An Insider Look at Zero Trust with GDIT DevSecOps Experts

As cyber attacks have become ever more sophisticated, the means of protecting against cyber attacks have had to become more stringent. With zero trust security, the model has changed from “trust but verify” to “never trust, always verify.” 

 

Joining D2iQ VP of Product Dan Ciruli for an in-depth discussion of zero trust security was Dr. John Sahlin, VP of Cybersolutions at General Dynamics Information Technology (GDIT), and David Sperbeck, DevSecOps Capability Lead at GDIT.

 

Kubernetes Brings New Complexities

As Ciruli notes, prior to the cloud and Kubernetes, we had a “castle model” in which the technology was more static. Protection in this model was through demilitarized zones, firewalls, and virtual private networks (VPNs). In the castle model, Ciruli explains, “we based our system of trust on whether or not a call to a particular system was coming from inside the castle or not. And as it turns out, that wasn't a very secure way to run a network.”

 

One of the challenges to implementing zero trust in a Kubernetes environment is the dynamic nature of Kubernetes. As Dan Ciruli points out, “By default, Kubernetes isn't secure.” One of the reasons Kubernetes is difficult to secure is the ephemeral nature of Kubernetes. “We not only have workloads that are coming up and down, we have dynamic clusters,” Ciruli explains.

 

As David Sperbeck points out, with Kubernetes running in the cloud, everything that is part of that infrastructure now has to be trusted with an identity certificate, not just individuals. “You have to be able to say which of those devices and nodes that are in Kubernetes are allowed to talk to other projects and under what conditions and what type of data is passing,” he explains.

 

Zero Trust Requires a Dynamic Mindset

Among the key points made in the discussion was that zero trust is not a single formula or model. Because of the dynamic nature of a cloud and Kubernetes environment, practicing zero trust effectively requires flexibility and a mindset that can adjust to conditions as they change.

 

As David Sperbeck notes, securing an environment by default “is not something that's one and done,” adding that, “It's a constant refresh to look at the security aspects of it and what the risks are.”

 

In addition to the policies, rules, and procedures related to technology, Sperbeck explains, there are cultural aspects to how you're setting up who is trusted by who and when, “but you have to change your thought and mindset in order to be able to do that.”

 

Dr. Sahlin points out that you can issue and revoke certificates of trust based on what's going on  based on what you're monitoring and seeing in the environment. “Policies are great, but if they're static, they might end up working against us in terms of securing and protecting our data,” he explains.

 

Zero Trust as an Enabler

Although the U.S. government has mandated that zero trust be implemented by 2024, compliance and government mandates are not good reasons to implement zero trust, says Dr. John Sahlin. A better reason is to improve business processes and increase efficiency. 

Besides bringing additional layers to secure an organization’s data, “zero trust allows us to use security not just as a lock, but as a key,” says Dr. Sahlin. Zero trust becomes not only a guard but an enabler to make an organization more efficient, he explains. Zero trust can remove restrictive barriers that cause bottlenecks and onerous productivity-draining access processes.

 

“We can actually use zero trust principles to help make the operating environment more efficient and more effective for the people who have to get the job done and execute the mission.”

 

Measuring Zero Trust Success

The experts agree that there is no single metric that can be used to measure zero trust success. 

 

Zero trust, says Dr. Sahlin, is a conditional consent model that is all about monitoring the behavior of the individual and of the interaction. “It’s like asking you to borrow your car. Do you trust me? The decision is based on a number of variables.”

 

One of the ways to measure zero trust success, says Dr. Sahlin, is to find a way to measure the friction introduced in the organization with each new control. “There are red flags when people try to get access to data that would be unusual for them based on their role and their job.”
 

What are the best practices for achieving zero trust? As Ciruli points out, you do need to know who everyone is. It's also every service on your network. Issuing certificates of trust is a way to provide identities that can be verified. And because our systems have so much system to system traffic now, you need to also issue these identities securely.

 

One of the ways to measure zero trust effectiveness, Ciruli notes, is through Mutual Transport Layer Security (mTLS), which enables two parties to authenticate each other during the initial connection of an SSL/TLS handshake.

 

Ultimately, to succeed in implementing zero trust, says Ciruli, “You're going to have to change some of your processes. You're going to have to change your culture. You're going to have to educate your people. So the time to start with all this is now.”

Listen to the full recording of “How to Meet Zero Trust and Other Government Standards.”

 

Find more expert security tips, guides, and best practices on the D2iQ Security Hub.

 

To learn how D2iQ can help you implement a successful zero trust initiative, speak with the Kubernetes security experts at D2iQ.