usage of public/hybrid clouds CSP responsible for physical access, shared responsibility for logical access Secures data sharing outside of organization Allows for confidential exchange and collaboration Of data and applications both within and across business entities 8 What it enable companies to do? Lower risk of data breach Trustless security protocols eliminate points of attach by relying on systematic identify verification, especially in remote scenarios. Reduced scope and cost of compliance Segmentation of networks simplifies audits given that only specific segments are in scope for regulation Reduced capital and operating expenditures Zero trust security approaches consolidate multiple security protocols across network, eliminating redundancies while reducing number of security-management consoles needed Business Impact
- 9. Agenda ● Zero-Trust architecture ● Distributed ledger technology (DLT) ● Zero-Trust + DLT 9
- 10. Distributed Ledger DLTs are public or private networks recording transactions across distributed infrastructure. Stored transactions are encrypted through unique, unchangeable hashes (for example, SHA 256 algorithm). Multiple nodes verify items based on permissions or economic incentives to reach majority consensus to add transactions to the ledger, called consensus mechanisms. Blockchain is a type of DLT, a public network with a shared ledger without central authority controlled by economic incentives for nodes to update the ledger. In a public network, economic incentives for transaction verification promise rewards to nodes as they credibly prove that transactions are legitimate; this is called mining. 10
- 12. How can DLTs integrate with companies use case 12
- 13. Agenda ● Zero-Trust architecture ● Distributed ledger technology (DLT) ● Zero-Trust + DLT 13
- 14. Zero-Trust architecture and distributed ledger intersection elements 14 Traditional Perimeter-Based Architecture Zero Trust Architecture Distributed ledger Technology Overall Approach Centralised Decentralised Decentralised Architectural focus Perimeter-Focused Borderless / Distributed Distributed Infrastructure trust level Trusted or semi- trusted in some cases Untrusted or trust but verify in some cases Untrusted
- 15. Blockchian based intrusion system 15 Context Assuming a blockchain enabled IDS, where multiple nodes, function as peers, are spread throughout the network for monitoring, gathering and data correlation purposes, they must reach consensus somehow. Challenge: What should be appropriate consensus mechanic? There must be an effective, practical, dependable, efficient, continuous, and secure mechanism to guarantee that all events and alerts are received and sent and are real and unaltered while all peer members concur to the status of the ledger. That said, there are several consensus mechanisms providing such capabilities, each one with their different attributes Concept Proof of Work (PoW) is a decentralized consensus mechanism that requires members of a network to expend effort solving an arbitrary mathematical puzzle. Proof of Stake (PoS) With proof-of-stake (POS), cryptocurrency owners validate block transactions based on the number of coins a validator stakes instead of solving puzzle. Hence, less energy used compared to PoW Practical Byzantine Fault Tolerance (PBFT) In PBFT, a predefined group of individuals function as validators. Participants must reach consensus when a new event occurs while at the same time, they must verify that no data has been modified during the event transmission. If 2/3 of the participants reach consensus, then the decision is considered final. Potential Consensus Mechanism
- 16. Blockchian based intrusion system 16 Context Assuming a blockchain enabled IDS, where multiple nodes, function as peers, are spread throughout the network for monitoring, gathering and data correlation purposes, they must reach consensus somehow. Challenge: What should be appropriate consensus mechanic? There must be an effective, practical, dependable, efficient, continuous, and secure mechanism to guarantee that all events and alerts are received and sent and are real and unaltered while all peer members concur to the status of the ledger. That said, there are several consensus mechanisms providing such capabilities, each one with their different attributes Concept Potential Consensus Mechanism Consensus mechanisms PoW PoS PBFT Energy Consumption Require high amount of energy Require less energy consumption Require less energy consumption Advanced hardware requirement Required Not required Not required Centralization Decentralized Partially Centralized Centralized Double Spending Attack Possible Difficult N/A Scalability Not Scalable Scalable Scalable Memory Requirement Significant due to public ledger Significant due to public ledger Less than PoW or PoS Security Attack with 51% is possible Attack with 51% not possible May have a single point of failure
- 17. References 17 Kindervag, J. (2021, January 1). What is Zero Trust? IBM. Retrieved May 11, 2022, from https://www.ibm.com/topics/zero-trust Mckinsey Digital. (2021, January 1). The top technology trends. The top trends in tech. Retrieved May 10, 2022, from https://www.mckinsey.com/business-functions/mckinsey-digital/our-insights/the-top-trends-in-tech Pinto, R. (2018, August 23). Enhancing Security By Leveraging Blockchain Tech As An Enabler For Zero-Trust Frameworks. Enhancing Security By Leveraging Blockchain Tech As An Enabler For Zero-Trust Frameworks. Retrieved May 11, 2022, from https://www.forbes.com/sites/forbestechcouncil/2018/08/23/enhancing-security-by-leveraging-blockchain-tech-as-an-enabler-for- zero-trust-frameworks/?sh=6bd1dd0e3192 Raina, K. (2021, May 6). What is Zero Trust Security? Principles of the Zero Trust Model. CrowdStrike. Retrieved May 10, 2022, from https://www.crowdstrike.com/cybersecurity-101/zero-trust-security/ Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020, August). Zero Trust Architecture.
- 18. References 18 Alevizos, L., Ta, V. T., & Eiza, M. H. (2021, November 15). Augmenting Zero Trust Architecture to Endpoints Using Blockchain: A State- of-The-Art Review. Retrieved April 29, 2022, from https://www.researchgate.net/publication/350577973_Augmenting_Zero_Trust_Architecture_to_Endpoints_Using_Blockchain_A_ Systematic_Review Encora. (2022, January 14). Factors Impacting the Adoption of Trust Architectures and Frameworks. Encora. Retrieved May 10, 2022, from https://www.encora.com/insights/the-factors-driving-the-adoption-of-trust-architectures-and-frameworks Forbes. (2018, August 13). Enhancing Security By Leveraging Blockchain Tech As An Enabler For Zero-Trust Frameworks. Enhancing Security By Leveraging Blockchain Tech As An Enabler For Zero-Trust Frameworks. Retrieved May 1, 2022, from https://www.forbes.com/sites/forbestechcouncil/2018/08/23/enhancing-security-by-leveraging-blockchain-tech-as-an-enabler-for- zero-trust-frameworks/?sh=4c28d2b93192 Gregory, M. (2019, January 1). What is a Trust Architecture and how service oriented systems help us think about trust in software development? Ockam. Retrieved May 11, 2022, from https://www.ockam.io/learn/blog/Introduction_to_Trust_Architectures
- 19. Thank You 19