Zero Trust Security

This morning I was interviewed on the Mike Farwell Show (CityNews). You can check the interview here @ 54:50.

SolarWinds Web Help Desk CVE-2024-28986 (rated 9.8 our of 10) is now included in CISA’s Known Exploited Vulnerabilities (KEV) Catalog, indicating its active use in cyber attacks, giving affected agencies until September 5, 2024 to fix the flaw under Binding Operational Directive 22-01. How fun.

Shared password bad. 10 billion passwords leaked. Your team installed some shadow IT remote access solution with a shared password.

You wouldn’t download a PLC, would you? Rockwell Automation alert on public access to PLC, and a Shodan search to fact check it.

This blog post explores the challenges of securing remote access to SCADA systems and how Zero Trust can act as a solution.

In this blog post, we’ll dive into the Zero Trust vs. VPN security model differences and why the former is ultimately the far superior choice for secure, seamless remote access. 

In this blog post, we’ll delve into the challenges of enabling SSH for remote access and how you can do so without compromising security through Zero Trust.

In this post, we’ll explore the limitations of VPNs and delve into how to enable Rockwell Automation remote PLC access.

Split Horizon VPN’s are used to avoid breaking video conferencing. They are unsafe. See paper for route injection issues.

What are the risks of using VPNs in water and wastewater facilities? We’ll help you answer that question and understand what to do instead.

There are many security risks of using shared credentials in water and wastewater facilities. Here’s why you should eliminate them and how to do it.

Perimeter security approaches are no longer effective. A Zero Trust Network Architecture is a powerful, modern way to protect your network from cyber attacks.

Securing your third-party vendors can help reduce the cyber risk to your control systems and improve overall industrial network cybersecurity.

This article will give you an overview of the CISA Zero Trust Maturity Model, the changes made in Version 2.0, and how it can benefit your organization.

This article will give you an overview of NIST 800-207 and the different ways your organization can implement Zero Trust to meet the guidelines.

Vendor privileged access management best practices: Access control, strong, unified authentication, fine-audit, secure access.

Single-Sign-On and Identity Providers are often treated as the same. But, the IdP facilitates the SSO. You can have multiple IdP if desired.

Identity vs Authentication. Who are you. Prove it. Related but different concepts. Ensure your IdP does not give identity when it realy means authentication.

Cybercriminals had a record year, the cost of a breach reached new highs in 2021. With clear cybersecurity goals, businesses avoid becoming a news headline.

Reconfigure a VoIP PSTN gateway remotely via Zero Trust with Multi-Factor Authentication and single-sign-on to avoid a DDoS.

e encouraged to create API keys by many SaaS tools, and, these present real authorisation challenges.

We want a web app. We have a desktop. Use zero-trust to make any desktop available to any device without a VPN.

You have an internal tool. Grafana, Prometheus, …. You get an alert, its via Slack, Chat, etc. You click. The link goes nowhere. You curse. We fix!

SSH to the server fleet. No Public IP? No problem. No VPN. No firewall changes. End-to-end encryption. Any user.

Keep The Share. Ditch The Ransomware. Simple Zero-Trust allows any user, any device, any share, no VPN, no ransomware. Simple single sign-on.

A Florida water treatment plant breached. People nearly poisoned. SCADA exposed via Windows & TeamViewer. How did it happen, how do we prevent systematically?

Grade 10 English, the W5 (Who, What, Why, When, Where, How). A common framework to frame something. Apply it to the problem domain of Zero Trust Networking.

Empowered people make pragmatic decisions to improve productivity. This can create Shadow IT, and, Identity sprawl. Fix via Identity Aware WAF

Deploy OpenWRT on a Mikrotik to achieve SpaceX Starlink + bonded DSL backup, with Zero-Trust Network Access inbound from any user, any network, any device.

Embracing Zero Trust: Assume that a breach has (or will occur), use defense in depth, fine grained authorisation and audit, everywhere, always.

Access your QuickBooks from anywhere, as any user, without a VPN. Live. No export. No ransomware.

Time and Encryption. Certificates have a not-before and not-after. If your time is wrong, you can be tricked. Learn how the certificate transparency helps you.

A water treatment plant was breached, looking to poison people. How did the hacker get in, and how would zero-trust secure scada?

OAuth 2.0 is deceptively simple: create client id, client secret, set a few environment variables, and watch the black magic take effect. Learn about the best current security practices.

Your password policy is wrong. So says this NIST standard. By trying to be too strong, you end up being weak. The users write it down!

Merger Acquisition Zero Trust. Two competitive or orthogonal companies become one. Achieve quick and secure with Federated Identity, Zero Trust.

Joint Ventures: Good Business strategy, complex access strategy. Does one VPN to the other? Dual accounts? Zero Trust Federated Identity FTW!

Target ransomware with Zero Trust. Defense in Depth with better audit, reduced access, increased simplicity.

Got VPN? Got perfect video conferencing with everyone all the time? If yes, well, this video is not for you. For the rest, read and view!

Big investments in SIEM become big headaches due to correlating IP and NAT. Skip that with crypto-secure audit with Zero Trust via JWT.

The myth of the VPN, the Firewall as the only and best method of remote access has lived for 20 years. Let’s retire it together. I discuss the myth, and, an outbound-only, no firewall reconfiguration method, no client method of achieving your goals of happier productive users accessing their data and applications.

Learn how to implement Zero Trust Network Access with no inbound connections, no firewall changes.

“Sign in with…”. What does it mean? Why should I use it? What am I giving up? There must be a catch, right?

Single Sign On with Microsoft Dynamics. First decide what this means, to who it means what. Then find a way to federate their natural, native identity providers together.

A philosophy that allows you to reduce cost, increase security, and increase user engagement and satisfaction. All 3 at once. Sounds crazy?

Trust-On-First-Use for enrolling multi-factor authentication.can improve your security for lower cost. Sounds like a win to me!

Risk versus Reach. A false choice. We should not materially compromise security to reach more users.

VPN slow? It might be your friends using YouTube and Spotify. Ration bandwidth? Split Horizon? We recommend door #3: Zero Trust, Internet Exposed, Direct.

A sudden influx of remote workers is stressing the VPN. That stateful device struggles. Consider a future switch to Zero-Trust, secure remote access with it.

The principles of zero trust make for improved security. Each component must prove itself to its neighbours. No trust is based on affinity or path. Explore.

Somewhere in your basement lurks a challenge. A web application that people need, but you don’t trust. Maybe its your timesheet or vacation planner. Maybe its your HR policies portal. But you know if it meets the Internet that you’ll be in the news. We need Secure Exposed Access! Sure, you could retool it. Add […]

Implement a srong, simple, secure authentication system, including support for 2-factor authentication, without triggering named-user license costs.

Mozilla makes multi-factor authentication mandatory for authors. Herd Immunity suggests if we get a few more, we are all protected.

Identity: Authentication a user in a simple, secure way, with two-factor authentication, and allowing the user to interact with API are the key to success.

SMS (text) has no place in your 2-factor authentication world. Remove it now and rely on a physical device (e.g. YubiKey) or TOTP (e.g. Authenticator app).

Whether your app is municipal, industrial, financial, or just vacation-booking-HR, it needs a strong, 2-factor auth system. Else you teach bad habits.

Bad code can come in through our own import statements and software process. Do you run an egress firewall to protect the world from yourself?

Learn how to safely protect ‘internal’ or ‘development’ resources while having them on the public Internet. Simply.