Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

8/28/2018
02:30 PM
Leo Taddeo
Leo Taddeo
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Why Security Needs a Software-Defined Perimeter

Most security teams today still don't know whether a user at the end of a remote connection is a hacker, spy, fraudster -- or even a dog. An SDP can change that.

In 1993, Peter Steiner published a now famous cartoon in which one dog tells another that on the Internet no one knows you're a dog. Twenty-five years later, that adage is still true. But it's even worse than that: Many security experts often don't know whether a "user" is a hacker, spy, or fraudster, either. The ability to verify the human being (or dog) on the other end of a remote connection is critical to security. It's about time we get it right with user-centric dynamic access controls.

Photo Credit: Jochen Tack/imageBROKER/Shutterstock
Photo Credit: Jochen Tack/imageBROKER/Shutterstock

We often hear that the problem of verifying users stems from the original purpose and design of the Internet. The Internet protocols used to send and receive messages do not require users to identify themselves. But the problem also stems from the design of legacy security. Specifically, the tools we use do not focus on the user. For example, firewalls and network access controls are built around network addresses and ports. Even complex next-generation firewalls are built around protocols, not users.

In order to verify the dog — er, user — on the end of a remote connection, we need a security solution that is built around the user. That is, one that makes it impossible for a hacker to impersonate anyone other than the authorized user. We need a software-defined perimeter (SDP). SDP, also known as a "Black Cloud," is a security approach that evolved from the work done (see pages 28–30 in this PDF) at the Defense Information Systems Agency under the Global Information Grid Black Core Network initiative around 2007.

A software-defined perimeter focuses on user context, not credentials, to grant access to corporate assets. To solve the problem of stopping network attacks on application infrastructure, in 2013 the Cloud Security Alliance formed the SDP Workgroup, which developed a clean-sheet approach that combines device authentication, identity-based access, and dynamically provisioned connectivity. The group noted that "While the security components in SDP are common place, the integration of the three components is fairly novel. More importantly, the SDP security model has been shown to stop all forms of network attacks including DDoS, Man-in-the-Middle, Server Query (OWASP10) as well as Advanced Persistent Threat (APT)."

An SDP requires users to present multiple authentication variables, such as time, place, and machine health and configuration to confirm whether users are who they say they are, and whether or not they should be trusted. This context enables organizations to identify an illegitimate user even if that person is in possession of legitimate user credentials. 

Access controls also need to be dynamic to account for risk and privilege escalation. Users interact with systems and applications in real time. Throughout any given session, they can perform any number of transactions of varying risk levels. For example, a user may check email several times, print a confidential document, and update the corporate blog. An SDP continuously monitors context when changes occur related to the user's behavior or the environment. The system can manage access based on location, time, security posture, and custom attributes.

An SDP also needs to be scriptable so that it can check more than the information on the device. It needs to be able to reach out to collect and analyze other sources of data to provide context and help authorize users. This ensures that even if a legitimate user is attempting to access resources with a new or different device, that enough information can be gathered to authenticate the user and permit access.

Once a user is properly authenticated — that is, we can determine with confidence that the user is Joe Smith from accounting and not a fraudster or a dog — then the SDP creates a secure, encrypted tunnel between the user and the resource(s) to protect the communications channel. In addition, the rest of the network is rendered invisible. By hiding network resources, the SDP reduces the attack surface and eliminates any possibility of the user scanning and moving laterally across the network.

Finally, because of the complexity and size of today's IT environments, an SDP needs to be scalable and highly dependable. It should be built like the cloud to enable massive scalability, and be distributed and resilient.

The key to securing access is making sure our adversaries can't simply steal credentials to gain access. We need an SDP to separate authorized users from hackers (and other bad dogs) on the Internet. Despite this longstanding and essential security control, many enterprises struggle to get it right — but they don't have to. All of these characteristics are available in SDP architecture today. 

Related Content:

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Leo Taddeo is responsible for oversight of Cyxtera's global security operations, investigations and intelligence programs, crisis management, and business continuity processes.  He provides deep domain insight into the techniques, tactics and procedures used by ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
chillywilly
50%
50%
chillywilly,
User Rank: Apprentice
8/30/2018 | 12:13:36 PM
SDP makes sesnse
An SDP approach for end users make sense and should be extended to all entitiies; machines, vm's, and containers.  Great post!  
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8144
PUBLISHED: 2020-04-01
The UniFi Video Server v3.9.3 and prior (for Windows 7/8/10 x64) web interface Firmware Update functionality, under certain circumstances, does not validate firmware download destinations to ensure they are within the intended destination directory tree. It accepts a request with a URL to firmware u...
CVE-2020-8145
PUBLISHED: 2020-04-01
The UniFi Video Server (Windows) web interface configuration restore functionality at the “backup� and “wizard� endpoints does not implement sufficient privilege checks. Low privileged users, belonging to the PUBLIC_GROUP ...
CVE-2020-8146
PUBLISHED: 2020-04-01
In UniFi Video v3.10.1 (for Windows 7/8/10 x64) there is a Local Privileges Escalation to SYSTEM from arbitrary file deletion and DLL hijack vulnerabilities. The issue was fixed by adjusting the .tsExport folder when the controller is running on Windows and adjusting the SafeDllSearchMode in the win...
CVE-2020-6009
PUBLISHED: 2020-04-01
LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.
CVE-2020-6096
PUBLISHED: 2020-04-01
An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker ...