en en en tr es id en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en ca es es ne en en kn en en en en en en en en en en en en en en en en en en en en en en en en en en en en pt it it en pt en en en en en en en en en en pms en en en en en en en pt fa it en it pt it fr en it en en en en en en en it en en en it pt en en en en en ceb en en it it en en en en en en en en en en en en ia it en en de en en en en en en en en it it en pt en en en en en en en en en en en en en en en it de en en en en en en en en en en pt en en it it en az en en en en uk en en en en en en en en en en en en en en en en en en en en pt en en en en en en en en en en en en en en en en en en
Shankar Kumarasamy Cloud, Cloud Computing, Intelligent Behavior Detection, Zero Trust Model February 25, 2020 4 Minutes
The term architecture in recent days has evolved so much to the extent that the architect is not only taking care of the application architecture but also the components involved in the successful implementation of the architecture. Security is important as we start integrating multiple offerings from different platforms. Platforms here include the likes of on-prem services, multiple cloud offerings in the form of IaaS, PaaS, and FaaS. Also, a single application can spread its information and services across all platforms. In this context, it is not just the north-south network traffic that has to be authenticated and authorized but also the east-west traffic that has to be monitored for security.
What is the traditional trust model that is mostly followed?
Let us see this in 2 different ways –
North – south traffic – Traffic that is coming from open internet space to the server instances where the application is hosted crossing your firewall, routers and the load balancers. The most common industry-standard to trust a request is by validating a JWT token issued by an Identity Provider(IdP) following oAuth 2.0 using the JWKS way of authentication. The other way to access the servers for privileged users is through a secure VPN tunnel.
East – west traffic – Traffic that is internal to the network that doesn’t leave. Once when the request reaches the internal servers, in this case, the traffic within the internal components within the same network are simply trusted. As there is a huge rise in the multi-cloud way of horizontal scaling, the east-west traffic extends to the hub and spoke or site-to-site VPN model of traffic distributions across clouds.
Either way, in both scenarios, trust is guaranteed by preset parameters. Once when the trust is compromised the intruders get unlimited access and control over the secured systems. Our preset parameters will not be able to differentiate a request coming from a genuine user or a malicious intruder.
The need for zero trusts at the user and service level
Even-though the zero trust model was primarily focused on addressing the fundamental flaw of traditional security strategies, it gives a new way of thinking into application architecture (BeyondCorp) and the deployment architecture (BeyondProd).
As high-security standards are emerging, the same way the hackers are also getting smart day by day. It is not sufficient to just trust the tokens that every request carries, rather we should find a way to derive at the trust score for the incoming request and based on that eliminate many of the requests.
Zero trust is inevitable because of some of the following instances –
Multiple form factors (Web apps, Mobile apps, Voice assistants, AR, VR, etc) using the same API to utilize the data – It is necessary to understand the context of the request and then share the data.
Multi-cloud environment means there is a flow of traffic from multiple applications to multiple cloud environments – It is necessary for the services to trust each other and know how much level of data can be shared between the services.
From Google’s blog on BeyondCorp and BeyondProd –
Where BeyondCorp states that “user trust should be dependent on characteristics like the context-aware state of devices and not the ability to connect to the corp network”, BeyondProd states that “service trust should be dependent on characteristics like code provenance and service identity, not the location in the production network, such as IP or hostname identity”
Who should know about the new security paradigms?
Unlike older days where security is treated as a separate entity, in the modern-day application development, even the developers should be aware of the security standards like zero trust. Understanding how zero trust model works will help in determining the right architecture of the application.
Guiding principles of zero trust model –
Below are the guiding principles for any zero trust model as suggested by BeyondCorp
Perimeterless design – Connecting from a particular network must not determine which services you can access.
Context-Aware – Access to services is granted based on what we know about you and your device.
Dynamic Access Controls – All access to services must be authenticated, authorized and encrypted.
BeyondCorp – Zero trust guiding principles
How to achieve a zero trust model?
Zero trust does not replace any of the existing architecture. Rather it is an enhancement or add-on to the existing security architectures. So, is zero trust an overkill to your application architecture? It depends on the way the application architecture has arrived. It is really an engineering challenge to come out with a good user experience without adding too much of security challenge in the existing flow.
Zero trust is not just a software that can be installed overnight. Zero trust involves 2 main things –
Architecture design – Knowing the context and origin of the request is core to the zero trust architecture. We have to determine the parameters to be considered to eliminate the trust on the request. Consider only the meaningful parameters that adds context about the user or the device.
Implementation engineering – AI/ML-driven policy enforcement engine helps determining the trust of the request that comes through. A trust score can be derived and the data to be shared can be determined based on the trust score. The different enforcement policies should be reviewed over a time.
Products like Apigee sense helps to identify anomalies by building algorithms based on the metadata captured in the Apigee API management platform. The intelligent behavior detection algorithms can be tweaked as per the needs and requirements of our application.
Below is an illustration of BeyondCorp implementation in Google Cloud Platform –
GCP – Context-Aware Access
Examples of user experience in a zero trust model –
Zero trust doesn’t refer to a specific technology or product, however, it is achieved by the application of several technologies.
1. An account activity alert sent in your smartphone when trying to access Gmail from some other location or a new device. In this case, there is no real blockage for the user, however, an alert is sent to the closest form factor that the user may currently use. The context is not just used to determine the trust of the request but also in pushing the alert to the most trusted device the user may be in possession of now.
2. Challenging with security questions even-though the right password is used. Some times Captcha’s are misunderstood for zero trust. However, Captcha’s help in preventing the bots from submitting the forms multiple times or with unwanted content.
Share your thoughts on the different mechanism that you would implement to achieve zero trust model in network and application architecture.
Published by Shankar Kumarasamy
Digital leader and technology enthusiast with experience in varied functional areas specializing in mobility and cloud backend. Areas of specialization include: 1) Solutions architecture - Enterprise-scale solution consulting to determine major IT investments, 2) Technical architecture - End-to-end system and integration architecture including hardware and software, 3) Applications architecture - Multi-cloud native server-less application architecture, 4) Data architecture - Canonical data architecture and design including support to multi-tenancy data models, 5) Identity architecture - Different LoB identity management solutions involving SSO for customer 360 experience, 6) Security architecture - Eliminate digital risk by designing the flow of data between people, systems, and things with granular and only the needed access View all posts by Shankar Kumarasamy
Published February 25, 2020
Previous Post My experiment with the latest android flash tool
Next Post Covid#19 – The first true test for modern technologies
Leave a Reply Cancel reply
Enter your comment here...
Fill in your details below or click an icon to log in:
Email (required) (Address never made public)
You are commenting using your WordPress.com account. ( Log Out /  Change )
You are commenting using your Twitter account. ( Log Out /  Change )
You are commenting using your Facebook account. ( Log Out /  Change )
Notify me of new comments via email.
Notify me of new posts via email.
This site uses Akismet to reduce spam. Learn how your comment data is processed.
Android App Bundle (1)
Android Flash Tools (1)
Application Integration Strategy (2)
Best Mobile Apps – 2018 (1)
Cloud Next 2018 (1)
Contact Center AI (1)
EV Charging Station (1)
Google AI Solutions (1)
Google IO 2019 (1)
Google IO 2021 (1)
Google Play Store (1)
Hybrid ML for Mobility (1)
Intelligent Behavior Detection (1)
Intelligent Mobile Solutions (3)
Mobile Application Development Strategies (7)
Mobile World Congress (1)
Mobility In 2019 (1)
Modern Tech Tools (4)
Multi Cloud Strategy (4)
Self driving cars (3)
Self Sovereign Identity (SSI) (1)
Zero Trust Model (1)
AI Amazon Android AndroidP API APIOrchestration ApplicationDevelopment AWS Azure BigDataAnalytics Blockchain Cloud CloudComputing CodingCulture ConnectedDevices DataFirst DigitalTransformation Edge EdgeComputing ElectricVehicle Firebase FutureCode FuturisticSolutions GCP GigEconomy Google GoogleHome GoogleIO2017 GooglePlayStore IdentityManagement IntelligentMobileApplications iOS IoT Learn MachineLearning Microsoft ML MobileAppsDevelopment MobileDevelopers MobileTechnology Mobility MobilitySolutions ModernTechTools MultiCloudStrategy On-DeviceLearning ServerlessComputing Strategy UbiquitousComputing VoiceAssistants VR
© [Shankar Kumarasamy] and [shankarkumarasamy.blog], [2017-2020].
Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited.
Excerpts and links may be used, provided that full and clear credit is given to [Shankar Kumarasamy] and [shankarkumarasamy.blog] with appropriate and specific direction to the original content.
Archives Select Month September 2022  (1) August 2022  (1) July 2022  (1) June 2022  (1) May 2022  (1) April 2022  (1) February 2022  (1) January 2022  (1) December 2021  (1) November 2021  (1) October 2021  (1) September 2021  (1) August 2021  (1) July 2021  (1) June 2021  (1) May 2021  (1) April 2021  (1) March 2021  (1) February 2021  (1) January 2021  (1) December 2020  (1) November 2020  (1) October 2020  (1) September 2020  (1) August 2020  (1) July 2020  (1) June 2020  (1) May 2020  (1) April 2020  (1) March 2020  (1) February 2020  (1) January 2020  (1) December 2019  (1) November 2019  (1) October 2019  (1) September 2019  (1) August 2019  (1) July 2019  (1) June 2019  (1) May 2019  (2) April 2019  (1) March 2019  (1) February 2019  (2) January 2019  (1) December 2018  (2) November 2018  (2) October 2018  (2) September 2018  (1) August 2018  (1) July 2018  (1) June 2018  (1) May 2018  (2) April 2018  (1) March 2018  (2) February 2018  (1) January 2018  (2) December 2017  (2) November 2017  (2) October 2017  (3) September 2017  (2) August 2017  (3) July 2017  (4) June 2017  (4) May 2017  (5) April 2017  (4) March 2017  (2)
Follow Blog via Email
Enter your email address to follow this blog and receive notifications of new posts by email.
Join 47 other followers
Start a Blog at WordPress.com.
Join 47 other followers
Already have a WordPress.com account? Log in now.
View post in Reader
Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.