Presentation given at a CloudAustin Meetup on Dec 7th, 2017.

1. BeyondCorp: Closing the Adherence Gap
CloudAustin Meetup - Dec 7th 2017
Ivan Dwyer | @fortyfivan

2. The Adherence Gap: A Written Policy That Isn’t Enforceable In Practice

3. All Too Common Behaviors
● Sharing/committing passwords and keys
● Not revoking credentials when employees leave
● Giving contractors too much privileged access
● Connecting to resources using unpatched devices
● Not logging and/or monitoring user activity
● Not assigning role based access controls

4. What if instead of always blaming the user…
We engineer a solution that automates the
encouragement of making good choices?

5. Google Got it Right With BeyondCorp
1 Connecting from a particular network must not determine which services you can access
2 Access to services is granted based on what we know about you and your device
3 All access to services must be authenticated, authorized, and encrypted
Mission: To have every Google employee work successfully
from untrusted networks without the use of a VPN

6. A Zero Trust State of Mind

7. Redefine Corporate Identity
Is the user in good standing with the company?
Does the user belong to the Engineering org?
Is the user on Team A working on feature X?
Is the device in inventory?
Is the device’s disk encrypted?
Is the device’s OS up to date?
Identity = You + Your Device at a Point-in-Time

8. Make Smarter Decisions in Context
“You can’t submit source code from an
unpatched device”
“You can only reach the company wiki
from a managed device”
“Your disk must be encrypted to access
the confidential file repository”
“You can view the corporate phone
directory from any device”
Real-time trust attestation based on dynamic conditions

9. Remove Trust From the Network
Access
Controls
Why the request was denied
request context
NO
YES
Access
Policies
AuthN AuthZ
Centralize Layer 7 Authentication and Authorization

10. Eliminate Static Credentials
➔ Issue short-lived client certificates or web
tokens to initiate secure sessions
➔ Inject metadata about the user and connecting
device into the credential
➔ Limit each credential in scope and time,
making it near impossible to hijack
Dynamic attestation needs a dynamic credential to match

11. How To Get Started With Your Own Zero Trust Architecture

12. Collect Your Relevant Data
1 Take an inventory of all employee devices - workstations, laptops, tablets, and phones
2 Take an inventory of all company resources to protect - apps, databases, servers, etc.
3 Take an inventory of all static credentials - shared passwords, ssh keys, etc.
4 Diagram your system architecture and inspect traffic logs to understand behavior
5 Monitor device state - is the software up to date? Is the disk encrypted?

13. Write Job Stories to Understand Your Use Cases
Alice - Build Engineer
When a release is ready, I want to login to the build
server over ssh, so I can inspect the build logs.
Bob - Recruiter
When I arrive at the office in the morning, I want to login
to the ATS, so I can review the day’s applicants.
Behavioral patterns should influence how access is managed

14. Determine Your Policy Framework
➔ User attributes
➔ Device attributes
➔ Location-based rules
➔ Time-based controls
➔ Groups and Roles
➔ Team federation
➔ Resource specific rules
Trust Tiers
User and device metrics are analyzed and placed in a tier
which must match the minimum tier associated with the
resource
Scoring System
User and device metrics are compiled and granted a
score which must match the minimum level associated
with the resource
Assertions
User and device attributes and state are individually
matched against an Access Policy where all assertions
must be true

15. Implement the Access Controls

16. Recommendations
1 You don’t have to build the whole system yourself - leverage solutions for the hard parts
2 Be selective with the environments you support - operating systems, protocols, etc.
3 Start with simple global coarse-grained access policies before getting too fine-grained
4 Start migrating cloud native applications to the new environment first
5 Keep your network controls in place until the Layer 7 controls are fully implemented

17. The ScaleFT Access Fabric
a globally distributed real-time authorization CDN capable of
making intelligent trust decisions at the edge
Learn more at: www.scaleft.com/access-fabric

18. THANKS!!
Get in touch: ivan.dwyer@scaleft.com | @fortyfivan
www.scaleft.com
www.beyondcorp.com