Recommended
More Related Content
What's hot
What's hot (20)
Similar to Micro segmentation and zero trust for security and compliance - Guardicore and YouAttest
Similar to Micro segmentation and zero trust for security and compliance - Guardicore and YouAttest (20)
Recently uploaded
Recently uploaded (20)
Micro segmentation and zero trust for security and compliance - Guardicore and YouAttest
- 1. YouAttest Cloud-Based Auditing Webinar: AD Best Practices for Audit Featuring: Milton Keath Guardicore Micro-Segmentation and Zero Trust Webinar: Thur, May 27th 10am PT
- 2. Guest Speaker Milton Keah, Guardicore Sr. SE
- 3. • Introductions • What is Micro-Segmentation and Zero Trust? • How does Zero Trust relate to compliance? • Guardicore and Micro-Segmentation • YouAttest and Compliance • Short Demo • Q & A Agenda
- 4. What is Micro-Segmentation and Zero Trust? Milton Keath Guardicore
- 5. The Zero Trust Story Arc
- 6. Zero Trust Defined • Developed by Forrester in 2010 • Assumes that every user, device, system, or connection is already compromised • Requires extensive segmentation Zero Trust is strategically focused on addressing lateral threat movement within the network by leveraging microsegmentation and granular enforcement, based on user context, data access controls, location, app and the device posture” Dr. Chase Cunningham, Principal Analyst, Forrester @ Forrester Security & Risk 2019 Conference
- 7. Why Zero Trust Matters: A Real-World Example Fileless SSH worm P2P Botnet Novel (previously unseen P2P module) Aggressive Efficient
- 8. So Why Haven’t More Enterprises Implemented Zero Trust? 43% interested in implementing Zero Trust 63% say their organization’s legacy firewall does not enable Zero Trust across the enterprise 26% Only have already implemented Zero Trust
- 9. How Are Security Vendors Adapting? Guardicore is charging into the Zero Trust space, with an approach to enabling Zero Trust that is emblematic of the largest players…” • Zero Trust Workloads • Visibility and Analytics • ZTX Vision and Strategy • ZTX Roadmap and Differentiation • Portfolio Growth Rate Guardicore named “Strong Performer, achieved highest scores possible in 7 criteria, including:
- 10. Five Steps to a Systematic Zero Trust Architecture Identify Your Sensitive Data Map the Flows of Your Sensitive Data Architect Your Zero Trust Microperimeters Continuously Monitor Your Zero Trust Ecosystem with Security Analytics Embrace Security Automation and Orchestration 1. 2. 3. 4. 5.
- 11. Zero Trust and Compliance Garret Grajek, CEH, CISSP YouAttest, CEO
- 12. Tenants of Zero Trust 1. Enforce Authentication and Authorization 2. Maintain data integrity 3. Gather data for improved security 4. Consider every data source and computing device as a resource 5. Keep all communication secured regardless of network location 6. Grant resource access on a per-session basis 7. Moderate access w/ a dynamic policy
- 13. Requires regularly schedule user and access reviews. Asset owners should review user’s access rights at regular intervals. Specific Regulations: All Site Access Policies and Mandate Reviews SOX 404B ISO/IEC 27001 A.9.2.2.5 ✔ ✔ ✔ HIPAA requires regularly review of audit logs, access reports, and security incident tracking reports. HIPAA/HITRUST ✔ SOC 2 Type 2 Requires access controls in place for access to data and this access be reviewed. ✔ PCI-DSS PCI Requirement 7.1.1-7.1.4 – requires quarterly reviews of user accounts to verify roles and privileges
- 14. PR.AC-4 - Identities and access must be reviewed NIST PROTECT (PR) and Access Reviews Access reviews are performed semiannually by each application or infrastructure owner, to confirm that access is still required. Any exceptions found must be removed within ten business days.. (Appendix A: NIST CSF Internal Controls) Appendix A: https://link.springer.com/content/pdf/bbm%3A978-1-4842-3060-2%2F1.pdf
- 15. NIST PROTECT (PR) and Access Reviews The principle of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions/business functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary, to achieve least privilege. PR.AC-6 POLP - Principle of Least Privilege
- 16. Zero Trust Architecture: NIST Publishes SP 800-207 NIST publishes Special Publication (SP) 800-207, "Zero Trust Architecture." August 11, 2020 • Is a series of cybersecurity measures and guidelines highlighting the core components of Zero Trust principles. • It is NOT currently • A quantifiable list of mandatory to-dos for compliance • This is not what NIST does • NIST creates the standards • Legislatures and industry groups determine to make regulations • Often use NIST standards as guidelines NIST and Zero Trust
- 17. What is Micro-Segmentation and Zero Trust? Milton Keath Guardicore
- 18. 1 – Identify Your Sensitive Data
- 19. 2 – Map Flows of Your Sensitive Data
- 20. It’s Time to Rethink Firewalls Data Center Cloud The old way • Tied to environment and network • Different approaches for different environments / technologies • Slow and difficult to change • Network-centric policies • Software-only approach • One set of security policies that work everywhere • Easy to visualize and change • Workload-centric policies The new way Faster Lower risk Lower costs Physical firewall appliances creating network choke points Virtual firewall appliances creating network choke points Data Center Cloud Software-based policies based on finer-grained attributes (e.g., process, user, fully-qualified domain name) Minimize hardware refresh cycles and overhead It’s Time to Rethink Firewalls
- 21. There is Now a Better Alternative Faster 45 applications 6 weeks No downtime Lower Risk Up to 99% attack surface reduction Lower Cost 85% TCO savings over legacy firewalls ere is Now a Better Alternative
- 22. 3 – Architect Your Zero Trust Microperimeters
- 23. 4 – Continuously Monitor Your Zero Trust Ecosystem
- 24. SECURITY CLOUD 5 – Embrace Security Automation and Orchestration VIRTUAL DESKTOPS AND APPS IOT IT AUTOMATION AND ITSM SOLUTIONS SIEM/SOAR IDENTITY & ACCESS MANAGEMENT INFRASTRUCTURE IGA
- 25. In Summary: Five Steps to Zero Trust Identify Your Sensitive Data Map the Flows of Your Sensitive Data Architect Your Zero Trust Microperimeters Continuously Monitor Your Zero Trust Ecosystem with Security Analytics Embrace Security Automation and Orchestration Fast and simple visualization identifies and classifies sensitive data and workloads Automated flow and dependency mapping creates a visual map of all flows to sensitive data Policy Engine and Wizards enable rapid definition of any segmentation/micro-seg mentation policy REST APIs and Orchestration Integration simplifies automation in any environment Real-Time Monitoring and Analysis quickly identifies security incidents and integrates with SIEM. Guidance Guardicore Capabilities
- 26. YouAttest and Identity for Micro-Segmentation Austin
- 27. Source: https://docs.microsoft.com/en-us/windows/win32/ad/domain-user-accounts A domain user account enables the service to take full advantage of the service security features of Windows and Microsoft Active Directory Domain ServicesWindow. Advantage • Domain user account is the service action are limited by the Access Rights and Privileges associated w/ the account Examples • YouAttest API key is associated to a domain-based service account • Where Read/Write privileges can be quantified Microsoft Recommendation: Domain User Service Accounts
- 28. Run a custom powershell script and upload AD Users and Group CSV
- 29. AD Audit attestation campaigns on Groups and Individual user.
- 30. Audit AD Groups and Users
- 32. Quick Demo
- 33. Best practice is to: • Many enterprises still use AD as store of record • Enforce and audit your network permissions YouAttest and Guardicore: • Repeatable access reviews quantifying • Roles • Groups • Permissions Micro-Segmentation and Zero Trust
- 34. Technology partner focused on aligning People, Process, Technology, and Data. • Business Outcomes • Customer Success • Experience / Approach Cloud Ingenuity Contact: shep@cloudingenuity.com www.cloudingenuity.com