Building a Core of Security Around the Data, Not Just the Network
The core concepts of zero trust, such as assuming a cybersecurity breach has happened, coupled with advanced identity and credentialing management, microsegmentation and software-defined networking, are now being applied to protecting information and data, not just computer networks, cybersecurity experts said, speaking December 6 at AFCEA International’s inaugural TechNet Transatlantic conference in Frankfurt, hosted by AFCEA Europe.
Zero-trust concepts have also evolved to support more flexible networking, security automation and military black networks.
To start, organizations should select a data technology that is fluid and follow the more modern rules of backing up information, offered Jim Cosby, chief technology officer, Public Sector, NetApp.
“Data security is going to be paramount, whether it's a data fabric, whether it's a datacentric security focus,” Cosby said. “When you look at zero trust and security, applications, the network and the data all need to work hand-in-hand to have a smooth function. ... Data has to be protected, no matter where it is.”
Cosby moderated a panel at the conference with Lt. Col. Phillip Alvarez, USAF, commander, 1st ACOS at Ramstein Air Base, Germany; Jeremy Guiles, lead engineering consultant, Juniper Networks; and retired Col. Dean Hullings, USAF, strategist, Global Defense Solutions, Forescout Technologies.
“I think whatever data technology someone picks, you should try to pick a data technology that is fluid and has that data as close as possible to the users in the application where that mission is happening, and where that needs to function,” Cosby said.
For Guiles, a network engineer and an Army veteran, zero trust presents a path away from the rigid, complicated network structures that did not adapt well to mission operations and were hard to operate. “And they probably caused as much pain to us as the actors that we were trying to defend our networks against,” he said. When applied effectively, zero trust can provide flexibility as well as then-necessary security, which is crucial for complex missions.
“With zero trust, it's about breaking those rigid barriers down and providing access to the data no matter where we are, no matter what we are doing because the missions are constantly changing and we need to be able to adapt,” Guiles noted. “And at the end of the day we have data, we have warfighters, and we need to give the warfighters access to the data that they need so they can do their jobs more effectively.”
With zero trust, it's about breaking those rigid barriers down and providing access to the data no matter where we are, no matter what we are doing because the missions are constantly changing and we need to be able to adapt.
Hullings considered the importance of thoroughly understanding all network connections, including any connected devices and the devices’ security posture.
“What does that device do and are we okay with what that device is doing?” he asked. “Those kinds of aspects go hand-in-hand with the user. There are two pieces to every connection—the user and the device that that user is using. And when we talk about operational technology, a lot of times there's not even a user. So those devices are going to be just as important to understand everything about them.”
Another key aspect that could be integrated more into zero trust is automation, Hullings continued. “We need to free up our airmen, our soldiers, sailors and Marines from doing day to day redundant tasks to bring up the security posture of the entire network. We need to automate those kinds of activities.”
