For years it has been an “us” vs “them” mindset in security. The bad folks are somewhere in the world—name a current adversarial country or organization—and our company is filled with good people. Therefore, if we build a big barrier around our company we can keep out the bad and everything is good, right?
The crunchy perimeter & squishy center security model has come and gone - at least it should be gone. It’s a relic of an old time and has no place in today’s modern enterprise defense. For those of you that may be fortunate to have avoided it, what is this model? Here’s the quick info. The idea was to build a strict and highly regulated perimeter around the company. Firewalls blocked almost all traffic in and out. Any exceptions were strictly reviewed and scrutinized. Laptops either didn’t leave the office at all or maybe had a forced VPN to tunnel all traffic back through the office network. While the perimeter was strong, once inside there was a more relaxed environment of trust. Because, hey, we can trust all of our employees, right? (in general, sure, as a global policy, definitely not)
What happened to this model? My argument isn’t that we should dissolve the perimeter or cast those efforts as worthless. Instead, we must accept that the paradigm has shifted. There is no longer a formal boundary between outside and inside or “us” and “them”. The rise of cloud computing, SaaS applications, continued connectivity to business partners, contract workforces, BYOD and more all mean that the “internal” network is a very busy place with many different people, systems, and notably - many threats.
Two Big Reasons to Ditch the Strong Perimeter & Squishy Center Mentality
First, insider attacks are a real concern and not just a theoretical exercise. Insider attacks may be the result of malice or just carelessness, but there is no denying that they are happening. The 2019 Verizon Data Breach Report shows that in some sectors “Privilege Misuse and Error by insider account for 30 percent of breaches”. Multiple articles also show how prominent techcompanies have felt the impact of overzealous employees abusing their access to private data.
Second, even if we assume there are no malicious insiders, the squishy center mentality means that once inside the network, an adversary has free rein. Taking this one step farther, we're essentially saying that if an attacker ever finds a vulnerability in the perimeter then the breach is not just a perimeter breach, but likely a massive breach of internal systems and data too!
We agree, the internal network is untrusted. Now what?
Although the internal network may not be trusted, this doesn’t mean we throw out the firewalls and just let it be a free-for-all. Instead, let’s double down on the concept of least privilege, which the perimeter is the first step to broadly eliminate access to the world unless they authenticate via VPN. The next logical step is applying least privilege inside the network. In other words, shift the mentality in all places to enforce strong authentication, access control, and minimal access policies. One way to think about this is that the company network is essentially a coffee house wireless network. No trust is implicitly granted just because a person is in a particular physical location and has internet access. Instead, trust is proved whenever access to systems and data is required.
Here are a few concrete steps to help move a company in this
The migration from a long held security approach and belief system may be challenging. You’ll undoubtedly have naysayers and others that believe this work is paranoid and unwarranted. In all areas of security it’s critical to return to fundamental risk modeling practices. If your company is moving forward to adopt new technology architectures and business relationships, then your threat model is evolving too. Through your risk management you either accept the new risk, hold back the business by denying technologies or update mitigating controls to safely enable the business. The only thing I hope you don’t do is cling to old truths that no longer hold - unless verified by your fresh risk evaluation specific to your company’s profile, risk model and controls.
Want to chat? Find me @_mwc
Fill in some contact info below or schedule a meeting so we can reach out to provide more details on how Altitude Networks can protect you from data loss in the cloud.