OSMC 2019 | Zero Trusted Networks – why Perimeter Security is dead by Jochen Kressin

SEARCH GUARD
ZERO TRUSTED
NETWORKS
© 2018 floragunn GmbH - All Rights Reserved
OR: WHY PERIMETER
SECURITY IS DEAD

ABOUT ME
Jochen Kressin, Co-Founder of floragunn GmbH
Makers of Search Guard
Enterprise Security Suite (and Alerting) for the Elastic Stack
Founded 2012
Main office: Berlin, Germany
Partner offices: Seattle, New York, Miami, Bordeaux, Mexico
01.

WHY THIS TOPIC?
I talk a lot to customers that are using Elasticsearch
Most of them store sensitive data inside Elasticsearch
Personally identifiable information: User- or customer data
Financial information: Transaction data
Healthcare information: Patient data
Elasticsearch does not /did not offer security out-of-the-box
Natural question: How do you secure Elasticsearch?
Answers are scary …
02.

ANSWERS
03.
Evil Internet
Sensitive Data
Elasticsearch
“It’s unprotected”
Elasticsearch
“Firewall”
Elasticsearch
“VPN and Firewall”

PERIMETER SECURITY
04.
Elasticsearch
Evil Internet Firewall Loadbalancer Data Lake
HTTPS HTTPS HTTPS HTTP
“Untrusted” “Trusted Perimeter”

ASSUMPTIONS
Traffic from the outside cannot be trusted
Traffic inside the perimeter can be trusted
Access to the perimeter can be controlled
Consequences
VPNs, firewalls and loadbalancers are sufficient
At any point in time, we know who has access to the data
Traffic inside the VPN does not need to be encrypted end-to-end
Performance is more important than encryption
Security breaches will be detected
05.

MAIN QUESTION
06.
Does perimeter security (still) work?
If it works, why do we still suffer
from security breaches and data loss?

REALITY CHECK
Data breach @ Exactis [1]
Close to 340 million personal records leaked
Phone number, home address, number, age and gender of children
“It seems like this is a database with pretty much every U.S. citizen in it”
Elasticsearch cluster publicly accessible
Perimeter not secured at all
[1] https://www.pymnts.com/legal/2018/exactis-data-breach-class-action-lawsuit/
07.

REALITY CHECK
Data breach @ Apple [1]
Customer data stolen from Apple internal database
By 22 companies working as distributors in China
Sold on Chinese black market for 7 million USD
Access to internal data granted for business partners
Attacker inside the Perimeter
[1] https://www.nytimes.com/2017/06/09/business/china-apple-personal-data-sold.html
08.

REALITY CHECK
Data breach @ Best Western [1]
Customer booking details leaked
Autoclerk, a hotel reservations system exposed 179 GB of data
Data of external client platforms exposed as well
Name, date of birth, home adress, travel dates
Unsecured Elasticsearch cluster hosted on AWS
One platform, multiple client data
How is perimeter defined?
[1] https://siliconangle.com/2019/10/21/customer-data-best-western-hotels-exposed-massive-data-breach/
09.

REALITY CHECK
Data breach @ Yves Rocher [1]
Data of 2.5 million Canadian customers of Yves Rocher exposed
6 million orders exposed
Names, home adress, phone number, email
Internal data: Store traffic, turnover, orde volumes
Unsecured Elasticsearch cluster set up / operated (?) by Aliznet
“The data breach impacts Aliznet’s clients who placed their trust in the company to protect their sensitive information. One
concern is that Aliznet may have other unsecured databases and applications that haven’t been discovered yet. That means
other clients of Aliznet may be at risk.”
[1] https://threatpost.com/data-leak-impacts-millions/147908/
10.

REALITY CHECK
Data breach @ OneLogin [1]
Password and identity management platform
Attacker obtained keys for AWS hosted platform “from an intermediate host”
“Attacker may have obtained the ability to decrypt some information”
Customers have been advised to …
… change all passwords, create new OAuth tokens, create new certificates
One stolen key to rule them all
[1] https://www.zdnet.com/article/onelogin-security-chief-new-details-data-breach/
11.

FIRST REACTION
12.
Dumb admins are too stupid
to protect sensitive data
Really?
Perimeter security is broken

WHAT HAS CHANGED?
Access control
Partners, distributors, freelancers, part-time contractors etc.
These are all potential inside threats
Locations
Remote offices
Remote workers
Devices
Laptops, smartphone, tablets
Bring your own device
13.

WHAT HAS CHANGED?
Cloud computing
Cloud storage
Microservices
SaaS / PaaS / IaaS
Containerization
Docker, Kubernetes etc.
How to apply IP-based security?
Decentralized systems / clusters
Internet of things
14.

WHERE IS THE PERIMETER NOW?
15.
Office
Internet
Aynwhere
Cloud Storage
SaaS
PaaS
Elasticsearch
Datacenter

PERIMETER SECURITY REVISITED
16.
Elasticsearch
Evil Internet Firewall Loadbalancer Data Lake
HTTPS HTTPS HTTPS HTTP
“Untrusted” “Trusted Perimeter”

ZERO TRUSTED NETWORK
17.
Office
Internet
Elasticsearch
Aynwhere Datacenter
Cloud Storage
SaaS
Cloud Storage
“Untrusted”

FACT CHECK
Companies do not have full control anymore
Explosion of devices and locations
Data and services are moving to the cloud
Internet of Things
Inside attacks are ever increasing
60% of attacks originated from the inside (IBM study 2016)
Attacks via social engineering
Angry employees, partners, freelancers etc.
Lines between inside and outside are blurry at best
18.

PARADIGM SHIFT
No traffic can be trusted
Regardless where it originates
Regardless from which device
No IP / port / application can be trusted
Cloud, containers, IoT
Traditional firewall approach flawed
No user can be trusted
Beware of inside attacks
Outside personell
19.

PARADIGM SHIFT
Move security to where the data lives
No unsecured services
Not even in a VPN
No unencrypted traffic, anywhere
Not even in a VPN
Assume attackers are already in your network
Never trust, always verify
Apply least privilege strategies
Inspect and log all traffic
20.

UNENCRYPTED TRAFFIC: CLIENT ACCESS
21.
Internet / Office / …
HTTPS
Data Lake
Elasticsearch
HTTP
Proxy / Loadbalancer
Terminates TLS

ACCESS CONTROL OUTSIDE DATASTORE
22.
HTTPS
Data Lake
Elasticsearch
HTTPS
Proxy
TLS Passthrough
Implements ACL
URL based
Index Alias
Wildcard index names
Date math index names
Bulk API
Multi Get / Multi Searc
https://sgssl-0.example.com:9200/mydata-*/_search
https://sgssl-0.example.com:9200/mydata/_search

UNENCRYPTED TRAFFIC: INTER-CLUSTER
23.
Node 1
Elasticsearch
Elasticsearch
Elasticsearch
Node 2
Node 3
HTTPS
Proxy / Loadbalancer
TLS Passthrough
HTTPS

UNENCRYPTED TRAFFIC: INTER-CLUSTER
24.
Node 1
Elasticsearch
Elasticsearch
Elasticsearch
Node 2
Node 3
Elasticsearch
Evil Node
Data Replication
Data Replication

NO AUDIT LOGGING / MONITORING
25.
Node 1
Elasticsearch
Elasticsearch
Elasticsearch
Node 2
Node 3
Evil Employee
https://sgssl-0.example.com:9200/logs/_search
What data has been accessed?
When has it been accessed?
Who has accessed it?

LEAST PRIVILEGES
26.
Node 1
Elasticsearch
Elasticsearch
Elasticsearch
Node 2
Node 3
Evil Employee
https://sgssl-0.example.com:9200/*/_search
What data has been accessed?
When has it been accessed?
Who has accessed it?

APPROACHES
Identify the protect surface
most critical data, assets, applications and services (DAAS)
Map the transaction flows
interdependencies between the DAAS, infrastructure, services and users
Build a Zero Trust architecture
move controls as close to protect surface as possible
Create Zero Trust policy
Least privileges approach
Monitor and maintain
27.

THE MICRO-PERIMETER
“Move controls as close to protect surface as possible”
as close to the data and services as possible
every device, every data source
effectively creating a “Micro-Perimeter”
Micro-Permieter moves with the protect surface
28.

29.
Micro Perimeters
Elasticsearch
THE MICRO-PERIMETER
Elasticsearch
Perimeter

CHALLENGES
It’s a concept, not a blueprint
Everybody is talking about ZTN, but here is no agreed-upon general definition
Paradigm shift
No single technical solution
Diverse infrastructures, diverse technologies, no one size fits all
Processes matter
Least privileges approach
Costly
But: Data breaches more costly
30.

EXAMPLE: ELASTICSEARCH
31.
Any location
Any device
HTTPS
Validate certificates
Hostname verification
DNS Lookups
Authentication
Certificate revocation
TLS
Role-based access control
Least privilege approach
No defaults
RBAC
Document-level
Field-level
Filtering
Anonymization
Data Audit
Logs
Track access
Monitor anomalies
Alerting
Data Lake
Elasticsearch

MAIN TAKEAWAY
32.
Trust no one
Assume the attacker is
already in your network

SEARCH GUARD
info@search-guard.com
send us a message:
34

floragunn GmbH
Tempelhofer Ufer 16
D-10963 Berlin, Germany
 
E-Mail: info@search-guard.com
Web: search-guard.com
Managing Directors: Claudia Kressin, Jochen Kressin 
Registergericht: Amtsgericht Charlottenburg  
Registernummer: HRB 147010 B
E-Mail: info@floragunn.com
Search Guard is a trademark of floragunn GmbH, registered in the U.S. and in other countries.
Elasticsearch, Kibana, Logstash, and Beats are trademarks of Elasticsearch BV, registered in the U.S. and in other countries.
floragunn GmbH is not affiliated with Elasticsearch BV.

OSMC 2019 | Zero Trusted Networks – why Perimeter Security is dead by Jochen Kressin

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to OSMC 2019 | Zero Trusted Networks – why Perimeter Security is dead by Jochen Kressin

Similar to OSMC 2019 | Zero Trusted Networks – why Perimeter Security is dead by Jochen Kressin (20)

Recently uploaded

Recently uploaded (20)

OSMC 2019 | Zero Trusted Networks – why Perimeter Security is dead by Jochen Kressin