Good evening everyone.
Thank you so much for joining us today here and welcome to the last session from Security
Devroom.
Let me start with a question.
How many of you think that the internet work within the premise or the organization
you are working is secured?
If you are unsure, you know that's why exactly I am here and all of you are here.
So my name is Ambidna.
I work as a senior staff member in IBM and I have all the way I have come here for first
them to gain knowledge to share knowledge with all of you from India Bangalore.
The first question comes is why you know zero trust rate.
So this is like a very, you know, moving from the traditional casselat mode model,
very it is considered that the perimeter based security approach no longer can apply.
Why zero trust is a very simple question and in that when you think about it, the rising
threat in form of the cloud involvement, in form of the remote work, in form of the various
you know, the perimeter less communication that we are having today, it is impossible to
have a perimeter based security in which anything beyond or within the within a premise, within
a network is considered as stored.
That is not going to work in today's environment and that is why the key drivers that are
driving the zero trust are something for example related to all the products slowly and
moving to the cloud environment.
We have the workforce which is not only you know, you can see them every day, it is all
you know consist of remote workforce and finally there are lot of regulatory compliance
that requires all our security controls to be very strong and to meet all of them,
to meet all of them we need to have the at least to have the attack surface limited
and to achieve that attack surface limited zero trust is the action which not only helps
you to reduce the surface by considering some of the factors but also have the impact
overall in case of breach less you know and then you know we will go through some of
the actionable items that will help you achieve zero trust in your work.
So in the left side you see the traditional perimeter based defense wherein the castle wall
actually represent the idea of security in which once you are beyond that castle you are
in a secured environment but now there is a concept of layered security in which you can see
that each and every point based on the context based on the behavior based on the you know various
factors the security is layered and you are being scanned to ensure that you are the right
person at the right time in the right context to access the information and the very very common
example is the modern security which is present in the airports these days each layer is actually
you are being scanned for your identity for your purpose and then finally you know for for the
future that you are going to do in in the airport. So this is how you know it it will look like
you have an application you have data you have compute you know very simple very normal you know
software environment. So all these enterprise network used to make a system or a process considered
as secured which is a traditional way I login to IBM network I login to a company network
in the secured zone but that is not going to work in today's era. In today's cybersecurity
environment you need to have various policy you need to have layered structure define per your
application the type of data that is going to be accessed and finally the type of compute resources
it is going to use. In this one of the very you know known example is from one of the vendor
actually what they try to do is to adopt zero trust they picked up the most critical data
in in any vendor management system the vendor data is will be the most critical information
and that was considered first which was made to be zero trust modern wherein admin the admin
who was doing the operation day in day out operation even that admin was not given access to the
data all the time when they had neat just in time they get access they do the work and then you
know that the access is no longer there with that the cost of the maintenance was reduced plus
the breach time was also reduced because the admin or the person who was supposed to do the
management they also do not have access to data all the time. Now think of you know the traditional
security as you keep your door locked maybe with the recent or you know very digitized lock
but keep all the windows open that is not going to help you know with respect to the modern
security in the traditional security you had implicit trust and that implicit trust is the one
rebel this zero trust will actually help to make this vulnerability convert into cyber resilience
and for that how how it does is it will stop or it will restrict the lateral movement it will
also help to reduce the insider threat limited we cannot have something like gone forever but
but what happens is the the implicit trust is what something which is exploited. I think earlier
in one of the sessions somebody mentioned that it is not that attackers are attacking from outside
they are logging into the system and that is where the zero trust actually you know gives you
principle to how to ensure that you know the situation where this whole boundary is blur how you
can achieve you know the security how you can address the modern challenges how you can have the
principle very simple principle of you know never trust always verify module very new continuously
monitor you you continuously authenticate and then only you actually allow that that you know
individual to access the system and finally you reduce the attack surface.
Now every breach tells us story so these three are three case study wherein first one is about
healthcare industry in that the identity was weak meaning even the MFA forget about the
complex password and policy the MFA itself was not adopted and that caused the you know the attack
actually weak access point the second example is on the research and development wherein you know
the perimeter base access was provided in the research and development environment and that caused
the attack and finally the critical infrastructure attack in the energy sector it was because
the network connectivity was compromised through the through vulnerability in the VPN itself
and that caused the you know some of the data to be leaked so you know understanding about
when we talk about modern security three pillars comes like a very prominent to be addressed first
is the identity setric protection then we have dynamic micro segmentation and finally continuous monitoring
so when I talk about identity synthetic protection we have all of the SSO you know single sign on
all I am management anything related to unauthorized access protection comes into picture here
the second pillar is your dynamic micro segmentation why we talk about dynamic micro segmentation is
you have considered you know you have divided your or into departments but that is not going to be
static is what it will not help you it has to be based on the network and application type
and at the runtime how the data is flowing how this critical data is flowing in your network and
that is what you have to dynamically micro segment your you know applications and finally it has
to be all real time it is not a one time project that is release and I am done you have to
real time actively monitor it using all idea tune which is possible do the behavioral analysis do
the correlation and then you can say that you know I am completely adopting to zero trust architecture
so in a typical zero trust architecture you have all type of user business user privilege user
they exist the corporate network through any you know endpoint protection mechanism you
have SSO and all of them in place once the user gets into corporate network they have these micro
segmentation in which based on their role they you know defined policy fireball eventually they
exist you know in this example it is an hybrid cloud and finally there are two important things
for monitoring your security operating system sorry team they are monitoring using it
idea all of the activities and then there are some security team data security team they manage the
keys they manage all the certificates so that you know you have even though you you are part
of the organization but your keys your tokens should all be valid to be used so talking about
framework is one thing but how it is being adopted is actually when the real story begins right
so let us talk about something on the numbers buys you know over 70% of organization they have
already on to zero trust principles by 2025 I am sorry for the little late data remote access
deployments are already you know 70% mark and finally when you see all these you know information
you cannot enforce anything to make it you know add more friction it has to come from as an
so it has to be divided that yes you are responsible to have this implemented you are
responsible to monitor it if I enforce it it will cause friction and that is not going to help so
that this is when you actually will you know think that my org my company my product is at what
level to adopt to zero trust implementation now how to implement it it has to be a phase wise approach
wherein we start with the high critical asset move to the core security principle where you bring
the all identity centric concepts you bring all of the micro segmentation you monitored them continuously
and then you eventually you know adopt it to other components that you would like to have zero trust
architecture it's not like a really really good idea that I give you some product or I give you some
process but I don't take input from the user who is going to basically use it right if I
don't make it seamless to more people are going to complain that you know security only is enforcing
lot of policies lot of regulations and lot of work on me how to make it seamless is so important
and that is when the user centric design even if it is a button it is a checkbox it is a radio
button it is a simple you know pop up all of them requires a user discussion and based on the
you know comfort label from the user that that design should is what we should be adopted
when we talk about you know that you know the seamless access I when I am in office I already
have crossed one of the authentication place and then only I reached office right I mean I might have
ID card or I might have some way to a six biometric data right so after I reach office my laptop
should not ask me 1000 of question before I actually start doing my work so it can be adaptive
but when I go to home office when I login from cafeteria or I know any cafe on weekend or my
relative space it has to ask are you really you know the person who is trying to access so these
are the thing that will help to give you seamless just in time access based on the perimeter
where you are operating your system and you know even even it goes for the adaptive authentication
wherein when you are in office environment when you are in home environment the various way
in which you are authenticated will give you more and more seamless access to the work that you are
trying to do and finally we cannot have like very complex graphical user interface or rest or anything
that makes the whole product so complex that you know people stop using it that is not the
intent here intent here is the security but intent also is to make the user experience very
you know friendly so that it is a popular product it is a you know helpful product and eventually
the user is actually appreciating the fact that I am getting a secure product even though you
know there are lot of zero trust principle which have provided to you so you know there are a few
things that we should keep in mind when we implement any zero trust we should not over complicate
the policy because at the end of the day the main goal is that we as a person you know authenticated
person I should have access to it there should be a strategy around that you know we should have
identity governance pick up the product which is like more very much clean clear or very near
to the product that you are going to implement it and finally there are lot of you know products
which are adopting AI based analysis AI based tools for the you know the correlation activity
or things like that that will help to achieve the you know future so just for a reference purpose
I have put 2 to 3 products here from the open source which which actually helps us to achieve
some of these steps that we discuss now for example 3 clock it will help you to achieve single
sign on it is provided by red hat and it has a very seamless integration with MFA and a several
identity federation tools the second one is about Poemorium it is identity of a reverse proxy it
also will provide you you know without the need of VPN but still you can achieve the secure
open cities another you know overlay network you know it provides a zero trust network which
is very helpful for you know stringent identity and context verification after that it allows
the user to log in and finally you know I think one of the session actually was in the
morning it talked about the whole monitoring thing right in that it is very important to get a
aggregated view I implement thousands of you know controls for you but how many of them are actually
useful how many of them are actually protecting any kind of breach is so important so that you can
invest your time money and energy into it rather than doing all the other things which actually
were not not doing much of help so all those you know such view you can get through ELK stack and
Elastic says log stash and kibana and all those stack will actually give you the view of all end point
how the things were accessed how various visualization of logs also can be done through that and
eventually it can be fed to any AI engine to actually you know give you any behavioral analysis in an
automated way now finally you know you understood the importance of zero trust you also have
you know phase wise implementation in place and then you will have some kind of balance in your
mind to bring that robustness into you know security attach it with smooth user experience and
finally it is not about like you know becoming too much of paranoia about you know zero trust
and how to get it in my product or things like that it is about little bit of you know
skeptical and think about security in terms of you know that it is going to it is to help us
but at the same time how to bring that trust through a process not you know through implicit trust
that will make you know this whole journey as a very easy to adopt to to easy to you know implement
about so always remember that the trust is very very expensive and breach they are always
helpless and if you think that zero trust is actually very you know difficult thing to explain or
understand just you know remember that it is very easy then explaining the any breach to your
senior executive so always you know keep a keep that in mind and let us try to have the
meter reading for this trust as zero so that is all I want to share to the thank you so much
for staying so late here and have a nice list of your day thank you we will get still some time for questions