Security breaches pervade the headlines. What was seen as a rare instance just 5 years ago now seems to occupy the daily news cycle. A lot of these data breaches are made possible due to missteps and misconfigurations. There are many security issues that are introduced into website authentication mechanisms that further compound the security issues in addition to enforcing bad behavior by the end users. Security debt is a real problem for the vast majority of organizations in the world today and the attackers will utilize this to their advantage. Find out more presentations at https://madrid2018.codemotionworld.com/speakers/

1. Zero Trust & The
Flaming Sword of
Justice
Dave Lewis, Global Advisory CISO
December 1st, 2018

2. Please Allow Me To Introduce
Myself..

3. #WHOAMI
Dave Lewis, Global Advisory CISO

12. What is Zero Trust?
● Where/how/when trust is decided has changed
● Must continuously verify
● Assume all networks are hostile
● This is not a “rip & replace” conversation

14. What is Zero Trust?
● 2007 - Jericho Forum
● 2010 - John Kindervag, coined term ‘Zero Trust’
● 2014 - Google BeyondCorp
● 2017 - O’reilly Zero Trust Networks

16. What is BeyondCorp?
● 2014 - Google BeyondCorp paper
● 2016 - Google BeyondCorp
progress update
● 2017 - BeyondCorp migration, user
experience and lessons learned

17. Focus on securing access to the application by verifying
the user, inspecting the device and context
Coverage for all apps including SaaS apps outside the
corporate network.
FW
Focus on securing access to the network by
inspecting the device.
Traditional perimeter approach “Zero Trust” approach
NAC

18. The Magic Triad
Apps
Users
Visibility
&
Policy
Devices

19. How Do You Establish Trust
Easily and Effectively?

20. ZTN

21. ZTN It’s On Fire Yo!

23. Castles Don’t Scale

24. Don’t trust something just
because it’s on the
“inside” of your firewall

26. Is the password…password?

27. No!! Now go away, or I shall taunt you a second time!

28. Lessons
From History
The sack of Rome in 410 AD

29. Remember when you
only had to outrun
the other hiker?

30. Now there’s more
than enough bear to
go around

31. The Flaming Sword of Justice

32. Data Breaches

33. In The News…

34. 81%
Of breaches involve stolen
or weak credentials
70%Of breaches involve
compromised devices
Sources: 2017 Verizon DBIR, 2016 IDC Research

35. Porous
Perimeter VPN
RDP
DNS EMAIL
HTTP(S)

36. Perimeter?

37. “The perimeter is anywhere an
access decision is being made.”

38. New Perimeter
Old PerimeterCloud Applications
Hybrid Cloud
Personal Devices
Vendors &
Contractors
Mobile Devices
Remote Employees
Traditional Network:
Endpoints, On-site Users,
Servers, Apps

39. The Summer of Breach 2012

40. Been There…

41. TWO YEARS AGO…

42. …AND NOW

43. What’s Open In Spain?

44. 5,894,829

45. Meanwhile, In Madrid
856,975

46. So, Why Should We Be Concerned?
Open Webcams Compromised
Databases
168 64 3,829
Industrial Control
Systems

47. Hola!

48. ZTN Value
Proposition
● Devaluation of stolen credentials
● Low hanging fruit sours.
● Complicates lateral movement
through uniform security policy.
● Attackers have to work that much
harder.

49. Unified Access
Security, Value
Proposition
● Devaluation of stolen credentials
● Low hanging fruit sours.
● Complicates lateral movement
through uniform security policy.
● Attackers have to work that much
harder.

50. Bastion Hosts

51. From DMZ To The Soft Chewy Centre

52. Setting Expectations

53. Aspire to a Zero Trust Network

54. A Game of Increments

55. Determining Priorities

56. Zero Trust
Shopping List
● Asset Inventory.
● User Management.
● Device Management through uniform
security policy.
● Defined Repeatable Process.
● User and Entity Behavior Analytics.
● Network Zone Segmentation.

57. Unified Access
Security
Shopping List
● Asset Inventory.
● User Management.
● Device Management through uniform
security policy.
● Defined Repeatable Process.
● User and Entity Behavior Analytics.
● Network Zone Segmentation.

58. The Authentications Must Flow

59. Supply Chain Security

60. Partner Network, Meet The Pentest

61. SSH

63. A Better Way Forward

64. Webauthn

66. Zero Trust True-isms
• Assume the network is hostile
• Establish a trust engine
• Reduce threat surface
• Continuously validate for authorization
• KISS

67. ZTN
Summary
● Build an asset inventory.
● Get a solid hold on user
management.
● What’s on your network?
● Defined Repeatable Process
● User and Entity Behavior Analytics.
● Network Zone Segmentation.

68. ● Build an asset inventory.
● Get a solid hold on user
management.
● What’s on your network?
● Defined Repeatable Process
● User and Entity Behavior Analytics.
● Network Zone Segmentation.
Unified Access
Security
Summary

69. The Sword Is Dissolving

70. No Need For The Holy Hand Grenade

72. Gracias!
gattaca@duo.com
@gattaca
www.duo.com