WIXLIB

AKAMAI WHITE PAPERMoving Beyond Perimeter SecurityA Comprehensive and Achievable Guide to Less RiskAuthor:Charlie Gero – CTO, Akamai TechnologiesEnterprise and Advanced Projects Group

Table of ContentsA Brief History of Network Architecture1The Rise of Cloud1Zero Trust2Google BeyondCorp 3Akamai Cloud Security Services4Application Access vs. Network Access6Desired End State7Application Access7Internet Access8Architectural Visualization8Getting from A to B9Pre-Staging Assumptions9User Grouping9User Grouping Methodology101. Application Precheck Stage112. Access Proxy Preparation Stage113. Test Lab Enrollment Stage114. Security Upgrade Stage115. Performance Upgrade Stage126. External User Enrollment Stage137. Internal User Enrollment Stage138. VLAN Migration Stage13Post-Staging Operations13Summary13Appendix14

Moving Beyond Perimeter Security1A Brief History of Network ArchitectureIt’s hard to imagine that almost 50 years have passed since the first four computer systems were strung together onthe Internet’s precursor, ARPANET. As that technology has evolved from rudimentary packet-switched networks to acomplex and dizzying array of autonomous systems around the world acting in concert to get data where it needs tobe, so too have the threats that utilize that technology. We have seen over the past 10 years crippling DDoS attacks,data breaches that affect hundreds of millions of people, data exfiltration from sensitive government systems, the riseof ransomware, and so much more.But for all of the change that has happened over this period of time, both goodand bad, there is one thing that has remained stubbornly constant: the basic huband-spoke network architecture that most companies utilize.Hub-and-SpokeNetwork ArchitectureThis architecture used to make sense. Long ago, before the Internet was a bustlingplace of business and core infrastructure, companies placed their workloads in datacenters. These data centers housed the critical infrastructure and applications necessaryto perform their duties. As branch offices, retail storefronts, and satellite locationswould come online, they too would need access to the centralized applications, andso companies would build out their networks to mirror that need, with all networkingbackhauling to their core data centers. After all, the data center was the central locationwhere all the action occurred.As time progressed, the Internet began to emerge as a commercially viable disrupter. SSL was invented by engineersat Netscape in 1994, enabling online commerce, and employees began to demand certain corporate services beattainable through the Internet. Naturally, businesses and carriers who had been in the practice of building complexglobal networks serviced these requests by doing what they knew best: deploying these services in the same datacenters their internal applications were hosted in, and purchasing Internet links to provide a route to them. Thisfortuitously served a double purpose: Outside consumers could get in, but internal employees spread out acrossmyriad branch offices could now get out. For the time being, hub-and-spoke was still the reigning champion ofnetwork architectures.Over time, threat actors began to capitalize on this architecture, causing a whole new industry to be born: the datacenter security stack. Since the hub-and-spoke architecture funnels Internet traffic at data centers, large powerfulboxes began to be developed for those high-capacity lines. Firewalls, intrusion detection, and prevention would ruleinbound traffic while secure web gateways would enforce acceptable use in the outbound direction. The proliferationof these security systems being deployed at centralized choke points would further serve to cement hub-and-spokeas the dominant network architecture. For a time, the castle-and-moat approach to security seemed viable, and thenotion of a network perimeter where everyone outside is bad and everyone inside is good remained dominant.The Rise of CloudIn 1964, five years before our four machines at ARPANET came online, Bob Dylan wrote The Times They Are aChangin’. A more true statement could not have been said about the dominance of cloud in the past decade. AsSaaS emerged, companies began to realize that it is both easier and far safer to rely upon third parties to managesupporting systems that aren’t part of their core initiatives. Why run an internal CRM when you can have SaaSproviders do it in the cloud, on their own managed servers, which is seemingly far safer and more performant?Even systems long thought to be too critical to migrate such as email, Active Directory (AD), and identity are nowmoving into global cloud infrastructure with the rise of Office 365 and G Suite.Further accelerating this change is the emergence of infrastructure as a service (IaaS) and cloud compute. Insteadof just offloading ancillary support systems through SaaS, products such as Amazon AWS, Microsoft Azure, andGoogle’s Compute Platform allow businesses to virtualize the very physical infrastructure itself in an on-demand,pay-as-you-consume fashion. This adds a never-before-seen level of agility in deploying your mission-critical corebusiness applications.

Moving Beyond Perimeter Security2Simply put, your applications are on the move. But they are not alone.Today’s workforce is increasingly mobile. For many corporations,employees are just as likely to be found in a coffee shop, workingat home, or in an airport as they are in a cubicle in an office.Inside TrustedApp 1As a result, the network perimeter no longer exists. At least not in anyrecognizable form. Your employees and applications are in many casesjust as likely to be outside of the moat as they are inside. And withadvanced persistent threats and malware, you are highly likely toinadvertently let the malicious actors inside of the perimeter withfull access to your most valuable assets.App 2App 3Utilizing a security and access approach that made sense 20 years ago in the modern world is at best misalignedand at worst perilous. Forrester Research says in Future-Proof Your Digital Business With Zero Trust Security:The data economy renders today’s network, perimeter-based security useless. Asbusinesses monetize information and insights across a complex business ecosystem,the idea of a corporate perimeter becomes quaint — even dangerous.And this isn’t just theory. This is evident in the massive amount of data breaches we’ve seen in the past five years,the vast majority of which happened as a result of trust being abused inside of the network perimeter.Further exacerbating this problem: Applications that were designed to live inside of a network perimeter oftenhave the worst security profiles. After all, if you were a developer 10 years ago and assumed that only authorizedemployees with good intentions could reach your system, would you have been as defensive as the coder todaywho knows vast armies of hackers will try to exploit his or her Internet-based application?So what are you to do?Zero TrustRoughly five years ago, John Kindervag, a thought leader in this space and a Forrester analyst at the time,proposed a solution that he termed “Zero Trust.” The principle behind it is quite simple, but very powerful:Trust is not an attribute of location. You shouldn’t trust something simply because it is behind your firewall.Instead, you should take a very pessimistic view on security where every machine, user, and server shouldbe untrusted until proven otherwise.The method of proof for this is strong authentication and authorization, and no data transfer should occuruntil trust has been established. In addition, analytics, filtering, and logging should be employed to verifycorrectness of behavior and to continually watch for signals of compromise.Inside TrustedThere isno insideApp 1App 1Zero TrustApp 2App 3App 2App 3

Moving Beyond Perimeter Security3This fundamental shift in posture defeats a vast amount of the compromises we have seen in the past decade.No longer can attackers spend time exploiting weaknesses in your perimeter, and then exploit your sensitivedata and applications because they made it inside of the moat. Now there is no moat. There are just applicationsand users, each of which must mutually authenticate and verify authorization before access can occur.How does one accomplish this?Google BeyondCorp A few years ago, Google debuted their vision for zerotrust access in several seminal white papers known asBeyondCorp. What makes BeyondCorp compelling isthat it attempts to solve the zero trust problem for allapplications, without modifying their code, and achieveaccess in an effortless manner regardless of where theapplication or user lives. In a simplified diagram fordiscussion purposes, it looks like the following:AccessProxyApp 1App 2App 3DeviceInventoryDatabaseApp 4Micro-perimeterIn this diagram, we see a number of items: A User and Laptop: In Google’s model, users needing access to internal applications have a managed laptopwith a certificate installed on it. This laptop also runs a small software agent. Access Proxy: The server that sits on top of the micro-perimeter line is known as an access proxy. Its job is toenforce secure access policies to applications within the micro-perimeter. It is the only entity that can directlyreach the applications (aside from the applications communicating directly with each other) and lives in the DMZof the micro-perimeter. Device Inventory Database: The database in the diagram is responsible for keeping a record of the securityposture of all Google employee laptops and devices. It is periodically updated with new information. Applications: These are the applications that employees need access to. These might be things like Git, email,internal knowledge bases, finance applications, databases, etc. These are not directly accessible outside of themicro-perimeter. Micro-perimeter: The applications are cordoned off from the rest of the world by a micro-perimeter. The onlyserver that can bridge that gap is the access proxy. Additionally, this micro-perimeter need not be in a physicaldata center. It is just as valid to have this perimeter in a cloud compute environment like GCP or AWS.Operationally, the BeyondCorp workflow is extremely simple and yet powerful. On a regular basis, the softwareagent running on the Google employee’s machine connects to the Device Inventory Database and gives a postureassessment of the device. It details attributes like which operating system is installed, which patches are present,the state of applications, AV, etc.The Device Inventory Database takes this information, and through the assistance of a component known as theTrust Inferrer (not shown) produces an evaluation or score of the laptop. In Google’s actual implementation, data isnot limited to the software agent on the end user’s device. It can also come from vulnerability scanners running ontheir network, router and firewall logs, etc. In essence, the Device Inventory Database continually collects as muchinformation as it can to determine, out of band, the security posture of the device itself.