1 00:00:00,060 --> 00:00:01,440 In this lesson, we're going to cover 2 00:00:01,440 --> 00:00:03,450 the concept of Zero Trust. 3 00:00:03,450 --> 00:00:04,740 In our current digital age, 4 00:00:04,740 --> 00:00:07,020 we are constantly being bombarded with digital threats 5 00:00:07,020 --> 00:00:08,670 that are more sophisticated than ever 6 00:00:08,670 --> 00:00:09,780 and this continually is putting 7 00:00:09,780 --> 00:00:12,570 our traditional cybersecurity strategies to the test. 8 00:00:12,570 --> 00:00:14,220 Now, traditional cybersecurity strategies 9 00:00:14,220 --> 00:00:16,950 have always focused on using a strong perimeter defense, 10 00:00:16,950 --> 00:00:19,020 much like an old castle has strong walls 11 00:00:19,020 --> 00:00:22,320 and a moat around the castle to keep threat actors at bay. 12 00:00:22,320 --> 00:00:24,420 Now, the problem with these old school strategies though, 13 00:00:24,420 --> 00:00:25,830 while they were effective in the past, 14 00:00:25,830 --> 00:00:28,530 is that they are no match for our modern networks. 15 00:00:28,530 --> 00:00:30,323 After all, castles were the pinnacle of security 16 00:00:30,323 --> 00:00:33,150 about 1,000 years ago, but these days, 17 00:00:33,150 --> 00:00:36,000 I could simply fly over them with a drone or a helicopter 18 00:00:36,000 --> 00:00:38,700 and now I can attack anybody inside the castle 19 00:00:38,700 --> 00:00:40,260 and those castle walls and that moat 20 00:00:40,260 --> 00:00:42,330 aren't doing anything to stop me. 21 00:00:42,330 --> 00:00:44,460 Well, this is exactly how most computer networks 22 00:00:44,460 --> 00:00:46,740 were secured over the past few decades. 23 00:00:46,740 --> 00:00:48,870 Cybersecurity experts had configured networks 24 00:00:48,870 --> 00:00:50,340 with strong external defenses 25 00:00:50,340 --> 00:00:51,900 by using things like firewalls, 26 00:00:51,900 --> 00:00:54,900 intrusion protection systems, and other perimeter defenses. 27 00:00:54,900 --> 00:00:57,150 But these days, many of our network devices 28 00:00:57,150 --> 00:00:59,250 are pretty much deperimeterized. 29 00:00:59,250 --> 00:01:02,010 Now instead, we must protect all of our systems and data 30 00:01:02,010 --> 00:01:04,709 using multiple levels of encryption, secure protocols, 31 00:01:04,709 --> 00:01:06,180 data level authentication, 32 00:01:06,180 --> 00:01:08,310 and other host-based protection mechanisms 33 00:01:08,310 --> 00:01:10,290 because using a perimeter only structure 34 00:01:10,290 --> 00:01:12,150 is not going to keep us safe. 35 00:01:12,150 --> 00:01:13,950 Now, from an operational perspective, 36 00:01:13,950 --> 00:01:16,020 most people love deperimeterization 37 00:01:16,020 --> 00:01:17,850 because it allows us to reduce our costs, 38 00:01:17,850 --> 00:01:19,380 conduct business to business transactions 39 00:01:19,380 --> 00:01:21,900 from anywhere in the world, and has become increasingly 40 00:01:21,900 --> 00:01:24,660 more agile for us as organizations to use 41 00:01:24,660 --> 00:01:26,550 this type of deperimeterization. 42 00:01:26,550 --> 00:01:28,230 The move to the cloud, when combined with 43 00:01:28,230 --> 00:01:30,810 the rise of work from home, has really increased our ability 44 00:01:30,810 --> 00:01:32,280 to conduct secure operations 45 00:01:32,280 --> 00:01:34,740 within a deperimeterization architecture. 46 00:01:34,740 --> 00:01:37,320 Now, deperimeterization has occurred due the migration 47 00:01:37,320 --> 00:01:39,450 into the cloud, the increase in remote work, 48 00:01:39,450 --> 00:01:41,100 people embracing mobile technologies 49 00:01:41,100 --> 00:01:44,070 along with the rapid adoption and use of wireless networks, 50 00:01:44,070 --> 00:01:45,300 as well as larger movements 51 00:01:45,300 --> 00:01:47,220 towards outsourcing and contracting. 52 00:01:47,220 --> 00:01:49,530 But this whole deperimeterization movement 53 00:01:49,530 --> 00:01:51,120 does really introduce a lot of risks 54 00:01:51,120 --> 00:01:53,850 to our organizations too, if we're not careful. 55 00:01:53,850 --> 00:01:56,550 So to protect these deperimeterized networks, 56 00:01:56,550 --> 00:01:59,580 we can't simply rely on boundary or perimeter defenses. 57 00:01:59,580 --> 00:02:01,950 And instead, we need to implement a best practice 58 00:02:01,950 --> 00:02:04,290 which is now known as Zero Trust. 59 00:02:04,290 --> 00:02:06,090 Zero Trust is used to ensure the security 60 00:02:06,090 --> 00:02:08,639 of your corporate network and your corporate data. 61 00:02:08,639 --> 00:02:10,289 Now, when we look at our traditional networks, 62 00:02:10,289 --> 00:02:11,460 we used to believe that our networks 63 00:02:11,460 --> 00:02:12,810 and our users were trusted 64 00:02:12,810 --> 00:02:15,150 because we gave them access to those systems. 65 00:02:15,150 --> 00:02:18,330 But under a Zero Trust model, that is simply not the case 66 00:02:18,330 --> 00:02:21,330 and that is considered a good thing in our modern world. 67 00:02:21,330 --> 00:02:23,940 You may have heard the old saying, trust but verify, 68 00:02:23,940 --> 00:02:25,950 which was made famous by President Ronald Reagan 69 00:02:25,950 --> 00:02:27,390 back in the 1980s. 70 00:02:27,390 --> 00:02:28,980 But as cybersecurity professionals, 71 00:02:28,980 --> 00:02:30,810 we actually take this a step further. 72 00:02:30,810 --> 00:02:32,280 When we implement Zero Trust, 73 00:02:32,280 --> 00:02:33,900 we want to quote our favorite mantra, 74 00:02:33,900 --> 00:02:36,660 which is trust nothing and verify everything. 75 00:02:36,660 --> 00:02:39,240 And that really does sum up the entire architecture concept 76 00:02:39,240 --> 00:02:41,190 behind Zero Trust systems. 77 00:02:41,190 --> 00:02:43,890 With Zero Trust, we demand that verification happens 78 00:02:43,890 --> 00:02:45,600 for every device, every user, 79 00:02:45,600 --> 00:02:47,670 and every transaction within our network 80 00:02:47,670 --> 00:02:49,680 regardless of where it came from. 81 00:02:49,680 --> 00:02:51,720 This means that whether a user is attempting to access 82 00:02:51,720 --> 00:02:54,270 a system from within our organization's physical office 83 00:02:54,270 --> 00:02:56,220 or from over the internet, because they're doing it 84 00:02:56,220 --> 00:02:58,500 from home remotely, their identity and permissions 85 00:02:58,500 --> 00:03:00,540 are always going to be verified. 86 00:03:00,540 --> 00:03:03,480 This methodology also addresses the changing nature of work 87 00:03:03,480 --> 00:03:04,890 and the digital landscape that has moved 88 00:03:04,890 --> 00:03:07,530 to a deperimeterization while acknowledging that threats 89 00:03:07,530 --> 00:03:10,680 can emerge from both inside or outside of your networks. 90 00:03:10,680 --> 00:03:13,170 Now, in order to create a Zero Trust architecture, 91 00:03:13,170 --> 00:03:15,090 we're going to use two different planes. 92 00:03:15,090 --> 00:03:17,970 These are called the control plane and the data plane. 93 00:03:17,970 --> 00:03:20,610 Now, the control plane refers to the overarching framework 94 00:03:20,610 --> 00:03:23,250 and set of components that are responsible for defining, 95 00:03:23,250 --> 00:03:26,130 managing, and enforcing the policies related to user 96 00:03:26,130 --> 00:03:28,740 and system access within an organization. 97 00:03:28,740 --> 00:03:30,990 It provides a centralized way to dictate and control 98 00:03:30,990 --> 00:03:34,050 how, when, and where access is going to be granted 99 00:03:34,050 --> 00:03:36,720 to ensure that only authenticated and authorized entities 100 00:03:36,720 --> 00:03:38,700 can access specific resources. 101 00:03:38,700 --> 00:03:40,440 The control plane typically encompasses 102 00:03:40,440 --> 00:03:43,260 several key elements, including adaptive identity, 103 00:03:43,260 --> 00:03:45,930 threat scope reduction, policy-driven access control, 104 00:03:45,930 --> 00:03:47,520 and secured zones. 105 00:03:47,520 --> 00:03:49,860 First, we have adaptive identity. 106 00:03:49,860 --> 00:03:53,430 In Zero Trust, we assume that static one-time verifications 107 00:03:53,430 --> 00:03:56,310 are not sufficient, so we must use adaptive identities 108 00:03:56,310 --> 00:03:58,260 that relies on real-time validation 109 00:03:58,260 --> 00:04:00,870 that takes into account the user's behavior, their device, 110 00:04:00,870 --> 00:04:03,330 their location, and other factors like that. 111 00:04:03,330 --> 00:04:05,160 By continually assessing these variables, 112 00:04:05,160 --> 00:04:07,200 our user identities are constantly adjusting 113 00:04:07,200 --> 00:04:09,420 and adapting to the environment in order to grant 114 00:04:09,420 --> 00:04:11,970 or restrict access to them as required. 115 00:04:11,970 --> 00:04:14,520 Second, we have threat scope reduction. 116 00:04:14,520 --> 00:04:17,130 Now in Zero Trust, we want to limit our users' access 117 00:04:17,130 --> 00:04:19,110 to only what they need for their work task 118 00:04:19,110 --> 00:04:20,370 because this drastically reduces 119 00:04:20,370 --> 00:04:22,260 the network's potential attack surface. 120 00:04:22,260 --> 00:04:25,020 This approach is focused on minimizing the blast radius 121 00:04:25,020 --> 00:04:26,880 that could occur in the event of a breach, 122 00:04:26,880 --> 00:04:28,530 and ensures that the compromised credentials 123 00:04:28,530 --> 00:04:31,080 will not allow attackers to have unimpeded access 124 00:04:31,080 --> 00:04:33,390 throughout your entire network or system. 125 00:04:33,390 --> 00:04:36,120 Third, we have policy-driven access control. 126 00:04:36,120 --> 00:04:38,850 Now the policy-driven access control is going to develop, 127 00:04:38,850 --> 00:04:41,400 manage, and enforce user access policies 128 00:04:41,400 --> 00:04:43,770 based on their roles and responsibilities. 129 00:04:43,770 --> 00:04:46,410 By defining clear policies, organizations can ensure 130 00:04:46,410 --> 00:04:48,960 that users only have access to data that is pertinent 131 00:04:48,960 --> 00:04:51,150 to their role in order to reduce the potential 132 00:04:51,150 --> 00:04:54,300 for successful data breaches against your organization. 133 00:04:54,300 --> 00:04:56,550 Fourth, we have secured zones. 134 00:04:56,550 --> 00:04:58,500 Now, secured zones are isolated environments 135 00:04:58,500 --> 00:05:01,350 within a network that are designed to house sensitive data. 136 00:05:01,350 --> 00:05:03,030 Only users with the appropriate permissions 137 00:05:03,030 --> 00:05:04,860 can access these zones and this creates 138 00:05:04,860 --> 00:05:06,660 a further layer of protection. 139 00:05:06,660 --> 00:05:08,400 Now, in addition to the control plane, 140 00:05:08,400 --> 00:05:10,470 we also have something known as the data plane 141 00:05:10,470 --> 00:05:13,260 that we have to use to properly implement Zero Trust. 142 00:05:13,260 --> 00:05:15,270 While the control plane lays out the policies 143 00:05:15,270 --> 00:05:17,640 and procedures, the data plane is going to ensure 144 00:05:17,640 --> 00:05:20,460 those policies are being properly executed. 145 00:05:20,460 --> 00:05:23,160 The data plane is going to consist of the subject/system, 146 00:05:23,160 --> 00:05:25,350 the policy engine, the policy administrator, 147 00:05:25,350 --> 00:05:27,510 and the policy enforcement point. 148 00:05:27,510 --> 00:05:29,610 First, we have the subject system. 149 00:05:29,610 --> 00:05:31,650 The subject/system refers to the individual 150 00:05:31,650 --> 00:05:33,990 or entity attempting to gain access. 151 00:05:33,990 --> 00:05:35,820 This could be an employee, a workstation, 152 00:05:35,820 --> 00:05:37,710 or even a software application. 153 00:05:37,710 --> 00:05:40,260 The primary objective is to verify the authenticity 154 00:05:40,260 --> 00:05:43,140 of the subject or system before granting access to them 155 00:05:43,140 --> 00:05:45,780 to be able to access your sensitive data or systems. 156 00:05:45,780 --> 00:05:47,850 Second, we have the policy engine. 157 00:05:47,850 --> 00:05:49,650 Once the subject's identity is verified, 158 00:05:49,650 --> 00:05:52,410 the policy engine cross-references the access request 159 00:05:52,410 --> 00:05:54,270 with its predefined policies. 160 00:05:54,270 --> 00:05:56,010 Think about it like a rule book that determines 161 00:05:56,010 --> 00:05:58,860 whether the request aligns with the subject's permissions. 162 00:05:58,860 --> 00:06:01,230 Third, we have the policy administrator. 163 00:06:01,230 --> 00:06:03,270 Now the policy administrator is an essential part 164 00:06:03,270 --> 00:06:05,070 of the Zero Trust model that's going to be used 165 00:06:05,070 --> 00:06:07,680 to establish and manage the access policies. 166 00:06:07,680 --> 00:06:10,350 This is the entity that dictates who gets access to what, 167 00:06:10,350 --> 00:06:12,450 and ensures that the policies align with the organization's 168 00:06:12,450 --> 00:06:15,240 security protocols and business objectives. 169 00:06:15,240 --> 00:06:17,820 Fourth, we have the policy enforcement point. 170 00:06:17,820 --> 00:06:19,860 The policy enforcement point is the final step 171 00:06:19,860 --> 00:06:22,110 in the process, and this is where the decision to grant 172 00:06:22,110 --> 00:06:24,990 or deny access is actually going to be executed. 173 00:06:24,990 --> 00:06:27,330 Based on the verification from the subject or system 174 00:06:27,330 --> 00:06:29,160 and the policy engine's determination, 175 00:06:29,160 --> 00:06:31,260 the policy enforcement point will then allow 176 00:06:31,260 --> 00:06:33,720 or restrict access and it will effectively act 177 00:06:33,720 --> 00:06:35,760 as a gatekeeper to the sensitive areas 178 00:06:35,760 --> 00:06:37,320 of your systems or networks. 179 00:06:37,320 --> 00:06:40,200 So remember, Zero Trust is a cybersecurity approach 180 00:06:40,200 --> 00:06:43,260 that assumes no user or system is trusted by default 181 00:06:43,260 --> 00:06:45,570 and it requires continuous verification for access 182 00:06:45,570 --> 00:06:47,880 to your organization's resources regardless of 183 00:06:47,880 --> 00:06:50,520 the location or origin of your network request. 184 00:06:50,520 --> 00:06:53,070 Zero Trust is more than just a security trend though. 185 00:06:53,070 --> 00:06:54,270 It really is the acknowledgement 186 00:06:54,270 --> 00:06:55,710 from the cybersecurity community 187 00:06:55,710 --> 00:06:58,170 that we're facing an ever evolving digital landscape 188 00:06:58,170 --> 00:06:59,760 where threats can come from outside 189 00:06:59,760 --> 00:07:01,710 or inside of your network. 190 00:07:01,710 --> 00:07:03,390 While traditional perimeter-based defenses 191 00:07:03,390 --> 00:07:05,490 still hold value and they should be used, 192 00:07:05,490 --> 00:07:07,440 they're increasingly going to be insufficient 193 00:07:07,440 --> 00:07:09,660 on their own to protect your system 194 00:07:09,660 --> 00:07:11,340 solely by using the perimeter. 195 00:07:11,340 --> 00:07:14,700 So as we navigate an age of remote work, cloud computing, 196 00:07:14,700 --> 00:07:16,650 and ever increasing array of devices, 197 00:07:16,650 --> 00:07:19,200 Zero Trust principles do offer us a roadmap 198 00:07:19,200 --> 00:07:22,320 to creating a more robust and adaptable security posture. 199 00:07:22,320 --> 00:07:24,090 By integrating the Zero Trust strategies 200 00:07:24,090 --> 00:07:26,400 and using our control planes and data planes, 201 00:07:26,400 --> 00:07:28,860 organizations can proactively defend against threats 202 00:07:28,860 --> 00:07:30,600 by recognizing that trust is a commodity 203 00:07:30,600 --> 00:07:33,780 that must be earned, verified, and continuously reassessed 204 00:07:33,780 --> 00:07:36,933 at every enforcement point within your systems and networks.