philip_industry zero trust presentation ppt

Zero trust

1. Philip Wong
Principal Solution Architect
Cisco Greater China
End 2 End Zero Trust Network Security Framework

2. © 2020 Cisco and/or its affiliates. All rights reserved.
•Trends and Challenges
•A Practical Zero Trust Approach
•Use Case
•Call for Collaboration
Agenda

3. © 2020 Cisco and/or its affiliates. All rights reserved. © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public
Shift in IT Landscape
Users, devices and apps are everywhere
Evolving
Perimeter
Remote Users
Personal &
Mobile Devices
IOT Devices
Cloud
Applications
Hybrid
Infrastructure
Cloud
Infrastructure

4. © 2020 Cisco and/or its affiliates. All rights reserved.
© 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Traditional Security is like a castle

5. © 2020 Cisco and/or its affiliates. All rights reserved.
© 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
What about“Least-Privilege Access”(i.e. grant access, but make a very specific)
üFocus on data protection,
not on attacks
üAssumes all environments
are hostile and breached
üNo access until user +
device is proven “trusted”
üAuthentication not equal to
Authorization

6. © 2020 Cisco and/or its affiliates. All rights reserved.
TODAY2004201020142017
Jericho ForumZTBeyondCorpCARTA & ZTXZTA
De-perimeterisation
An international group of
CISOs and Vendors
Focus on solving “de-
perimeterisation” problem
Early output calling for “the
need for trust”
Multiple Models Emerge
Forrester coined Zero Trust.
Google published their ZT
solution as BeyondCorp.
Forrester expands to Zero
Trust eXtended.
Gartner named their model
Continuous Adaptive Risk
and Trust Assessment.
Generalized
The industry has
largely accepted
Zero Trust
Architecture as
the general term.
A brief history of Zero Trust

7. © 2020 Cisco and/or its affiliates. All rights reserved.
© 2019 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Zero TrustArchitectural “Pillars”
vEliminate Network Trust
vExternal and internal threats
exist at all times
vEvery user, device, app and
network flow is authenticated
and authorized
vPolicies-based and must be
dynamic; postures calculated
from as many sources as
possible
vConstant logging, monitoring
and re-scoring
vAutomation is key to build and
operate a ZT architecture

8. © 2020 Cisco and/or its affiliates. All rights reserved.
Cisco Zero Trust Approach
vMulti-factors of User Identity
vDevice context and Identity
vDevice posture & health
vLocation
vRelevant attributes & contect
“Least Privilege Access” to:
vNetwork
vApplications
vResources
vUsers & Devices
vOriginal tenets used to
establish trusts still true?
vThreat Traffic?
vBehavior baselining
vMalicious or anomalous
actions?

9. © 2020 Cisco and/or its affiliates. All rights reserved.
Sample Zero Trust Architecture
Control Plane
Data Plane
Policies Establishment
Polices Enforcement
Workload / App
Inventory
Device
Inventory
User
Inventory
Policy Information Point (PiP) Policy Administration Point (PaP)
Policy Decision Point (PdP)
Policy Information Point (PiP)
ZT Policy EngineTrust EngineOther
Sources
Legacy
App
EndpointNetwork Equipment
IPS, FW
App
Legacy
App
Legacy
App
Internet
SaaS
SaaS
Policy Enforcement Point (PEP)
Feedback Loop
CLOUDs
On-Premise
Network
Applications
Mode 1
Mode 2

10. © 2020 Cisco and/or its affiliates. All rights reserved.
Zero Trust Use Case Scenarios
Workload / App
Inventory
Device
Inventory
User
Inventory
WORKFORCEWORKLOADWORKPLACE
Device
Inventory
User
Inventory
+ Network / Location Context
PoliciesPolicies

11. © 2020 Cisco and/or its affiliates. All rights reserved.
Ø“No more network centric authentication”
ØShifting to “a serverless world”
ØApplication Services relationship@uto-discovery
ØConstantly Monitor flows
ØApplyMachine Learning, baselining activities, identify anomalous, …
ØEstablish and Simulate Trust Policies
ØMulti-domain enforcement
ØAgents
ØPolicy-based network
Ø3rdparty OPEN integration
WorkloadWORKLOAD

12. © 2020 Cisco and/or its affiliates. All rights reserved.
•Mode 1 Applications transition to Micro-
Services
•Safeguard Interaction between Mode 1 and
Mode 2
•Securely expose Mode 2 Services to ultimate
consumers
WORKLOAD

13. © 2020 Cisco and/or its affiliates. All rights reserved. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public
Embracing Other contextual data
13

14. © 2020 Cisco and/or its affiliates. All rights reserved. © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public#CiscoLiveLA

15. © 2020 Cisco and/or its affiliates. All rights reserved.
Expand to a much wider scope with context data exchange

16. © 2020 Cisco and/or its affiliates. All rights reserved.
•Publish/Subscribe Model with Bi-directional Context Sharing and
Consuming Control
Cisco Platform Exchange Grid (pxGrid)
IOT Ecosystem partner (e.g. MRI)
Policy Enforcement Point

17. © 2020 Cisco and/or its affiliates. All rights reserved.
•Platform Exchange for context sharing and innovative integration
between
•IOT Devices
•Thin Applications
•Further information
•Cisco Zero Trust
•https://www.cisco.com/c/en_hk/products/security/zero-trust.html
•pxGridWhite Paper
•https://pubhub.devnetcloud.com/media/pxgrid-
api/docs/overview/Cisco_pxGrid_White_Paper_09192018_JE.pdf
•https://developer.cisco.com/site/pxgrid/
Call for Collaboration