Zero Trust

Overview

Zero-Trust security. Switch from a perimeter-based (firewall and VPN) model of access to a user to resource model.

Implement strong, simple identity. Identity for both a person, but also a system. Decouple the identity from the corporation: make it affinitive to the user, a single identity.

Enforce entitlements and authorisation in the network.

This micro-segmentation is simpler to use, more accessible, and, more secure. It reduces the lateral-traversal, it empowers the users, it increases the audit capability. And, its more economical, more scalable. Everybody wins.

Articles

Zero Trust Secure SCADA Could Make Your Water Safe To Drink

A water treatment plant was breached, looking to poison people. How did the hacker get in, and how would zero-trust secure scada?
OAuth 2.0 Security Best Current Practice

OAuth 2.0 is deceptively simple: create client id, client secret, set a few environment variables, and watch the black magic take effect. Learn about the best current security practices.
OAuth 2.0 Protected Resource Threats

The OAuth 2.0 protected resource. It takes the access token and uses it to grant access. Watch out for it becoming compromised.
OAuth 2.0 Refresh Token Threats

OAuth 2.0 refresh tokens are used to obtain new access tokens on the user’s behalf. If lost, they can allow an attacker to masquerade.
OAuth 2.0 Token Endpoint Threats

The OAuth 2.0 Token Endpoint. Its were authorisation becomes real. Secure it to prevent guessing
Your password policy is wrong: NIST SP 800-63B

Your password policy is wrong. So says this NIST standard. By trying to be too strong, you end up being weak. The users write it down!
OAuth 2.0 Authorisation Endpoint Threats

OAuth 2.0 Authorisation Endpoints are the front-door skeleton-key creator of all your front-doors. So protect them carefully.
OAuth 2.0 Client Threats

OAuth 2.0 and the client. Use Defense In Depth. Secure the client, and then assume it can still be compromised. Zero Trust.
OAuth 2.0 Threat Model and Security Considerations

OAuth 2.0 has simplified authentication and authorisation for many applications, shifting from custom code to simple library import. However, as more applications come to rely on it, this makes its weaknesses more interesting. An attacker can gain access to a broader set of data via a smaller set of tactics and techniques. First lets understand the threat areas, and then, the best current practices for addressing them.
Merger, Acquisition: Federated Identity And Zero Trust

Merger Acquisition Zero Trust. Two competitive or orthogonal companies become one. Achieve quick and secure with Federated Identity, Zero Trust.
Joint Venture: The Case For Federated Identity And Zero Trust

Joint Ventures: Good Business strategy, complex access strategy. Does one VPN to the other? Dual accounts? Zero Trust Federated Identity FTW!
Zero-Trust Reduces Ransomware Risk

Target ransomware with Zero Trust. Defense in Depth with better audit, reduced access, increased simplicity.
Your VPN Hates Your Video Conferencing. Here’s Why

Got VPN? Got perfect video conferencing with everyone all the time? If yes, well, this video is not for you. For the rest, read and view!
Zero Trust Audit Logging: Reliable Meets Simple

Big investments in SIEM become big headaches due to correlating IP and NAT. Skip that with crypto-secure audit with Zero Trust via JWT.
Reject The Status Quo: Zero Trust Status Future

The myth of the VPN, the Firewall as the only and best method of remote access has lived for 20 years. Let’s retire it together. I discuss the myth, and, an outbound-only, no firewall reconfiguration method, no client method of achieving your goals of happier productive users accessing their data and applications.
Access an Internal Resource with no Inbound Connections

Learn how to implement Zero Trust Network Access with no inbound connections, no firewall changes.
You want me to sign in with what now?

“Sign in with…”. What does it mean? Why should I use it? What am I giving up? There must be a catch, right?
Identity, Authorisation, Access: Microsoft Dynamics

Single Sign On with Microsoft Dynamics. First decide what this means, to who it means what. Then find a way to federate their natural, native identity providers together.
Ding Dong: The VPN is dead. Split Identity and Authorisation to Simplify Security

A philosophy that allows you to reduce cost, increase security, and increase user engagement and satisfaction. All 3 at once. Sounds crazy?
Trust You? I Just Met You! How Trust-On-First-Use Can Increase Your Security

Trust-On-First-Use for enrolling multi-factor authentication.can improve your security for lower cost. Sounds like a win to me!
The False Choice of Risk Versus Reach

Risk versus Reach. A false choice. We should not materially compromise security to reach more users.
Why your VPN is slow: the case of the work-at-home streaming

VPN slow? It might be your friends using YouTube and Spotify. Ration bandwidth? Split Horizon? We recommend door #3: Zero Trust, Internet Exposed, Direct.
Zero-Trust Makes Working From Home Secure And Reliable, Unlike VPN

A sudden influx of remote workers is stressing the VPN. That stateful device struggles. Consider a future switch to Zero-Trust, secure remote access with it.
Zero-Trust Principles

The principles of zero trust make for improved security. Each component must prove itself to its neighbours. No trust is based on affinity or path. Explore.
Secure Exposed Access: Zero-Trust Legacy Online With High Security and No Work

Somewhere in your basement lurks a challenge. A web application that people need, but you don’t trust. Maybe its your timesheet or vacation planner. Maybe its your HR policies portal. But you know if it meets the Internet that you’ll be in the news. We need Secure Exposed Access! Sure, you could retool it. Add some 2-Factor Authentication. Audit its east-west traffic flows. Add a SIEM in the path. But, would you feel confident? Maybe we’ll just let it lay,…
Strong Identity and Authentication: Avoid Named User License Costs With Federation

Implement a srong, simple, secure authentication system, including support for 2-factor authentication, without triggering named-user license costs.
Two-Factor Herd Immunity: Mozilla 2-factor authentication

Mozilla makes multi-factor authentication mandatory for authors. Herd Immunity suggests if we get a few more, we are all protected.
Auth and API: OpenID Connect for user + service, and enforcement along route

Identity: Authentication a user in a simple, secure way, with two-factor authentication, and allowing the user to interact with API are the key to success.
Remove SMS from your 2-factor authentication

SMS (text) has no place in your 2-factor authentication world. Remove it now and rely on a physical device (e.g. YubiKey) or TOTP (e.g. Authenticator app).
What does your internal enterprise application login look like?

Whether your app is municipal, industrial, financial, or just vacation-booking-HR, it needs a strong, 2-factor auth system. Else you teach bad habits.