1
00:00:00,120 --> 00:00:01,859
In this lesson, we're going to cover

2
00:00:01,859 --> 00:00:04,050
zero-trust architectures.

3
00:00:04,050 --> 00:00:05,550
Now, in our current digital age,

4
00:00:05,550 --> 00:00:07,080
we are constantly being bombarded

5
00:00:07,080 --> 00:00:08,520
with digital threats that are more

6
00:00:08,520 --> 00:00:10,380
sophisticated than ever before,

7
00:00:10,380 --> 00:00:12,330
and this continually is putting our traditional

8
00:00:12,330 --> 00:00:14,580
cybersecurity strategies to the test.

9
00:00:14,580 --> 00:00:16,260
Now, traditional cybersecurity strategies

10
00:00:16,260 --> 00:00:18,660
have always focused on using a strong perimeter,

11
00:00:18,660 --> 00:00:20,550
and this way, we have a big defense,

12
00:00:20,550 --> 00:00:22,800
much like an old castle has strong walls

13
00:00:22,800 --> 00:00:24,180
and a moat around the castle

14
00:00:24,180 --> 00:00:26,190
to keep threat actors at bay.

15
00:00:26,190 --> 00:00:27,780
Now, the big problem with these old school

16
00:00:27,780 --> 00:00:29,550
strategies though is that while they were

17
00:00:29,550 --> 00:00:30,690
effective in the past,

18
00:00:30,690 --> 00:00:33,210
they are no match for our modern networks.

19
00:00:33,210 --> 00:00:34,860
After all, castles were the pinnacle

20
00:00:34,860 --> 00:00:36,960
of security about a thousand years ago,

21
00:00:36,960 --> 00:00:38,730
but these days, I can simply fly

22
00:00:38,730 --> 00:00:39,780
over them with a drone

23
00:00:39,780 --> 00:00:42,180
and attack anybody inside of that castle,

24
00:00:42,180 --> 00:00:43,470
and those castle walls

25
00:00:43,470 --> 00:00:44,670
and that moat aren't going to be able

26
00:00:44,670 --> 00:00:46,590
to do anything to stop me.

27
00:00:46,590 --> 00:00:48,510
Well, this is exactly how most computer

28
00:00:48,510 --> 00:00:50,910
networks were secured over the past few decades.

29
00:00:50,910 --> 00:00:53,130
Cybersecurity experts configured their networks

30
00:00:53,130 --> 00:00:55,170
with strong external defenses like those

31
00:00:55,170 --> 00:00:57,660
castle walls by using things like firewalls,

32
00:00:57,660 --> 00:00:59,040
intrusion protection systems,

33
00:00:59,040 --> 00:01:01,050
and other perimeter-based defenses.

34
00:01:01,050 --> 00:01:03,210
But these days, many of our network devices

35
00:01:03,210 --> 00:01:04,650
aren't inside the perimeter.

36
00:01:04,650 --> 00:01:07,620
Instead, we call these deperimeterized.

37
00:01:07,620 --> 00:01:10,080
Now, we have to instead protect all of our systems

38
00:01:10,080 --> 00:01:12,240
and data using multiple levels of encryption,

39
00:01:12,240 --> 00:01:14,580
secure protocols, data-level authentication,

40
00:01:14,580 --> 00:01:16,740
and other host-based protection mechanisms,

41
00:01:16,740 --> 00:01:18,660
because using a perimeter only structure

42
00:01:18,660 --> 00:01:20,730
is simply not going to keep us safe when

43
00:01:20,730 --> 00:01:23,280
we're working in a deperimeterized world.

44
00:01:23,280 --> 00:01:24,900
From an operational perspective,

45
00:01:24,900 --> 00:01:27,090
most people love deperimeterization

46
00:01:27,090 --> 00:01:28,890
because it allows us to reduce our costs,

47
00:01:28,890 --> 00:01:30,630
conduct business transactions from anywhere

48
00:01:30,630 --> 00:01:32,430
in the world, and it's become increasingly

49
00:01:32,430 --> 00:01:34,650
more agile for us to use as an organization

50
00:01:34,650 --> 00:01:36,480
because we can work from anywhere

51
00:01:36,480 --> 00:01:38,250
at any time we want.

52
00:01:38,250 --> 00:01:40,380
The move to the cloud when combined with the rise

53
00:01:40,380 --> 00:01:42,150
of work from home has really increased

54
00:01:42,150 --> 00:01:44,100
our ability to conduct secure operations

55
00:01:44,100 --> 00:01:46,950
within a deperimeterized architecture as well.

56
00:01:46,950 --> 00:01:49,590
So deperimeterization has really occurred due

57
00:01:49,590 --> 00:01:51,030
to the migration into the cloud,

58
00:01:51,030 --> 00:01:52,320
the increase in remote work,

59
00:01:52,320 --> 00:01:54,300
and people embracing mobile technologies

60
00:01:54,300 --> 00:01:55,800
along with the rapid adoption

61
00:01:55,800 --> 00:01:57,480
and use of wireless networks,

62
00:01:57,480 --> 00:01:59,760
as we have this larger movement towards outsourcing

63
00:01:59,760 --> 00:02:02,520
and contracting inside of our organizations.

64
00:02:02,520 --> 00:02:04,770
But this whole deperimeterization movement

65
00:02:04,770 --> 00:02:06,540
does really introduce a lot of risk to

66
00:02:06,540 --> 00:02:09,330
our organizations too, if we're not careful.

67
00:02:09,330 --> 00:02:12,060
So to protect these deperimeterized networks,

68
00:02:12,060 --> 00:02:14,160
we simply can't rely on boundary defenses

69
00:02:14,160 --> 00:02:15,930
or perimeter defenses anymore.

70
00:02:15,930 --> 00:02:18,870
Instead, we have to implement a new best practice,

71
00:02:18,870 --> 00:02:21,060
which is called, Zero-Trust.

72
00:02:21,060 --> 00:02:23,250
Now, Zero-Trust is used to ensure the security

73
00:02:23,250 --> 00:02:25,860
of your corporate network and your corporate data.

74
00:02:25,860 --> 00:02:27,510
When we look at our traditional networks,

75
00:02:27,510 --> 00:02:28,740
we used to believe there are networks

76
00:02:28,740 --> 00:02:30,360
and our users were trusted because

77
00:02:30,360 --> 00:02:32,490
we gave them access to those systems.

78
00:02:32,490 --> 00:02:34,050
But under a Zero-Trust model,

79
00:02:34,050 --> 00:02:35,790
this is simply not the case,

80
00:02:35,790 --> 00:02:37,470
and that is considered to be a really

81
00:02:37,470 --> 00:02:39,930
good thing in today's modern world.

82
00:02:39,930 --> 00:02:41,287
You may have heard the old saying,

83
00:02:41,287 --> 00:02:43,500
"trust but verify," which is made famous

84
00:02:43,500 --> 00:02:46,320
by President Ronald Reagan back in the 1980s.

85
00:02:46,320 --> 00:02:48,210
But as cybersecurity professionals,

86
00:02:48,210 --> 00:02:50,520
we actually take this a step further.

87
00:02:50,520 --> 00:02:52,860
When we implement a Zero-Trust architecture,

88
00:02:52,860 --> 00:02:55,230
we instead want to quote our favorite mantra,

89
00:02:55,230 --> 00:02:56,317
and this mantra is,

90
00:02:56,317 --> 00:02:58,890
"trust nothing and verify everything."

91
00:02:58,890 --> 00:03:00,030
Because this really does sum up

92
00:03:00,030 --> 00:03:02,250
the entire architecture concept behind

93
00:03:02,250 --> 00:03:03,840
a Zero-Trust system.

94
00:03:03,840 --> 00:03:06,060
With Zero-Trust architectures, we demand

95
00:03:06,060 --> 00:03:08,280
that verification happens for every device,

96
00:03:08,280 --> 00:03:10,020
every user, and every transaction

97
00:03:10,020 --> 00:03:11,550
that's occurring within our network

98
00:03:11,550 --> 00:03:13,590
regardless of where it came from.

99
00:03:13,590 --> 00:03:15,210
This means that whether a user is attempting

100
00:03:15,210 --> 00:03:17,160
to access a system from within our organization's

101
00:03:17,160 --> 00:03:19,650
physical office or from over the Internet,

102
00:03:19,650 --> 00:03:21,750
because they're doing it from home remotely,

103
00:03:21,750 --> 00:03:23,910
their identity and permissions are always

104
00:03:23,910 --> 00:03:25,410
going to be verified.

105
00:03:25,410 --> 00:03:27,600
This methodology also addresses the changing

106
00:03:27,600 --> 00:03:29,610
nature of work and the digital landscape

107
00:03:29,610 --> 00:03:32,130
that is moved into a deperimeterized format

108
00:03:32,130 --> 00:03:34,110
while acknowledging that threats can emerge

109
00:03:34,110 --> 00:03:36,060
from both inside or outside

110
00:03:36,060 --> 00:03:38,100
of our organizational networks.

111
00:03:38,100 --> 00:03:40,800
Now, in order to create a Zero-Trust architecture,

112
00:03:40,800 --> 00:03:42,870
we're going to use two different planes.

113
00:03:42,870 --> 00:03:44,580
These are called, the control plane,

114
00:03:44,580 --> 00:03:46,170
and the data plane.

115
00:03:46,170 --> 00:03:48,330
Now, the control plane refers to the overarching

116
00:03:48,330 --> 00:03:49,830
framework and set of components that

117
00:03:49,830 --> 00:03:51,810
are responsible for defining, managing,

118
00:03:51,810 --> 00:03:54,270
and enforcing the policies related to the user's

119
00:03:54,270 --> 00:03:57,060
and system access within an organization.

120
00:03:57,060 --> 00:03:59,250
It provides a centralized way to dictate

121
00:03:59,250 --> 00:04:02,190
and control how, when, and where access

122
00:04:02,190 --> 00:04:04,050
is going to be granted to ensure that only

123
00:04:04,050 --> 00:04:05,970
authenticated and authorized entities

124
00:04:05,970 --> 00:04:08,250
can access specific resources.

125
00:04:08,250 --> 00:04:10,020
The control plane typically encompasses

126
00:04:10,020 --> 00:04:11,250
several key elements,

127
00:04:11,250 --> 00:04:12,930
including adaptive identity,

128
00:04:12,930 --> 00:04:15,030
threat scope reduction, policy-driven

129
00:04:15,030 --> 00:04:17,399
access control, and secured zones.

130
00:04:17,399 --> 00:04:19,589
First, we have adaptive identity.

131
00:04:19,589 --> 00:04:21,930
In Zero-Trust architectures, we're going to assume

132
00:04:21,930 --> 00:04:23,850
that static one-time verifications

133
00:04:23,850 --> 00:04:25,650
are no longer sufficient.

134
00:04:25,650 --> 00:04:28,020
So we have to use adaptive identities

135
00:04:28,020 --> 00:04:30,210
that rely on real time validation that's going to

136
00:04:30,210 --> 00:04:32,160
take into account the user's behavior,

137
00:04:32,160 --> 00:04:33,690
their device, their location,

138
00:04:33,690 --> 00:04:35,490
and other factors like that.

139
00:04:35,490 --> 00:04:37,710
By continually assessing these variables,

140
00:04:37,710 --> 00:04:39,870
our user identities are constantly adjusting

141
00:04:39,870 --> 00:04:41,880
and adapting to the environment in order

142
00:04:41,880 --> 00:04:44,910
to grant or restrict access to them as required.

143
00:04:44,910 --> 00:04:47,610
Second, we have threat scope reduction.

144
00:04:47,610 --> 00:04:49,890
Now, in Zero-Trust architectures, we want to

145
00:04:49,890 --> 00:04:51,900
limit our users' access to only what they

146
00:04:51,900 --> 00:04:53,700
need for their work-related tasks,

147
00:04:53,700 --> 00:04:55,110
because this will drastically reduce

148
00:04:55,110 --> 00:04:57,210
the network's potential attack surface.

149
00:04:57,210 --> 00:04:59,160
This approach is focused on minimizing

150
00:04:59,160 --> 00:05:00,540
the blast radius that could occur

151
00:05:00,540 --> 00:05:02,310
in the event of a breach, and ensures

152
00:05:02,310 --> 00:05:04,320
that the compromised credentials will not allow

153
00:05:04,320 --> 00:05:06,270
an attacker to have unimpeded access

154
00:05:06,270 --> 00:05:08,670
throughout your entire network or system.

155
00:05:08,670 --> 00:05:11,670
Third, we have policy-driven access control.

156
00:05:11,670 --> 00:05:13,560
Now, the policy-driven access control

157
00:05:13,560 --> 00:05:15,510
is going to develop, manage, and enforce

158
00:05:15,510 --> 00:05:17,280
user access policies.

159
00:05:17,280 --> 00:05:18,600
This is going to be based on the roles

160
00:05:18,600 --> 00:05:19,680
and responsibilities,

161
00:05:19,680 --> 00:05:21,630
and it helps us by defining clear policies

162
00:05:21,630 --> 00:05:23,850
that organizations can ensure that only users

163
00:05:23,850 --> 00:05:25,290
who have access to the data that's going to

164
00:05:25,290 --> 00:05:27,330
be pertinent to the role is going to exist,

165
00:05:27,330 --> 00:05:29,010
and this will help reduce the potential

166
00:05:29,010 --> 00:05:30,750
for successful data breaches against your

167
00:05:30,750 --> 00:05:32,460
organization as well.

168
00:05:32,460 --> 00:05:34,710
Fourth, we have secured zones.

169
00:05:34,710 --> 00:05:36,720
Now, secured zones are isolated environments

170
00:05:36,720 --> 00:05:38,070
within a network that are designed

171
00:05:38,070 --> 00:05:39,600
to house sensitive data.

172
00:05:39,600 --> 00:05:41,310
When you're dealing with a secure zone,

173
00:05:41,310 --> 00:05:43,110
only users with the appropriate permissions

174
00:05:43,110 --> 00:05:44,550
can access these zones,

175
00:05:44,550 --> 00:05:45,810
and this creates a further layer

176
00:05:45,810 --> 00:05:48,090
of isolation and protection.

177
00:05:48,090 --> 00:05:49,950
Now, in addition to the control plane,

178
00:05:49,950 --> 00:05:52,110
we also have something known as the data plane

179
00:05:52,110 --> 00:05:53,520
that we're going to use to properly implement

180
00:05:53,520 --> 00:05:55,620
our Zero-Trust architectures.

181
00:05:55,620 --> 00:05:57,030
While the control plane is going to layout

182
00:05:57,030 --> 00:05:58,590
the policies and procedures,

183
00:05:58,590 --> 00:06:00,120
the data plane is going to ensure those

184
00:06:00,120 --> 00:06:02,010
policies are being properly executed

185
00:06:02,010 --> 00:06:04,560
so data can flow across the network.

186
00:06:04,560 --> 00:06:06,510
Now, to secure our systems in a Zero-Trust

187
00:06:06,510 --> 00:06:08,550
architecture, we're going to rely on the use

188
00:06:08,550 --> 00:06:10,860
of subject systems, the policy engine,

189
00:06:10,860 --> 00:06:12,030
the policy administrator,

190
00:06:12,030 --> 00:06:13,980
and the policy enforcement point.

191
00:06:13,980 --> 00:06:15,750
These functions will often be split

192
00:06:15,750 --> 00:06:17,940
between the control plane and the data plane,

193
00:06:17,940 --> 00:06:19,650
and they serve as the four basic steps

194
00:06:19,650 --> 00:06:21,930
that we're going to use to verify and validate

195
00:06:21,930 --> 00:06:24,030
a user's request to access the network

196
00:06:24,030 --> 00:06:25,950
and transmit data over it.

197
00:06:25,950 --> 00:06:28,200
First, we have the subject system.

198
00:06:28,200 --> 00:06:30,360
The subject system refers to an individual

199
00:06:30,360 --> 00:06:32,970
or entity that's attempting to gain access.

200
00:06:32,970 --> 00:06:35,010
This could be an employee, a workstation,

201
00:06:35,010 --> 00:06:36,810
or even a software application.

202
00:06:36,810 --> 00:06:38,820
The primary objective here is to verify

203
00:06:38,820 --> 00:06:41,100
the authenticity of the subject or system

204
00:06:41,100 --> 00:06:43,200
before granting it access for them to be able

205
00:06:43,200 --> 00:06:45,540
to access your sensitive data or systems.

206
00:06:45,540 --> 00:06:47,640
The subject system will be evaluated by

207
00:06:47,640 --> 00:06:49,470
the control plane and its policies,

208
00:06:49,470 --> 00:06:51,390
and once authorized, the subject can then

209
00:06:51,390 --> 00:06:54,240
have its data transmitted by the data plane.

210
00:06:54,240 --> 00:06:56,310
Second, we have the policy engine.

211
00:06:56,310 --> 00:06:58,410
Once the subject's identity is verified,

212
00:06:58,410 --> 00:07:00,270
the policy engine is going to cross-reference

213
00:07:00,270 --> 00:07:03,270
the access request with its predefined policies.

214
00:07:03,270 --> 00:07:04,530
Think about it like a rule book

215
00:07:04,530 --> 00:07:06,300
that determines whether the request aligns

216
00:07:06,300 --> 00:07:07,890
with the subject's permissions.

217
00:07:07,890 --> 00:07:09,810
This policy engine works directly with

218
00:07:09,810 --> 00:07:11,700
the control plane because the control plane

219
00:07:11,700 --> 00:07:13,260
is what's overseeing the creation,

220
00:07:13,260 --> 00:07:15,120
management, and enforcement of the security

221
00:07:15,120 --> 00:07:17,730
policies for your entire network.

222
00:07:17,730 --> 00:07:20,220
Third, we have the policy administrator.

223
00:07:20,220 --> 00:07:21,870
Now, the policy administrator is another

224
00:07:21,870 --> 00:07:24,030
essential part of the Zero-Trust architecture

225
00:07:24,030 --> 00:07:25,950
model because it's going to be used to establish

226
00:07:25,950 --> 00:07:28,470
and manage the access policies themself.

227
00:07:28,470 --> 00:07:30,300
This is the entity that's going to dictate

228
00:07:30,300 --> 00:07:32,250
who gets to access what and ensures that

229
00:07:32,250 --> 00:07:33,540
the policies are in alignment

230
00:07:33,540 --> 00:07:35,490
with the organization's security protocols

231
00:07:35,490 --> 00:07:37,290
and business objectives.

232
00:07:37,290 --> 00:07:38,850
The policy administrator, together

233
00:07:38,850 --> 00:07:41,400
with the policy engine, does form the backbone

234
00:07:41,400 --> 00:07:43,170
of the control plane's functionality

235
00:07:43,170 --> 00:07:45,270
in a Zero-Trust architecture.

236
00:07:45,270 --> 00:07:48,000
Fourth, we have the policy enforcement point.

237
00:07:48,000 --> 00:07:50,280
The policy enforcement point is the final step

238
00:07:50,280 --> 00:07:52,200
in the process, and this is where the decision

239
00:07:52,200 --> 00:07:54,420
to actually grant or deny access is going

240
00:07:54,420 --> 00:07:56,880
to be executed. Based on the verification

241
00:07:56,880 --> 00:07:58,800
from the subject or system and the policy

242
00:07:58,800 --> 00:08:00,180
engine's determination,

243
00:08:00,180 --> 00:08:01,950
the policy enforcement point is going to

244
00:08:01,950 --> 00:08:03,660
then allow or restrict access

245
00:08:03,660 --> 00:08:05,730
and it will effectively act as a gatekeeper

246
00:08:05,730 --> 00:08:08,490
to the sensitive areas of your systems or networks.

247
00:08:08,490 --> 00:08:10,710
Essentially, the policy enforcement point

248
00:08:10,710 --> 00:08:12,270
is where the access control decisions

249
00:08:12,270 --> 00:08:13,950
are going to be applied, which happens

250
00:08:13,950 --> 00:08:15,870
in coordination with the control plane,

251
00:08:15,870 --> 00:08:17,280
and then the data will be sent over

252
00:08:17,280 --> 00:08:19,080
the network based on the request from

253
00:08:19,080 --> 00:08:20,880
that subject system, which means

254
00:08:20,880 --> 00:08:23,310
that only authenticated and authorized access

255
00:08:23,310 --> 00:08:25,290
will be permitted on the data plane,

256
00:08:25,290 --> 00:08:27,210
which is why the policy enforcement point

257
00:08:27,210 --> 00:08:28,950
is usually classified as being part

258
00:08:28,950 --> 00:08:30,570
of the data plane's functionality

259
00:08:30,570 --> 00:08:33,059
within a Zero-Trust architecture.

260
00:08:33,059 --> 00:08:36,150
So remember, Zero-Trust is a cybersecurity approach

261
00:08:36,150 --> 00:08:39,330
that assumes no user or system is trusted by default.

262
00:08:39,330 --> 00:08:41,220
It's going to require continuous verification

263
00:08:41,220 --> 00:08:43,230
for access to your organization's resources

264
00:08:43,230 --> 00:08:44,880
regardless of location or origin

265
00:08:44,880 --> 00:08:46,590
of that network request.

266
00:08:46,590 --> 00:08:48,960
Zero-Trust is more than just a security trend

267
00:08:48,960 --> 00:08:50,820
though, it really is the acknowledgement from

268
00:08:50,820 --> 00:08:52,440
the cybersecurity community that we are

269
00:08:52,440 --> 00:08:54,870
facing an ever-evolving digital landscape where

270
00:08:54,870 --> 00:08:56,310
threats can come from outside

271
00:08:56,310 --> 00:08:58,110
or inside of your network.

272
00:08:58,110 --> 00:08:59,850
While traditional perimeter-based defenses

273
00:08:59,850 --> 00:09:02,160
still hold value and they should be used,

274
00:09:02,160 --> 00:09:03,270
they are increasingly going

275
00:09:03,270 --> 00:09:05,010
to be insufficient on their own

276
00:09:05,010 --> 00:09:07,020
to protect your systems solely using

277
00:09:07,020 --> 00:09:09,120
a perimeter defense methodology.

278
00:09:09,120 --> 00:09:11,730
So as we navigate an age of remote work,

279
00:09:11,730 --> 00:09:13,710
cloud computing, and ever-increasing arrays

280
00:09:13,710 --> 00:09:15,330
of devices connecting to our networks

281
00:09:15,330 --> 00:09:17,340
from inside and outside of our network,

282
00:09:17,340 --> 00:09:19,770
Zero-Trust architecture principles will offer

283
00:09:19,770 --> 00:09:21,660
us a roadmap to creating a more robust

284
00:09:21,660 --> 00:09:23,610
and adaptable security posture.

285
00:09:23,610 --> 00:09:25,350
By integrating the Zero-Trust strategies

286
00:09:25,350 --> 00:09:27,810
and using our control planes and data planes,

287
00:09:27,810 --> 00:09:30,120
organizations can proactively defend against

288
00:09:30,120 --> 00:09:32,040
threats by recognizing that the trust

289
00:09:32,040 --> 00:09:34,710
is a commodity that must be earned, verified,

290
00:09:34,710 --> 00:09:37,380
and continuously reassessed at every enforcement

291
00:09:37,380 --> 00:09:39,753
point within your systems and your networks.