Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

8/28/2018
02:30 PM
Leo Taddeo
Leo Taddeo
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Why Security Needs a Software-Defined Perimeter

Most security teams today still don't know whether a user at the end of a remote connection is a hacker, spy, fraudster -- or even a dog. An SDP can change that.

In 1993, Peter Steiner published a now famous cartoon in which one dog tells another that on the Internet no one knows you're a dog. Twenty-five years later, that adage is still true. But it's even worse than that: Many security experts often don't know whether a "user" is a hacker, spy, or fraudster, either. The ability to verify the human being (or dog) on the other end of a remote connection is critical to security. It's about time we get it right with user-centric dynamic access controls.

Photo Credit: Jochen Tack/imageBROKER/Shutterstock
Photo Credit: Jochen Tack/imageBROKER/Shutterstock

We often hear that the problem of verifying users stems from the original purpose and design of the Internet. The Internet protocols used to send and receive messages do not require users to identify themselves. But the problem also stems from the design of legacy security. Specifically, the tools we use do not focus on the user. For example, firewalls and network access controls are built around network addresses and ports. Even complex next-generation firewalls are built around protocols, not users.

In order to verify the dog — er, user — on the end of a remote connection, we need a security solution that is built around the user. That is, one that makes it impossible for a hacker to impersonate anyone other than the authorized user. We need a software-defined perimeter (SDP). SDP, also known as a "Black Cloud," is a security approach that evolved from the work done (see pages 28–30 in this PDF) at the Defense Information Systems Agency under the Global Information Grid Black Core Network initiative around 2007.

A software-defined perimeter focuses on user context, not credentials, to grant access to corporate assets. To solve the problem of stopping network attacks on application infrastructure, in 2013 the Cloud Security Alliance formed the SDP Workgroup, which developed a clean-sheet approach that combines device authentication, identity-based access, and dynamically provisioned connectivity. The group noted that "While the security components in SDP are common place, the integration of the three components is fairly novel. More importantly, the SDP security model has been shown to stop all forms of network attacks including DDoS, Man-in-the-Middle, Server Query (OWASP10) as well as Advanced Persistent Threat (APT)."

An SDP requires users to present multiple authentication variables, such as time, place, and machine health and configuration to confirm whether users are who they say they are, and whether or not they should be trusted. This context enables organizations to identify an illegitimate user even if that person is in possession of legitimate user credentials. 

Access controls also need to be dynamic to account for risk and privilege escalation. Users interact with systems and applications in real time. Throughout any given session, they can perform any number of transactions of varying risk levels. For example, a user may check email several times, print a confidential document, and update the corporate blog. An SDP continuously monitors context when changes occur related to the user's behavior or the environment. The system can manage access based on location, time, security posture, and custom attributes.

An SDP also needs to be scriptable so that it can check more than the information on the device. It needs to be able to reach out to collect and analyze other sources of data to provide context and help authorize users. This ensures that even if a legitimate user is attempting to access resources with a new or different device, that enough information can be gathered to authenticate the user and permit access.

Once a user is properly authenticated — that is, we can determine with confidence that the user is Joe Smith from accounting and not a fraudster or a dog — then the SDP creates a secure, encrypted tunnel between the user and the resource(s) to protect the communications channel. In addition, the rest of the network is rendered invisible. By hiding network resources, the SDP reduces the attack surface and eliminates any possibility of the user scanning and moving laterally across the network.

Finally, because of the complexity and size of today's IT environments, an SDP needs to be scalable and highly dependable. It should be built like the cloud to enable massive scalability, and be distributed and resilient.

The key to securing access is making sure our adversaries can't simply steal credentials to gain access. We need an SDP to separate authorized users from hackers (and other bad dogs) on the Internet. Despite this longstanding and essential security control, many enterprises struggle to get it right — but they don't have to. All of these characteristics are available in SDP architecture today. 

Related Content:

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Leo Taddeo is responsible for oversight of Cyxtera's global security operations, investigations and intelligence programs, crisis management, and business continuity processes.  He provides deep domain insight into the techniques, tactics and procedures used by ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
chillywilly
50%
50%
chillywilly,
User Rank: Apprentice
8/30/2018 | 12:13:36 PM
SDP makes sesnse
An SDP approach for end users make sense and should be extended to all entitiies; machines, vm's, and containers.  Great post!  
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17789
PUBLISHED: 2019-09-20
Prospecta Master Data Online (MDO) allows CSRF.
CVE-2019-11280
PUBLISHED: 2019-09-20
Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain ...
CVE-2019-11326
PUBLISHED: 2019-09-20
An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL to read the password of the administrative user. The same pro...
CVE-2019-11327
PUBLISHED: 2019-09-20
An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product has a local file inclusion vulnerability. An attacker with administrative privileges can craft a special URL to read arbitrary files from the device's files system.
CVE-2019-14814
PUBLISHED: 2019-09-20
There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.