Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

9/17/2010
02:38 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Forrester Pushes 'Zero Trust' Model For Security

New security approach would view internal network traffic as untrusted, as well as closely monitor and analyze all traffic inside and outside of the organization

Trust no one, not even your end users: That's the underlying theme of a new security model proposed by Forrester Research this week called "Zero Trust," which calls for enterprises to inspect all network traffic, from the outside and on the inside.

John Kindervag, senior analyst with Forrester, says the current trust model in security is broken and the only way to fix it is to get rid of the idea of the trusted internal network and the untrusted external network. Instead consider all network traffic untrusted, he says. "Times have changed. You can't think about trusted and untrusted users" anymore, says Kindervag, who gave more details on the model at Forrester's Security Forum in Boston this week.

The wave of damaging insider-borne breaches during the past few years illustrates the importance of being able to see everything going on in the network, he says. He points to the case of a help desk employee for software firm TeleData Communications who sold credit reports from TCI customers Equifax, TransUnion, and Experian to a Nigerian organized crime ring, giving the bad guys access to client information for several years even after he had left the company.

None of the victim companies knew about the intrusions into their networks until two years after it had begun, when one firm discovered it. In the end, the employee, Philip Cummings, sold 30,000 identities, amassing a financial loss of more than $2.7 million.

"We have to know what's going on in our networks," Kindervag says. "Users can't have willy-nilly access ... they will either inadvertently do something bad and maybe get fired for it or illegally access data they actually had access to," such as the State Department employees who viewed passport information of several presidential candidates in 2008, he says.

Zero Trust means inspecting all traffic in real time, and a new category of products called network analysis and visibility, which combines several niche tools -- such as forensics, packet capture, meta data analysis, and network discovery flow analysis -- such that they provide visibility and analysis of traffic and don't disrupt business processes, according to Kindervag. These tools would work with security information management systems, he says.

Kindervag says this network architecture would deploy what he calls a network segmentation gateway. "It's like a UTM [unified threat management] tool or firewall on steroids," he says. It does firewall, IPS, data leakage protection, content filtering, and encryption with a 10-gigabit interface that separates the switching fabrics for each function, he says. "It's a new security paradigm," he says.

The gateway would be managed as a single switch, with "mini-cores of switches, each has its own perimeter security by default and protected by policy," he says. "The management software that manages all the switches becomes the backplane switch fabric."

Zero Trust basically builds security into the network fabric, he says. "You can take these concepts and do a radical [change] using existing, off-the-shelf technologies rearranged in different ways," he says. "Some of the existing UTM and firewalls are close to" a network segmentation gateway model, he says.

This will let enterprises catch illicit activity more quickly. "You're going to see all traffic as it goes through," he says. "And you're inspecting and logging all traffic, so can see things that look weird, like when Joe who doesn't normally access the SQL database is [suddenly] downloading the entire SQL database," Kindervag says.

But he admits the model won't go over well with the network side or with end users who might resent their traffic being so closely scrutinized. "A few vendors won't be agile enough to respond to this," he says.

For now, Forrester plans to continue shaping the model and provide more information so enterprises and vendors can test it out. The model is less about products and more about a new model of trust, Kindervag notes.

As a former penetration tester and engineer, Kindervag says he was getting frustrated with the state of security and that just another layer of defense-in-depth isn't the answer. "The answer is to go all the way to the lowest part of the stack and [to change] the trust model," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25826
PUBLISHED: 2020-09-23
PingID Integration for Windows Login before 2.4.2 allows local users to gain privileges by modifying CefSharp.BrowserSubprocess.exe.
CVE-2020-25821
PUBLISHED: 2020-09-23
** UNSUPPORTED WHEN ASSIGNED ** peg-markdown 0.4.14 has a NULL pointer dereference in process_raw_blocks in markdown_lib.c. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2020-3130
PUBLISHED: 2020-09-23
A vulnerability in the web management interface of Cisco Unity Connection could allow an authenticated remote attacker to overwrite files on the underlying filesystem. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted HTTP re...
CVE-2020-3133
PUBLISHED: 2020-09-23
A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured filters on the device. The vulnerability is due to improper validation of incoming emails. An attacker could exploit t...
CVE-2020-3135
PUBLISHED: 2020-09-23
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (UCM) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based...