# Zero Trust Air Gap Lock Down Inbound and Outbound

- Link: https://www.agilicus.com/white-papers/zero-trust-air-gap-lockdown-inbound-and-outbound/
- Published: 2023-03-17T01:32:28+00:00
- Author: Don Bowman

## Zero Trust Air Gap Lock Down Inbound and Outbound

## Overview

Air Gaps are a useful tactic as a part of a defence in depth strategy. However, 
they are inconvenient and ineficient. Is this trade off between security and convenience
a false choice? Learn how a Zero Trust Air Gap Lockdown Inbound and Outbound can
provide convenience **and** security **together**. Explore the challenges associated
with fine-grained lockdown of the inbound path, of the outbound path.

## Defence In Depth: Zero Trust Air Gap Lockdown Inbound and Outbound

Defence in depth is about layers. Protect at each level. Assume a breach has occured.
Buy time and observability. Do not put all your defences in a single location such
as a firewall or a VPN. Zero Trust is the concept of using authenticated identity
to drive authorisation on a fine-grained basis, between a single, non-shared user
and a single resource. If each network transaction, regardless of direction, is 
initiated by a known, allowed actor, to a known, allowed destination, performing
an allowed action, and if no other network transactions are allowed, this is the
ultimate in network security.

An Air Gap is a method of ensuring no network transactions occur. Technically this
achieves the objectives of Zero Trust (by allowing nothing). However, once achieved,
this objective is human capital ineficient, requiring physical access to all resources
to perform needed operations. This in turn can actually reduce security (prop the
door open, introduce a backdoor such as an Ewon or other cellular modem). The human
desire for efficiency in work often defeats the goals of the organisation. A better
solution is a Zero Trust Air Gap Lockdown: achieve the security objectives (and 
more) of the Air Gap with the convenience of remote usage.

### Implementation Challenges

To implement this Zero Trust Air Gap Lockdown Inbound and Outbound network security
model, you must be able to control both directions of traffic. It is important to
restrict outbound traffic since it makes it more challenging for an attacker who
might have other out-of-band means of attacking. For example, assume that a staff
member finds a USB flash drive and brings it into the secure enclave. This might
introduce malware that must then turn around and make an outbound connection to 
the command-and-control to activate. By blocking the outbound direction, we prevent
the malware from activating, giving the organisation time to detect and remediate.

One of the challenges when implementing a full outbound firewall block can be breaking
certificate verification. This is a complex topic, encryption certificates need 
proper time synchronisation as well as the ability to fetch a [certificate revocation list](https://en.wikipedia.org/wiki/Certificate_revocation_list)
or [Online Certificate Status Protocol](https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol).
However, enabling these outbound can be a challenge. The Agilicus AnyX platform 
has a simple means of configuring outbound ONLY to our platform, and, at the same
time, allowing certificate verification and revocation to operate. See “[Locked-Down Networks Certificate Revocation](https://www.agilicus.com/anyx-guide/locked-down-networks-certificate-revocation/)”
for more information. Any Zero Trust Air Gap Lockdown solution **must** allow for
certificate verification to be performed, otherwise it becomes prone to an [Attacker In The Middle](https://en.wikipedia.org/wiki/Man-in-the-middle_attack)
atack vector.

A common challenge on the inbound path is the complexity of mapping identity and
application onto layer-3 and layer-4 (IP and port) coordinates. Applications might
use a Content Delivery Network, with unknowable IP addresses. They might use port-
ranges. They may have multiple modes of operation on a single IP and port. Source
IP, although commonly used, is a poor approximation of identity. A true Zero Trust
system must use common single-sign-on identity attestation and authentication, including
multi-factor, not mere IP address. Common firewalls are incapable of operating in
this mode and become simple DMZ or port-forward setups. A Swiss Cheese if you will.
A Zero Trust Air Gap Lockdown must be able to use per-person identity, not shared
accounts. Any Zero Trust Air Gap Lockdown Inbound and Outbound implementation must
be capable of acting on individual applications, and, transactions within it (e.
g. admin versus viewer, e.g. write files versus read files).

## Agilicus AnyX Solution to Air Gap Challenges

Agilicus AnyX can be used to implement a Zero Trust Air Gap Lockdown solution, for
both the inbound and the outbound direction. Agilicus recommends using the host-
firewall, or, a directly attached layer 3/4 firewall to block all but the Agilicus
fixed, well-known IP in both the inbound and outbound direction. In this fashion
malware has nowhere to go: the outbound path is blocked. Similarly, attackers have
no way to come in: they must either provide identity attestation, authenticated,
and then pass authorisation checks.

The Agilicus AnyX Zero Trust Air Gap Lockdown stylised deployment is shown below.
In this we show two methods. The Critical Resource Server on the left uses an OS-
based firewall (perhaps implemented in a virtual-machine hypervisor, perhaps in 
the OS) to block all but the Agilicus AnyX source/destination. Malware that becomes
resident on the host out-of-band cannot reach out, cannot activate. A user, outside
the environment, has transparent access after proving their identity and role. The
Critical Resource Server on the right is implemented in a similar fashion, but, 
the firewall is external (e.g. if the resource is incapable of running the Agilicus
Connector such as on e.g. an embedded HMI). This firewall should be as close as 
practical. Since this firewall is very simple (a single IP-based ACL), it can often
be implemented in an existing router or even a switch.

![Zero Trust Air Gap Lockdown: Secure Inbound and Outbound Data Transfer. Illustration
showing a secure system architecture using zero trust principles to bridge air gaps,
enabling safe data flow in both directions. Learn how to implement a robust lockdown
strategy for enhanced cybersecurity.](https://www.agilicus.com/www/f1c10fe6-zero-
trust-air-gap-lockdown-inbound-and-outbound-page-1.svg)

## Conclusions

From a convenience standpoint, the Agilicus AnyX Zero Trust Air Gap Lockdown is 
unparalleled. The end-user sees transparent access with Single-Sign-On. From a security
standpoint, per-user, per-transaction fine-grained audit backstops a per-user, per-
transaction role-based access control.

From an acceptability and meeting-of-organisation policy standpoint, a single outbound
HTTPS connection, interacting properly with existing SSL-inspecting firewalls, meets
the criteria of even the most security-conscious organisations. Outbound only, strong,
audited encryption, layered interaction with other security appliances, perfect 
fine-grained audit.

The Agilicus AnyX platform provides a convenient, simple-to-deploy, non-disruptive
Zero Trust Air Gap Lockdown with is both efficient and secure. It was indeed a false
choice to assume you could be either easy to use **or** secure.

BOOK A MEETING

Ready To Learn More?

Agilicus AnyX Zero Trust enables any user, on any device, secure connectivity to
any resource they need—without a client or VPN. Whether that resource is a web application,
a programmable logic controller, or a building management system, Agilicus can secure
it with multi-factor authentication while keeping the user experience simple with
single sign-on.

[BOOK A MEETING](https://www.agilicus.com/book-calendar-meeting/)

![Agilicus AnyX platform logo, horizontal orientation.](https://www.agilicus.com/
www/9f758437-agilicus-logo-horizonta.svg)

info@agilicus.com, +1 ‪519 953-4332‬

300-87 King St W, Kitchener, ON, Canada. N2G 1A7

[⌊partner⌉⌊partner⌉[