The document discusses the implications of migrating to a Zero Trust security model. It compares the traditional "castle and moat" network model, where everything inside the network is implicitly trusted, to the Zero Trust model, which eliminates trust and focuses on least privilege access, microsegmentation, and risk analytics. While Zero Trust aims to restrict access, traditional security assessments still apply and can exploit obstacles to a true Zero Trust implementation, such as legacy systems. The document advocates for increased automation but also warns that APIs can introduce new attack vectors if access controls are not implemented properly. In conclusion, it emphasizes that Zero Trust does not replace existing security practices and that pure Zero Trust is difficult to achieve in reality.

1. Outpost24 Template
2019
Security Assessment:
Implications when migrating to a Zero Trust model
John Stock
26th June 2019

2. Helping customers improve security posture since 2001
Full stack security assessment
Over 2,000 customers in all regions of the world
Really good at breaking technology

3. Outpost24 Template
2019
Today’s topic
3
• Networking models: Traditional vs Zero Trust
• Modern enterprise challenges
• Why Zero-Trust is nothing new
• …and why security assessment isn’t scared
• Automation: Better, Faster, Stronger?
• Takeaways

4. Outpost24 Template
2019
Today’s topic
4
Why risk is the new normal
Adapting to the threat landscape
Bringing in the business context
Business aligned remediation
Takeaways
View from a:
• business perspective
• security testing perspective

5. Outpost24 Template
2019Networking models: Traditional vs Zero Trust

6. Traditional Networks follow a ‘Castle & Moat’ model
• One Way in, One way out
• Everything inside is ‘trusted’
• …

7. Traditional Networks follow a ‘Castle & Moat’ model
• One Way in, One way out
• Everything inside is ‘trusted’
• …Not dragon proof!

8. Fundamentals of a Zero Trust model:
• Eliminate trust
• Least privileged access
• Micro Segmentation
• Risk Management analytics
Zero Trust Model was coined by Forrester Research in 2010
• Data Centric model
• Gartner calls it CARTA (Continuous Adaptive Risk and Trust Assessment)

9. Outpost24 Template
2019Modern Enterprise Challenges
9

10. 10Modern Enterprise challenges
• Increased access
• Increased attack surface
• Gaps in visibility

11. Outpost24 Template
2019Why Zero Trust is nothing new…
11

12. 12
Traditional Networks have an element of Zero Trust:
• Everything outside the network is bad
• Only ‘authorized’ interactions are allowed from external sources
• Only traffic within the segment is trusted
….. Its just a BIG segment!
• Network segmentation can be done via VLAN’s
PCI has embraced the basic concepts since its inception

13. Outpost24 Template
2019..and why security assessment isn’t scared
13

14. 14
Obstacles for a true Zero Trust network
• Internally developed systems
• Legacy systems
• Technology Transformation
• Mesh Network Technology adoption
Security assessment is about exploiting these obstacles.

15. Typical security assessment killchain
15
Image reference: https://s3-eu-west-1.amazonaws.com/ssl247/1506076485_EN_Schemes_Application-penetration-test.png

16. Eliminate trust…
16
Image reference: https://s3-eu-west-1.amazonaws.com/ssl247/1506076485_EN_Schemes_Application-penetration-test.png

17. Least privileged access…
17
Image reference: https://s3-eu-west-1.amazonaws.com/ssl247/1506076485_EN_Schemes_Application-penetration-test.png

18. Micro segmentation…
18
Image reference: https://s3-eu-west-1.amazonaws.com/ssl247/1506076485_EN_Schemes_Application-penetration-test.png

19. Total restriction?
19
Image reference: https://s3-eu-west-1.amazonaws.com/ssl247/1506076485_EN_Schemes_Application-penetration-test.png

20. Altogether…
20
Image reference: https://s3-eu-west-1.amazonaws.com/ssl247/1506076485_EN_Schemes_Application-penetration-test.png

21. Zero Trust focuses on user access, role-based access, lateral movement,
micro-segmentation and traffic analytics
It doesn’t take into account existing fundamental security practices
• Vulnerability Management

22. This leaves us 2 common attack vectors:
• Vulnerability exploitation
• Privileged account escalation

23. Which leads us back to square one
23
Image reference: https://s3-eu-west-1.amazonaws.com/ssl247/1506076485_EN_Schemes_Application-penetration-test.png

24. Outpost24 Template
2019Automation: Better, Faster, Stronger?
24

25. One of the Five Steps to Zero trust is:
• Embrace Security Automation and Orchestration
One of the fundamentals of security assessment is:
• If you can spend 3 hours writing a script to save you 5 minutes, write the
script!

26. Outpost24 Template
2019
Everything is only an API away
from being a network entry point

27. API’s can provide us alternative attack methods:
• Bad implementation
• Weak access controls
• Overcomplicated controls

28. Outpost24 Template
2019Takeaways?
28

29. • Zero trust is just internalizing existing
security measures.
• Pure Zero Trust is almost impossible
for real business.
• Security assessment has already
adapted
• Automation will save time, but..
• API’s can lead to greater risk.
• Trust. No. One.
Takeaways

30. Outpost24 Template
2019
John Stock
Product Manager - Netsec
js@outpost24.com
Questions?