Zero trust server management - lightning
1 like878 views
The document discusses zero-trust server management as an alternative to traditional server access management using Active Directory and VPN. Zero-trust involves dividing systems into sub-systems with least privilege access for all users, machines, and code. It also recommends using public key authentication and bastion hosts to create security zones for access to servers rather than relying on Active Directory in cloud environments.
Zero trust server management - lightning
- 1. Zero-Trust Server Management Boston DevOps August 2014
- 2. Traditional server access management has been based on Active Directory and VPN / perimeter
- 3. Data center - “Chewy interior” Perimeter - “Crunchy exterior”
- 4. What do you do when your perimeter is taken away?
- 5. Service A Service B Service C Service D
- 6. Zero-Trust: No “root” privilege Division of systems into sub-systems Least privilege among all users, machines and code
- 7. Zero-Trust is the future of infrastructure management http://www.slideshare.net/mdkail/it-ops-2014-technology-roadmap
- 10. What’s the practical challenge to implement zero-trust auth for systems management?
- 11. Don’t try and use Active Directory in the cloud. It won’t work, for more reasons than I can list here.
- 12. Front-End Back-End ◁ Corporate, password authentication ◁ Second factor ◁ Location-independent ◁ Public key authentication ◁ No shared keys ◁ Integrated with security “zones” such as cloud accounts and security groups Identity hand-off
- 13. ssh Corporate Password Authority ssh Bastion Service A Service B ssh Public key and systems authz authority
- 14. Apply intelligent use of openssh and PAM ◁ Public keys available as a network service ◁ Granular authorization via PAM ◁ Automatic audit of login/logout events
- 15. Use Bastions to create security zones ◁ Dedicated admin bastion(s) for access to management services such as Chef/Puppet server, log server, Conjur ◁ General-purpose bastions for access to everything else ◁ Let the back-end authz system provide most of the access control
- 16. Zero-Trust Server Management Boston DevOps August 2014