Zero Trust Strategy and Roadmap
defense.gov
defense.gov
1.6 Behavioral, Contextual ID and Biometrics & 7.4 User and Entity Behavior Analytics - focus monitoring/auditing on accounts that all of a sudden transfer 10GB data when they usually only transfer only 100MB/day, or where the employee has had to be asked for that one time of the year to login on a weekend at an office they don't usually visit.
5.1 Data Flow Mapping - detect unexpected egress of data by defining ahead of time the volumes of data being transferred between systems (e.g. 2AM backup transfers 100GB to systemX and between 9AM-5PM there is a usual data transfer rate of 1MB/s therefore 100MB/s transfer rate at 1PM would raise an alert).
How well do these techniques work in practice, particularly in a huge organisation? I would have thought the number of false positives would be very high and the people monitoring the anomalous behaviour wouldn't have much or any context to know whether something is legitimate or not.
A more feasible approach may be system owners installing a new system would have to specify rate limits (including per time of day, per API call and/or per user) and would have to lodge as part of a change request whether these limits need to be temporarily increased to cater for a one-off or rare event such as a major system upgrade. But given that some of the other techniques listed indicate a lack of awareness of what software is installed and is in use, it seems unlikely that specification of rate limits would happen any time soon.
At $dayjob I have access to the Azure Active Directory "unusual user activity" security alerts in an environment with about 15K staff.
In my experience, the reports are accurate, in the sense that they get triggered as advertised by mis-use of IT resources. However, 95% of the time it's just staff being "naughty" instead of actual hackers.
For example, the "impossible travel" one gets triggered regularly. About 80% of the time it's because someone forgot to turn off the VPN they use to watch foreign Netflix. The other 20% of the time is because they were sharing credentials, which is against every IT security policy ever.
Even just the use of a VPN by itself is red flag. VPN providers are notoriously untrustworthy, many of them teetering on the edge of being outright malware. Certainly they all collect far too much metadata and sell it to the highest bidder. No such VPN product has any legitimate use on a corporate device.
Not to mention that corporate traffic is now looping out of the country into another country and back for no good reason...
You’d like to think so, but...
So instead of hiring the same constant number of security monitors/auditors independently of the organization size, can't you "solve" this problem by hiring one per every N employees, and having them monitor solely that group?
It sounds to me like either this solution should work (a "large" organization should be able to afford this!), or the problem isn't really related to the size of the organization.
Additionally, security is one of those things it's hard to get C-suite execs to pay attention to and spend money on. When it's working, you don't notice it. And if your 5 person security team has worked fine for the past 5 years as the org has grown, why should you suddenly scale it up to 10? Everything is fine! That is...until it isn't. But rarely do people think ahead like this.
Defense Logistics Agency in 2018 reported 264 applications in use, which was down from 1200 in 2013[1]. DLA only represent about 0.9% of the total DOD workforce[2] and it appears the application reduction could be due to consolidation of applications together, making application counts appear better but not doing much to reduce true complexity.
Given many systems have a single subject matter expert (or sometimes none), what is a cyber security analyst responsible for 100's of applications going to be able to reason about an event raised from a system with a name as vague as "DLA Action Item Tickler Report"? Was Bob OK to send the XY12 report via e-mail to Oscar? Who knows? It's likely no one has asked that type of question before and the only person who knows enough about the system to answer the question is the person who caused the event to be generated.
Some organisations are quite simple (despite having similar finances and employee counts) because they largely consist of simple repeatable processes performed by 1000's of employees using a single software product. Some organisations (particularly the DOD) are very complex because every employee is doing something unique across 100's of different software products.
[1] https://www.dla.mil/About-DLA/News/News-Article-View/Article...
[2] https://en.wikipedia.org/wiki/United_States_Department_of_De...
For one part of the org, occasionally doing 100x data transfers may not be out of the ordinary, while for others it may be exceptional. But it might be anomalous if its 100x data transfer and hitting services no one on your team has ever hit (indicating perhaps scanning/scraping and exfiltrating data, but you don't need to explicitly specify that as an alert).
As I tell people, "We don't care if you browse Reddit, we only care if you start doing things an employee shouldn't".
But to answer your questions we would just ingest those alerts into Splunk, build a KB on how to handle the alerts when they trigger and then begin the process of filtering out the noise. The SOC Analyst who works these alerts will get numb to them but still pick out the unusual ones to investigate.
Aah yes, Splunk....
Good tool, but realistically only viable for those working for a corporate-sized employer with corporate-sized pockets filled with $$$$$$$.
Most people can't afford to simply dump it all into Splunk and (if they are using Splunk at all) have to pre-filter first. Which kind of defeats the point of Splunk if they're already doing the hard work outside, and so might was well use some cheaper (F)OSS tool.
Right now it's 100% free, because I'm just looking for user feedback. I think/hope there is an opening in the market for folks looking for an easy-to-use, but powerful tool like Splunk, but can't afford their hefty price tag. All feedback welcomed!
Also created an open-source ETL tool: https://log-ship.com
Like this:
I log into system foo-bar-baz, which one person accesses once or twice a year. Maybe it's christmas setup, maybe it's for daylight savings time, maybe it's for a new release of Ubuntu, whatever. I have all the relevant credentials, I am responsible for foo-bar-baz, and I have an authorised change request.
Three days later, the security team sends me a slack message, asking if I accessed system foo-bar-baz.
I tell them yes.
This statement from the actual PDF really is telling for how far the DoD has dropped the ball on protection- maybe spend less time fleshing out offensive capabilities and more time on defense of your citizens?
It's a wild time, I'm telling you
There is literally nobody on earth more qualified than me than me to make the statement I did.
With our budget the two are not mutually exclusive
Everyone seems to think they need super ninja threat intel to protect them from elite nation state hackers, meanwhile they’re being randomware’d with metasploit modules from 8 months ago.
Run A/V and patch, that’ll be $1.7million, thanks.
Did you forget what you wrote?
What do you mean? The US should invest in cyber defenses instead of fighter jets?
It's gotten so bad, that their recommendations for crypto are regarded with a significant degree of skepticism because of past history of deliberately undermining crypto systems which is a Terrible state of things.
Indeed. Once you start talking about magical constants and extremely convoluted math concepts... that's zero trust in my book.
Integer factorization is a grade school concept in most developed nations. The edge cases are far more obvious than with something like ECC, which has entire classes of no-good constants that would require a PhD in math to fully grok.
I agree that the security environment is awful, but that doesn't excuse NSA making it worse.
The whole industry and economy needs to be upleveled software wise in a lot of ways for meaningfully better security to be economically possible.
Typically that requires a serious crisis and/or war. Hopefully not the case here.
Of course it does. Thinking about it in terms of ROI doesn't consider externalities. When the OPM gets hacked, nobody at the NSA worries about their budget.
Reason #7893 "run government like a business" is a self-describing category error.
The underlying issue is that large organizations have low trust (some worse than others!), and therefore large organizations tend to coarse numeric metrics, and game those metrics to look better, which makes even more low trust (and hence backstabbing, empire building, etc.) between divisions.
As a reaction, leadership also tends to err towards coarse, harder to game metrics (like ‘reduce breaches by xx%’ rather than relying on judgement and trust like ‘ensure we don’t have an unreasonable number of breaches, and work to reduce them in the ecosystem’.
Which of course provides strong incentives for chasing the number by throwing all the babies out with the bathwater, and often making the real problem worse.
It’s a size of the organization problem. Changing metrics/mission will shuffle up the specific babies being thrown out, and what is considered the bath water, but the underlying problem remains.
Solid, consistent leadership makes the problem better. That tends to be expensive and not want to deal with the political BS common in Gov’t, at least in the US.
Someone looks at it and goes ‘yeah, that might pay off’ or round files it somewhere.
Researchers who never end up finding anything notable also don’t tend to have long careers, correct?
The crazy amount of skepticism this always draws is simultaneously very funny and very saddening.
What percentage of the overall budget do you think it is?
If you think tech workers have office BS to complain about, gov’t workers are at least 10x higher on the scale.
> No it's just that the NSA used to work to make American companies more secure
1. I'm interested in that history; e.g. how it came about and how it worked.
2. Evidence that this is no longer (or less of) a goal: policy, internal priorities, spending? Congressional testimony, legislation, or guidance? Leaks?
Knowing what your adversaries are up to is invaluable.
https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-Z...
Sounds like you're getting the message just fine!
What they're talking about here sounds more like things that ought to be obvious but the industry got lazy about.
Zero-trust means that Access Control is more finely-grained, down to the machine/user level. In this approach we don't trust any machine/user inside the organization as well.
What they are talking about here is the more common understanding.
Hot take: real innovation is finding the right person’s metaphorical arm to twist to get enough leverage to get the tech implemented. The tech is the easy part. Bureaucracy hacking is underrated.
I'm happy to see this admission lead the document; it's bold coming from an org as conservative as the DoD. To see critical mass around the idea that -- like it or not -- adversaries (both malicious insiders and outsiders) are already on trusted networks is really encouraging to see.
First, let's be clear what this document is and isn't.
> Importantly, this document serves only as a strategy, not a solution architecture. Zero Trust Solution Architectures can and should be designed and guided by the details found within this document.
This is a long term strategy doc, not an implementer's guide. Operators looking for zero-trust easy mode won't find it here. It's also very DoD specific.
But there are some good parts. I read the doc so (maybe?) you don't have to.
I made some screenshots of the portions I thought most relevant.
The comments will make more sense if you are viewing those.
> Zero Trust uses continuous multi-factor authentication, micro-segmentation, advanced encryption, endpoint security, analytics, and robust auditing, among other capabilities, to fortify data, applications, assets, and services to deliver cyber resiliency. The Department is evolving to become a more agile, more mobile, cloud-supported workforce, collaborating with the entirety of DoD enterprise, including federal and non-federal organizations and mission partners working on a variety of missions.
If you somehow managed to read the above without going into a post word salad coma, I'm sorry. I highlighted the section just to bring up there's an awful lot of enterprise security buzzword and DoD acronym bingo going on. But there are some good thoughts too.
> Zero Trust is much more than an IT solution. Zero Trust may include certain products but is not a capability or device that may be bought.
It's nice to hear this being reiterated so often. A good start!
> Zero Trust security eliminates the traditional idea of perimeters, trusted networks, ...
Zero trust is -- to me at least -- mostly about the idea of removing perimeters and trusted networks as the basis for trust and access control. So I'm with you so far.
> ... devices, personas, or processes and shifts to multi-attribute-based levels of confidence that enable authentication and authorization policies founded on the concept of least privileged access concept of least privileged access
But it's interesting here that the authors are also calling out and devices, personas which is what I'd argue are the fundamental contextual attributes that allow you to replace a "trusted perimeter"; if we aren't using perimeters, devices, personas... what is the DoD suggesting we use? I can't find it.
> At its core, ZT assumes no implicit trust is granted to assets or users based solely on their physical or network location (i.e., local area networks versus the Internet) or asset ownership (enterprise or personally owned).12
I strongly agree with the first point, but disagree and am perplexed by the second. Zero trust is all about getting rid of a trusted network location.
However, asset ownership *matters* because it affects not only the identity of the user, but also the _state_ of the device. It's totally reasonable to have different levels of trust for a managed company owned device with a known set of endpoint protection tools, vs a BYOD device whose device state is largely unknown.
The doc does a good job of outlining the "Why" of zero trust. And what's required from an org to make it possible.
Unfortunately, while the document starts out strong, it quickly becomes "actually, zero trust is every security thing you've ever heard of". Paired with a timeline no one will ever meet ever.
For example, if we state we want to have zero trust in the network, we can achieve this by switching from authenticate/authorise-after-connect (i.e., how TCP/IP/almost every network is built), to authenticate/authorise-before-connect. This is achieved with strong identity (e.g., x509) and an overlay network built on zero trust principles which further provides us microsegmentation, least privilege, etc. It allows us to close all inbound ports and make access decision at the source (rather than destination) edge (e.g., device/user) and close all inbound ports. This makes many MITRE attacks impossible and massively reduces the affect of others. We can have zero trust in the WAN/internet (no inbound ports), LAN and even host OS.
Identity always involves trust and is authn. Zero-trust assumes authn is already compromised (ie. don't trust anything) and therefore identity is out of scope.
Zero Trust is not assume everything is compromised and you dont trust anything. Its about reducing implicit trust across the pillars to reduce risk.
Bad bot.
Now I really want to know the DoD's definition of basic vs. advanced encryption. Is there a middle tier, like average encryption?
I.e. is it just another 'practice' marketed to solve an existing people and process issue that can be readily solved with proper focus , which just introduces its own issues anyway? Like sure, zero trust will work IF you do it really well, but then so will the existing environment.