Zero Trust Strategy and Roadmap

https://www.defense.gov/News/Releases/Release/Article/3225919/department-of-defense-releases-zero-trust-strategy-and-roadmap/

by CKMo • 4 years ago

205 103 4 years ago

defense.gov

degenerate• 4 years ago

The actual roadmap document (PDF) is not linked directly from the press release:

https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-Z...

oyashirochama• 4 years ago

Zero trust is fun, it's fine if the computers were all from the last decade and not circa. 2011-2013 HP mini's with HDD rather than SSDs or M.2 in the newest revisions of allowed devices on our networks.

eikenberry4• 4 years ago

Why would the hardware matter? Zero trust has zero (ha!) to do with hardware.

daveevad3• 4 years ago

It seems to me that distributing this information as a PDF undercuts the message a bit. It's tangential; sure, but also, it doesn't strike me as particularly good security either.

eat_veggies• 4 years ago

what do you expect it to be distributed as?

kube-system• 4 years ago

Do you not trust the PDF?

Sounds like you're getting the message just fine!

asynchronous2• 4 years ago

“The Department’s most consequential strategic competitor and the pacing challenge for the Department, the People’s Republic of China,3 as well as other state-sponsored adversaries and individual malicious actors often breach the Department’s defensive perimeter and roam freely within our information systems.”

This statement from the actual PDF really is telling for how far the DoD has dropped the ball on protection- maybe spend less time fleshing out offensive capabilities and more time on defense of your citizens?

edgyquant2• 4 years ago

maybe spend less time fleshing out offensive capabilities and more time on defense of your citizens

With our budget the two are not mutually exclusive

prvit6• 4 years ago

And they’re often the same. Take cyber “offensive” capabilities for example. Why do those exist? To provide intelligence for defense.

Thorrez• 4 years ago

That quote is from this PDF: https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-Z...

prvit6• 4 years ago

maybe spend less time fleshing out offensive capabilities and more time on defense of your citizens?

What do you mean? The US should invest in cyber defenses instead of fighter jets?

Enginerrrd2• 4 years ago

No it's just that the NSA used to work to make American companies more secure. Now they instead they find zero-days to then secretly exploit for as long as possible.

It's gotten so bad, that their recommendations for crypto are regarded with a significant degree of skepticism because of past history of deliberately undermining crypto systems which is a Terrible state of things.

CKMo• 4 years ago

I was reading it and going "Are...are you allowed to publicly admit this?"

It's a wild time, I'm telling you

imwillofficial6• 4 years ago

As an insider, I’ll say it’s a selective reading of the facts on the verge of hyperbole.

Godel_unicode11• 4 years ago

What’s the downside? It’s not like they have a customer base whose trust they need to keep.

nonameiguess• 4 years ago

They are. The entire purpose of the zero trust push is that it is nearly impossible to completely prevent perimeter breaches, so instead design in such a way that an actor inside your perimeter is not automatically trusted.

PLG888• 4 years ago

You can almost entirely prevent perimeter breaches (from untrusted attacks) by implementing authenticate-before-connect with strong identity incl. closing all inbound ports at source and destination.

edgyquant2• 4 years ago

This is the kind of decentralized systems web3 is supposed to be. Not ethereum tokens

toomuchtodo2• 4 years ago

Web3 came and went to no fanfare in places like Estonia, who have cutting edge digital identity and trust systems built on boring, existing crypto primitives and smart cards, while in the US we’re stuck with checks and paper signatures. Everyone raves about distributed identity while Login.gov is now integrated with almost 220+ federal agency systems, is the primary identity provider for Social Security (and soon, IRS after the ID.me debacle), and is a bit of PKI and CAC/smart card infra away from being a huge leap forward.

Hot take: real innovation is finding the right person’s metaphorical arm to twist to get enough leverage to get the tech implemented. The tech is the easy part. Bureaucracy hacking is underrated.

https://e-estonia.com/solutions/e-identity/id-card/

sangnoir• 4 years ago

Gemalto was hacked, possibly by GCHQ/NSA. How confident are you that the keys in the smartcards aren't compromised by an peer nation-state (e.g. China)? Security is always hard when you adversary is patient, motivated and well-resourced.

dhx2• 4 years ago

For the following techniques:

1.6 Behavioral, Contextual ID and Biometrics & 7.4 User and Entity Behavior Analytics - focus monitoring/auditing on accounts that all of a sudden transfer 10GB data when they usually only transfer only 100MB/day, or where the employee has had to be asked for that one time of the year to login on a weekend at an office they don't usually visit.

5.1 Data Flow Mapping - detect unexpected egress of data by defining ahead of time the volumes of data being transferred between systems (e.g. 2AM backup transfers 100GB to systemX and between 9AM-5PM there is a usual data transfer rate of 1MB/s therefore 100MB/s transfer rate at 1PM would raise an alert).

How well do these techniques work in practice, particularly in a huge organisation? I would have thought the number of false positives would be very high and the people monitoring the anomalous behaviour wouldn't have much or any context to know whether something is legitimate or not.

A more feasible approach may be system owners installing a new system would have to specify rate limits (including per time of day, per API call and/or per user) and would have to lodge as part of a change request whether these limits need to be temporarily increased to cater for a one-off or rare event such as a major system upgrade. But given that some of the other techniques listed indicate a lack of awareness of what software is installed and is in use, it seems unlikely that specification of rate limits would happen any time soon.

jiggawatts• 4 years ago

How well do these techniques work in practice, particularly in a huge organisation?

At $dayjob I have access to the Azure Active Directory "unusual user activity" security alerts in an environment with about 15K staff.

In my experience, the reports are accurate, in the sense that they get triggered as advertised by mis-use of IT resources. However, 95% of the time it's just staff being "naughty" instead of actual hackers.

For example, the "impossible travel" one gets triggered regularly. About 80% of the time it's because someone forgot to turn off the VPN they use to watch foreign Netflix. The other 20% of the time is because they were sharing credentials, which is against every IT security policy ever.

Even just the use of a VPN by itself is red flag. VPN providers are notoriously untrustworthy, many of them teetering on the edge of being outright malware. Certainly they all collect far too much metadata and sell it to the highest bidder. No such VPN product has any legitimate use on a corporate device.

Not to mention that corporate traffic is now looping out of the country into another country and back for no good reason...

nopenopenopeno• 4 years ago

they were sharing credentials, which is against every IT security policy ever

You’d like to think so, but...

nekoashide• 4 years ago

A big problem is insiders selling information or ransoming it under the guise of a breach. Employees are the single greatest threat to any organization so behavior analytics is starting to become really big.

As I tell people, "We don't care if you browse Reddit, we only care if you start doing things an employee shouldn't".

But to answer your questions we would just ingest those alerts into Splunk, build a KB on how to handle the alerts when they trigger and then begin the process of filtering out the noise. The SOC Analyst who works these alerts will get numb to them but still pick out the unusual ones to investigate.

CDT-MLT2• 4 years ago

That is something right there. I am intrigued by this.

bogomipz• 4 years ago

I'm curious are there any open source "behavior analytics" projects that are gaining traction?

traceroute662• 4 years ago

just ingest those alerts into Splunk

Aah yes, Splunk....

Good tool, but realistically only viable for those working for a corporate-sized employer with corporate-sized pockets filled with $$$$$$$.

Most people can't afford to simply dump it all into Splunk and (if they are using Splunk at all) have to pre-filter first. Which kind of defeats the point of Splunk if they're already doing the hard work outside, and so might was well use some cheaper (F)OSS tool.

TheGeminon• 4 years ago

Ideally in a system like this, you don't just look at a single user and a single point (e.g. 100x data transfer in a day), you build out scoring based on a multitude of factors and across related agents/assets, and hopefully you have enough training data to account for irregular or seasonal occurrences.

For one part of the org, occasionally doing 100x data transfers may not be out of the ordinary, while for others it may be exceptional. But it might be anomalous if its 100x data transfer and hitting services no one on your team has ever hit (indicating perhaps scanning/scraping and exfiltrating data, but you don't need to explicitly specify that as an alert).

Closi• 4 years ago

Let's remember the level of classification here though - in a usual org an occasional large data transfer might not be worth investigating, but in some contexts within the DoD it's certainly worth investigating.

_tk_• 4 years ago

I work as an Information Security Officer in a corporation with about 100.000 employees. The outlined reasons in this post are what makes these capabilities effective in our org as well.

dataflow• 4 years ago

This might sound silly (as I have no experience in the field), but if this problem is due to the "largeness" of an organization (say "large" being N = 300, for the sake of argument), then presumably it's because certain false positives become more frequent as they have more employees than N, which causes the security monitors to tune out similar behavior, correct?

So instead of hiring the same constant number of security monitors/auditors independently of the organization size, can't you "solve" this problem by hiring one per every N employees, and having them monitor solely that group?

It sounds to me like either this solution should work (a "large" organization should be able to afford this!), or the problem isn't really related to the size of the organization.

asebold• 4 years ago

Org size can cause some amount of fatigue, sure. But reliable security engineers are few and far between. Not necessary scale-able to org size.

Additionally, security is one of those things it's hard to get C-suite execs to pay attention to and spend money on. When it's working, you don't notice it. And if your 5 person security team has worked fine for the past 5 years as the org has grown, why should you suddenly scale it up to 10? Everything is fine! That is...until it isn't. But rarely do people think ahead like this.

PeterisP• 4 years ago

One aspect that changes with the scale is the distance (both in org-chart and physically) between the monitor and the monitored - in larger organizations the monitor has less useful context (and less ability to get it) to evaluate the circumstances of some alert.

dhx2• 4 years ago

My thoughts on complexity are more in relation to large organisations having more areas of business, each with their own set of software in use. For a multinational company which frequently acquires other businesses, perhaps they end up with 10 of everything--10 HR systems, 10 finance systems, etc. And then on top of that a number of other systems for generating reports from the 10 finance systems, polling and searching data from the 10 logistics systems, etc. The DOD would be a nightmare of complexity and most likely the global leader in complexity.

Defense Logistics Agency in 2018 reported 264 applications in use, which was down from 1200 in 2013[1]. DLA only represent about 0.9% of the total DOD workforce[2] and it appears the application reduction could be due to consolidation of applications together, making application counts appear better but not doing much to reduce true complexity.

Given many systems have a single subject matter expert (or sometimes none), what is a cyber security analyst responsible for 100's of applications going to be able to reason about an event raised from a system with a name as vague as "DLA Action Item Tickler Report"? Was Bob OK to send the XY12 report via e-mail to Oscar? Who knows? It's likely no one has asked that type of question before and the only person who knows enough about the system to answer the question is the person who caused the event to be generated.

Some organisations are quite simple (despite having similar finances and employee counts) because they largely consist of simple repeatable processes performed by 1000's of employees using a single software product. Some organisations (particularly the DOD) are very complex because every employee is doing something unique across 100's of different software products.

[1] https://www.dla.mil/About-DLA/News/News-Article-View/Article...

[2] https://en.wikipedia.org/wiki/United_States_Department_of_De...

michaelt• 4 years ago

How well do these techniques work in practice, particularly in a huge organisation?

Like this:

I log into system foo-bar-baz, which one person accesses once or twice a year. Maybe it's christmas setup, maybe it's for daylight savings time, maybe it's for a new release of Ubuntu, whatever. I have all the relevant credentials, I am responsible for foo-bar-baz, and I have an authorised change request.

Three days later, the security team sends me a slack message, asking if I accessed system foo-bar-baz.

I tell them yes.

Godel_unicode11• 4 years ago

Because they want to know if someone stole your creds.

_HMCB_• 4 years ago

Didn’t know much about Zero Trust. This article was helpful: https://www.csoonline.com/article/3247848/what-is-zero-trust...

rkagerer• 4 years ago

When I think of "zero trust" I think concepts like zksnarks where all the information is already out there (go ahead and let your org leak, in fact you can even deliberately publish it) but protected in such a way that only legitimate uses can decipher / make use of it.

What they're talking about here sounds more like things that ought to be obvious but the industry got lazy about.

imwillofficial6• 4 years ago

Your understanding is an uncommon one.

What they are talking about here is the more common understanding.

manbash• 4 years ago

Firewall and VPN is the obvious part, and that's the industry standard.

Zero-trust means that Access Control is more finely-grained, down to the machine/user level. In this approach we don't trust any machine/user inside the organization as well.

CDT-MLT2• 4 years ago

What is a real joke is how you can make into the phone system at the DOD and speak to a human and they give you information without even verifying who the hell you are. Still happens all the time.

desimone• 4 years ago

Our adversaries are in our networks, exfiltrating our data, and exploiting the Department’s users.

I'm happy to see this admission lead the document; it's bold coming from an org as conservative as the DoD. To see critical mass around the idea that -- like it or not -- adversaries (both malicious insiders and outsiders) are already on trusted networks is really encouraging to see.

First, let's be clear what this document is and isn't.

Importantly, this document serves only as a strategy, not a solution architecture. Zero Trust Solution Architectures can and should be designed and guided by the details found within this document.

This is a long term strategy doc, not an implementer's guide. Operators looking for zero-trust easy mode won't find it here. It's also very DoD specific.

But there are some good parts. I read the doc so (maybe?) you don't have to.

I made some screenshots of the portions I thought most relevant.

https://imgur.com/a/Dhm7yvi

The comments will make more sense if you are viewing those.

Zero Trust uses continuous multi-factor authentication, micro-segmentation, advanced encryption, endpoint security, analytics, and robust auditing, among other capabilities, to fortify data, applications, assets, and services to deliver cyber resiliency. The Department is evolving to become a more agile, more mobile, cloud-supported workforce, collaborating with the entirety of DoD enterprise, including federal and non-federal organizations and mission partners working on a variety of missions.

If you somehow managed to read the above without going into a post word salad coma, I'm sorry. I highlighted the section just to bring up there's an awful lot of enterprise security buzzword and DoD acronym bingo going on. But there are some good thoughts too.

Zero Trust is much more than an IT solution. Zero Trust may include certain products but is not a capability or device that may be bought.

It's nice to hear this being reiterated so often. A good start!

Zero Trust security eliminates the traditional idea of perimeters, trusted networks, ...

Zero trust is -- to me at least -- mostly about the idea of removing perimeters and trusted networks as the basis for trust and access control. So I'm with you so far.

... devices, personas, or processes and shifts to multi-attribute-based levels of confidence that enable authentication and authorization policies founded on the concept of least privileged access concept of least privileged access

But it's interesting here that the authors are also calling out and devices, personas which is what I'd argue are the fundamental contextual attributes that allow you to replace a "trusted perimeter"; if we aren't using perimeters, devices, personas... what is the DoD suggesting we use? I can't find it.

At its core, ZT assumes no implicit trust is granted to assets or users based solely on their physical or network location (i.e., local area networks versus the Internet) or asset ownership (enterprise or personally owned).12

I strongly agree with the first point, but disagree and am perplexed by the second. Zero trust is all about getting rid of a trusted network location.

However, asset ownership *matters* because it affects not only the identity of the user, but also the _state_ of the device. It's totally reasonable to have different levels of trust for a managed company owned device with a known set of endpoint protection tools, vs a BYOD device whose device state is largely unknown.

The doc does a good job of outlining the "Why" of zero trust. And what's required from an org to make it possible.

Unfortunately, while the document starts out strong, it quickly becomes "actually, zero trust is every security thing you've ever heard of". Paired with a timeline no one will ever meet ever.

eikenberry4• 4 years ago

Zero trust is about not trusting anything, not only the network, and instead focusing on controlling the access/damage. It is 100% authz, about limiting what you can access and how long you can access it to what is required. That you there is no trust in those agent (ie. assume authn is already compromised) so you limit the damage possible.

PLG888• 4 years ago

I would extend it to not inherently trusting the agent as well as being able to not have to trust the network (e.g., internet WAN) by closing all inbound ports by implementing authentication-before-connect using strong identity (e.g., x509)

PLG888• 4 years ago

I agree that it quickly became a radar for every single tech/vendor which slaps a 'zero trust' sticker on their product. Personally, I believe that while zero trust applies to all pillars, the most consequential is the network if we pair it with comcepts/components of the other pillars.

For example, if we state we want to have zero trust in the network, we can achieve this by switching from authenticate/authorise-after-connect (i.e., how TCP/IP/almost every network is built), to authenticate/authorise-before-connect. This is achieved with strong identity (e.g., x509) and an overlay network built on zero trust principles which further provides us microsegmentation, least privilege, etc. It allows us to close all inbound ports and make access decision at the source (rather than destination) edge (e.g., device/user) and close all inbound ports. This makes many MITRE attacks impossible and massively reduces the affect of others. We can have zero trust in the WAN/internet (no inbound ports), LAN and even host OS.

vsareto• 4 years ago

advanced encryption

Now I really want to know the DoD's definition of basic vs. advanced encryption. Is there a middle tier, like average encryption?

teleforce• 4 years ago

NIST Zero Trust Architecture recommendation:

https://www.nist.gov/publications/zero-trust-architecture

imwillofficial6• 4 years ago

I was pushing this stuff in DoD for years. Glad to see it catch on.

nonrandomstring2• 4 years ago

Take some solace in the fact that you probably _did_ make a difference. Just one you couldn't see while being ignored for years.

imwillofficial6• 4 years ago

It’s exhausting to the soul to yell into the void for so long.

headsoup• 4 years ago

Is zero trust just the same idea as agile 'fixing' waterfall?

I.e. is it just another 'practice' marketed to solve an existing people and process issue that can be readily solved with proper focus , which just introduces its own issues anyway? Like sure, zero trust will work IF you do it really well, but then so will the existing environment.

Zero Trust Strategy and Roadmap

Related Stories