Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

8/28/2018
02:30 PM
Leo Taddeo
Leo Taddeo
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Why Security Needs a Software-Defined Perimeter

Most security teams today still don't know whether a user at the end of a remote connection is a hacker, spy, fraudster -- or even a dog. An SDP can change that.

In 1993, Peter Steiner published a now famous cartoon in which one dog tells another that on the Internet no one knows you're a dog. Twenty-five years later, that adage is still true. But it's even worse than that: Many security experts often don't know whether a "user" is a hacker, spy, or fraudster, either. The ability to verify the human being (or dog) on the other end of a remote connection is critical to security. It's about time we get it right with user-centric dynamic access controls.

We often hear that the problem of verifying users stems from the original purpose and design of the Internet. The Internet protocols used to send and receive messages do not require users to identify themselves. But the problem also stems from the design of legacy security. Specifically, the tools we use do not focus on the user. For example, firewalls and network access controls are built around network addresses and ports. Even complex next-generation firewalls are built around protocols, not users.

In order to verify the dog — er, user — on the end of a remote connection, we need a security solution that is built around the user. That is, one that makes it impossible for a hacker to impersonate anyone other than the authorized user. We need a software-defined perimeter (SDP). SDP, also known as a "Black Cloud," is a security approach that evolved from the work done (see pages 28–30 in this PDF) at the Defense Information Systems Agency under the Global Information Grid Black Core Network initiative around 2007.

A software-defined perimeter focuses on user context, not credentials, to grant access to corporate assets. To solve the problem of stopping network attacks on application infrastructure, in 2013 the Cloud Security Alliance formed the SDP Workgroup, which developed a clean-sheet approach that combines device authentication, identity-based access, and dynamically provisioned connectivity. The group noted that "While the security components in SDP are common place, the integration of the three components is fairly novel. More importantly, the SDP security model has been shown to stop all forms of network attacks including DDoS, Man-in-the-Middle, Server Query (OWASP10) as well as Advanced Persistent Threat (APT)."

An SDP requires users to present multiple authentication variables, such as time, place, and machine health and configuration to confirm whether users are who they say they are, and whether or not they should be trusted. This context enables organizations to identify an illegitimate user even if that person is in possession of legitimate user credentials. 

Access controls also need to be dynamic to account for risk and privilege escalation. Users interact with systems and applications in real time. Throughout any given session, they can perform any number of transactions of varying risk levels. For example, a user may check email several times, print a confidential document, and update the corporate blog. An SDP continuously monitors context when changes occur related to the user's behavior or the environment. The system can manage access based on location, time, security posture, and custom attributes.

An SDP also needs to be scriptable so that it can check more than the information on the device. It needs to be able to reach out to collect and analyze other sources of data to provide context and help authorize users. This ensures that even if a legitimate user is attempting to access resources with a new or different device, that enough information can be gathered to authenticate the user and permit access.

Once a user is properly authenticated — that is, we can determine with confidence that the user is Joe Smith from accounting and not a fraudster or a dog — then the SDP creates a secure, encrypted tunnel between the user and the resource(s) to protect the communications channel. In addition, the rest of the network is rendered invisible. By hiding network resources, the SDP reduces the attack surface and eliminates any possibility of the user scanning and moving laterally across the network.

Finally, because of the complexity and size of today's IT environments, an SDP needs to be scalable and highly dependable. It should be built like the cloud to enable massive scalability, and be distributed and resilient.

The key to securing access is making sure our adversaries can't simply steal credentials to gain access. We need an SDP to separate authorized users from hackers (and other bad dogs) on the Internet. Despite this longstanding and essential security control, many enterprises struggle to get it right — but they don't have to. All of these characteristics are available in SDP architecture today. 

Related Content:

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Leo Taddeo is responsible for oversight of Cyxtera's global security operations, investigations and intelligence programs, crisis management, and business continuity processes.  He provides deep domain insight into the techniques, tactics and procedures used by ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
chillywilly
50%
50%
chillywilly,
User Rank: Apprentice
8/30/2018 | 12:13:36 PM
SDP makes sesnse
An SDP approach for end users make sense and should be extended to all entitiies; machines, vm's, and containers.  Great post!  
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...