Instructor: In this lesson, 2 2
we're going to talk about deperimeterization 3 3
and the need to implement zero trust 4 4
in order to secure your networks. 5 5
First, what is deperimeterization? 6 6
Now, deperimeterization is the removal of a boundary 7 7
between an organization and the outside world. 8 8
In the old days of computer networks, 9 9
we would have all of our laptops, desktops, servers, 10 10
and network devices contained 11 11
within our own office buildings. 12 12
Over time though, we added things 13 13
like personal digital assistants and smartphones, 14 14
and this allowed our networks to expand beyond the walls 15 15
of our own buildings. 16 16
These days, we cannot trust that all of our devices 17 17
are going to be connecting to our networks 18 18
from within our trusted office spaces. 19 19
This is known as the deperimeterization of our networks. 20 20
Now because of this, 21 21
we cannot rely solely on perimeter-based defenses 22 22
like firewalls, intrusion prevention systems, 23 23
and other network appliances. 24 24
Instead, we must protect our systems 25 25
and data using multiple levels of encryption, 26 26
secure protocols, data level authentication, 27 27
and other host-based protection mechanisms. 28 28
Now, deperimeterization is a wonderful thing 29 29
from an operational perspective. 30 30
It allows us to reduce our cost, 31 31
conduct business to business transactions 32 32
from anywhere in the world 33 33
and become a more agile organization. 34 34
The move to the cloud has rapidly increased our ability 35 35
to conduct secure operations 36 36
within a deperimeterization architecture. 37 37
But deperimeterization has occurred 38 38
due to the migration into the cloud, 39 39
this increase in remote work, 40 40
and the embracing of mobile technologies, 41 41
and the use of wireless networks, 42 42
as well as a move to outsourcing and contracting. 43 43
But it does bring a lot of risk to us if we're not careful. 44 44
Let's start by looking at mobile devices. 45 45
When I began working in the IT field nearly two decades ago, 46 46
networks were mostly comprised of servers, desktops, 47 47
and a few laptops thrown in here and there. 48 48
Over the past 10 years though, 49 49
the type of devices that make up our networks 50 50
have expanded to include mobile devices such as tablets, 51 51
smartphones, and countless other devices 52 52
that make up the internet of things. 53 53
Due to this ever-increasing scope of devices 54 54
on our networks, it's become very important 55 55
to consider the unique challenges each 56 56
of these devices bring into our organizations. 57 57
Our organization must first consider 58 58
if it's going to allow these devices to connect to the network, 59 59
and if so, what security policies will reduce the risk 60 60
that these various devices are going to introduce? 61 61
Each device can connect to multiple networks, 62 62
including our organizational wireless networks, 63 63
the untrusted internet over cellular, 64 64
the user's own home network, 65 65
and even hotel or coffee shop's wireless networks 66 66
when our employees are traveling for business. 67 67
While we can't control all of these networks, 68 68
each one of them introduces security risks into the devices, 69 69
which in turn introduces them back 70 70
into our organizational networks. 71 71
So with the move to the cloud, 72 72
many organizations are placing their critical data 73 73
either in public cloud offerings like AWS, Azure, 74 74
or Google Cloud's platform, 75 75
or they're putting that data into software 76 76
as a service offerings. 77 77
Either way, the data now goes beyond the perimeter 78 78
of your network, 79 79
and this, too, is considered a form of deperimeterization. 80 80
Increasingly, our employees are working remotely 81 81
whether that's from their home, from a hotel room, 82 82
or from a co-working space. 83 83
Because of this increase in the number 84 84
and type of locations being used, 85 85
these employees and their data 86 86
are also outside our traditional perimeters 87 87
of the corporate network. 88 88
When they're working outside of our corporate offices, 89 89
our employees may also be using different types 90 90
of connections back into our networks. 91 91
For example, when they're working from a hotel 92 92
or their home office, 93 93
they might be using a wireless network, a cellular modem, 94 94
or being directly cabled to an ethernet connection 95 95
over a Cat 5 or Cat 6 cable. 96 96
As the owner of the office network, 97 97
you really won't have much control 98 98
over which type of network they're connecting 99 99
back to you over. 100 100
So it's always the best practice 101 101
to implement a concept known as zero trust 102 102
to ensure the security of your corporate network 103 103
and your corporate data. 104 104
Now you see, in traditional networks, 105 105
we used to believe that our networks 106 106
and our users were trusted 107 107
because we gave them access to our data, 108 108
but under a zero trust model, that is not the case, 109 109
and that is considered a good thing in a modern world. 110 110
Zero trust is a security concept 111 111
that's centered on the belief that organizations 112 112
should not automatically trust anything inside 113 113
or outside of its perimeters, 114 114
and instead it must verify anything and everything 115 115
that's trying to connect to its systems 116 116
before granting them access. 117 117
This all comes down to the fact that everyone is suspicious. 118 118
Just because someone's using a username and password 119 119
that was assigned to one of your users, 120 120
you really don't know if that user is who they say they are 121 121
and if they can be trusted. 122 122
Zero trust is a strategic initiative 123 123
that helps prevent successful data breaches 124 124
by eliminating the concept of trust 125 125
from an organization's network architecture. 126 126
Instead zero trust can be used 127 127
to protect modern digital environments 128 128
by leveraging network segmentation, 129 129
preventing lateral movement, 130 130
providing layer 7 threat prevention, 131 131
and simplifying granular user access control. 132 132
Now, by using the concepts of microsegmentation, 133 133
we can create microperimeters within our networks. 134 134
Every time somebody tries to cross that perimeter 135 135
either inbound or outbound, 136 136
they're going to be checked again 137 137
to see if they have the right access. 138 138
These checks are not focused simply 139 139
on authentication though, 140 140
which is who is conducting the action, 141 141
but it's also checking the what they want to do, 142 142
where they're doing it from, why they're doing it, 143 143
and how they're doing it. 144 144
This policy of zero trust will determine 145 145
who can transit the microperimeter 146 146
at any given point in time, 147 147
and this prevents access to your protected area 148 148
by unauthorized users and prevents them 149 149
from exfiltrating sensitive data from your network 150 150
and other services, regardless of their actual location. 151 151
The final consideration 152 152
in this move to deperimeterization 153 153
and the implementation of zero trust revolves 154 154
around the world of outsourcing and contracting, 155 155
which is ever on the increase inside modern organizations. 156 156
You see, when we outsource functions within our company 157 157
to a contractor, we're also going to be including methods 158 158
for them to authenticate back into our network too. 159 159
For example, I have a video editor on my staff, 160 160
but I have additional video editors 161 161
that I contract work out to 162 162
whenever we're producing a lot of courses at the same time. 163 163
Now, both of these video editors though need 164 164
to access our file servers 165 165
to access the videos that I recorded 166 166
so they can do their job 167 167
and make the final video that you're going to see. 168 168
My on staff video editor can simply access it 169 169
from our local internet, 170 170
but my contracted video editor can't do that 171 171
because they're not located in or near our offices. 172 172
Instead, we have to implement the concept 173 173
surrounding deperimeterization 174 174
to allow them to securely access cloud-based file shares 175 175
under our zero trust policy 176 176
so they can access those files 177 177
and perform their necessary job functions. 178 178
As you begin to work with outsourcing and contractors, 179 179
it's always important 180 180
to identify what data they need access to, 181 181
where it is currently being stored 182 182
and how you're going to move that across the perimeter 183 183
to give them access to the data while keeping it secure.