Everything old is new again or so goes the cliché. This presentation will take the attendee through the industry’s “re-discovery” journey of the principles associated with Zero Trust and help them weather the coming tsunami of FUD and marketing hype, while enjoying the security benefits the approach provides. Disappearing perimeters and workloads that are migrating to the cloud necessitate a change. Complete Zero Trust might be the way forward. The speaker will discuss “latent” capabilities that exist in most environments and field proven techniques for exploiting them for the benefit of the organization without the need to purchase more “stuff".

1. TRUST VS CONTROL - COMPLETE ZERO TRUST
“TRUST NO ONE THING”

2. SPEAKER
 Host of the annual Dayton Security Summit http://www.day-con.org
 Creator of Packetwars™ the world’s first cyber sport
 Facilitated Innovation & Structured Choice practice lead
 SANS GIAC/GSEC Gold published author
 Trusted Advisor & “Herder of Cats”
 @BryanFite
Global Account CISO at BT
BRYAN K. FITE
©2019CROWDSTRIKE

3. SYSTEM CONFIDENCE
©2019CROWDSTRIKE
TRUST & CONTROL
CONFIDENCE=

4. “THE PERIMETER IS DEAD…”
©2019CROWDSTRIKE
Radical
Thinking?
(Digital)Identity is the new perimeter

5. “LONG LIVE THE NEW PERIMETER”
©2019CROWDSTRIKE
Radical
Thinking?
(Digital)Identity is the new perimeter

6. “EVERYTHING OLD IS NEW AGAIN”
©2019CROWDSTRIKE
2000
2010
2005
2015

7. DRAFT NIST SPECIAL PUBLICATION 800-207 - ZERO
TRUST ARCHITECTURE
©2019CROWDSTRIKE
An operative definition of ZTA is as follows:
“Zero Trust Architecture (ZTA) provides a collection of
concepts, ideas, and component relationships
(architectures) designed to eliminate the uncertainty in
enforcing accurate access decisions in information
systems and services.”
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207-
draft.pdf

8. THE SECURITY MATURITY JOURNEY
©2019CROWDSTRIKE
Naked SDWANNaked SDNBusiness Transforms with
No Security Investment
Traditional
Security
Investment with
No Business
Transformation
Traditional Security Investment
+ Business Transformation
Micro Segmentation, & Maturing CICD
with virtualisation & containerisation
+ Business Transformation
Naked SDWAN/DIA
Naked BYOD / Mobility
Complete Zero Trust Architecture
+ Business Transformation
Cloud-based SecurityInvestment
+ Business Transformation
100% Protected, 0% Attack Surface *Theoretical!
Cloud Adoption
Mobility Adoption
…Business Transformation
done to you
…Security
Transformation
done by you
Complete Zero Trust
OT Networks
No Naked Networks
On-prem
approach
Low
Cloud
Uptake
Medium
Cloud
Uptake
High
Cloud
Uptake
On-Prem
Virtualised
Multi-Cloud
Architecture
Cloud First /
Cloud Native
Corporate Servers
only
Corporate Laptops Corporate Mobiles BYOD

9. THREATS EVOLVE – ORGANIZATIONS MUST TOO
©2019CROWDSTRIKE
$3.92m
34%
Average total cost
of data breach1
Percentage of
breaches due to insider
threat
25,575
Average number
of records stolen1
Endpoint
Workload
Outside = Untrusted
Work-
load
Work
-load
Work
-load
VPN Proxy
NGFW
IDS/IPS
MPLS Sandbox
SD-WAN
Virtualisation
Flow-based
AnalyticsIR/Forensics
Endpoint
Workload
Inside = Trusted
Workload
WorkloadWorkload
Current approach:
Perimeter-based security
Security procrastinators
Workload
Inside = Untrusted
Workload
Workload
Workload Workload
EndpointEndpoint
Workload
Workload
Workload
Endpoint
Workload
Outside = Untrusted
Work-load
Work-
load
Work-
load
Complete Zero Trust

10. TIME FOR A CHANGE: COMPLETE ZERO TRUST
©2019CROWDSTRIKE
Trust no one & nothing
Authenticate & Validate
Complete & Dynamic Access Policy
Workloa
d
protectio
n
End
point
protectio
n
Visibility
Analytics
Control
Authentica
tion
The new realities Zero Trust tenets The BT way: Complete Zero Trust
Network is always hostile
Effectively no perimeter
Static rules vs. dynamic threats

11. REASONABLE RESPONSE
©2019CROWDSTRIKE
Detect & predict
threats to
safety/quality,
security & privacy
Gain visibility
(& control)
Reduce your attack
surface
Deny adversaries
the ability to pivot
Respond in real-
time
Protect what
matters most

12. WORDS OF WARNING: PAUL SIMMONDS @RSA2019
©2019CROWDSTRIKE

13. CRITICAL SECURITY CONTROLS & “LATENT
CAPABILITIES”
©2019CROWDSTRIKE
CIS 20 CSC
Workload
Protection
NGFW IAM PAM DLP Encryption
URL
Filtering
Proxy EPP/EDR CASB IDS/IPS Anti-DDoS
Application
Shielding
Threat
Modeling
Effective
GRC
SD-WAN
Controls
Inventory of authorized devices
0.75 0.75 0.5 0 0.25 0.25 0.25 0.25
Inventory of authorized software 0.25
Vulnerability Assessment & Remediation 0.25
Controlled Use of Adminstrative Privileges 0.25
Secure Configurations 0.25
Audit Logs 0.5 0.5 0.5 0.5 0.5 0.5 0.5 0.5 0.5 0.5 0.5 0.25 0.5 0 0.5 0.5
Email & Browswer Proections 0.25
Malware Defenses 1 1 1 0.25
Ports, Protocols and Services 1 0.25
Data Recovery 0.25
Secure Configurations for Network Devices 1 1
Boundary Defense 0.75 0.75 0.5 1 1 0.25
Data Protection 0.5 0.75 0.25 1 0.25
Controlled Access Based on the
Need to Know 0.25
Wireless Access Control 0.25
Account Monitoring and Control 0.75 0.25 1 0 0.25 0.25 0.25 0.25 0.75 0.25 0 0.75 0.5 0.1 0.25
Security Skills Assessment 0.5 0.5 0.5 0.5 0.5 0.5 0.5 0.5 0.5 0.5 0.5 0.5 0.5 0.5 0.5 0.5
Application Software Security 1 0.25
Incident Response and Management 0.5 0.25
Penetration Tests 1 0.5 0.25 0.1 0.25
Visibility & Control
BASIC
Foundational
Organizational
Control Affinity Effectiveness Factor - 0, 0.1,
0.2…0.9, 1.0
Draft Version 2.0 - Bryan K. Fite
CIS20 CSC– Control Census &
Maturity• Threat Catalog –Threat Modelling&Simulation
• RBAC (Groups &Directories)
• ACLS &White Lists
• Netflow
• Segmentation, VPN’s, SSH& Micro segmentation
• Bastion Host
• Routing
• IPV6
Logs are yourfriend!

14. CROWDSTRIKE’S ROLE IN ZERO TRUST
©2019CROWDSTRIKE
Workload
protection
End point
protection
Visibility
Analytics
Control
Authenticati
on
• EndPoint Protection
• Zero Breach Mindset/Vision/ Guarantee
• Threat Intelligence andContext
• Machine Learning &AI
• Indicators of Attack (IOA)
• Force Multiplier
• IR: Containment andRemediation
• Visibility & Control

15. CONCLUSIONS

16. THANK YOU.
ANY QUESTIONS?
©2019CROWDSTRIKE