Cloud Native Computing Foundation Production Identity Day: SPIFFE + SPIRE North America 2021, 30 Oct 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Economics of Zero Trust - Frederick Kautz, Sharecare & Ed Warnicke, Cisco

Description

Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Economics of Zero Trust - Frederick Kautz, Sharecare & Ed Warnicke, Cisco

Technology has attempted to endlessly and mindlessly increase the cost of exploits to attackers. This is a losing game, because the *cost to defenders* of increasing the *cost to attackers* has become a game of diminishing returns.

Economics teaches different lessons. It teaches that ultimately the system is about the interplay between costs and benefits. Costs and benefits for the attackers. Costs and benefits for the defenders.

If you really want to understand Zero Trust, come here how to think beyond the technology to the economics of security and learn how SPIFFE can play a critical role in increasing the risk and decreasing the value of attacks.

A

Everybody welcome to frederick coutts. Thank you very much for coming. He's gonna give our second keynote. uh He is joined by ed, virtually um in heart and in spirit.

A

I was not able to make it out over here. I just want to make sure you can hear me: okay, perfect, okay, so we're going to talk a little bit about economics of zero trust. So uh when people think of economics, they usually think of things like oh supply and demand. While that is important, I want you to consider for security, the concept of risk and reward.

A

So when you're starting to look at, should I make an investment? Should I make a particular move? Should I should I get up and drive to my work, you're, saying the there's, a risk involved, you're making an informed decision and for for the possibility of receiving a specific reward.

A

So what you need to look at when you're starting to look at zero trust is what is in it for the for the attacker for for the person who wants to break into the system. uh While there are people who are doing it for uh for exposure or so on.

A

Most of the advanced, persistent threats that we see tend tend to be, or or also the people are looking at uh at running, script, kitties or or similar tend to be the people who are looking for some for some reward they're. They want to go mine bitcoin or they want to go exfiltrate something out, and so you have to look what is the reward of breaking into a given system and in deciding whether they want to break into that system?

A

They're going to look at what is the risk like what is the chance of me being caught? If I am cut, then what is the penalty for being caught like this being caught me and I just get kicked out of the system, pretty pretty low risk versus?

A

uh Please show up your house and arrest you much higher risk and then based upon that, you want to look at what is the opportunity cost with with that? So when you start looking at an advanced versus some threats like even they have to look at the at the total cost, because we think of them as like having these massive quantity of resources, certainly more than any most individuals have.

A

But when you start to look at uh like if you're a nation state looking to see about attacking a specific target, even nations have limited resources and they have to consider. Well. If I spend time focusing on a specific area, then I don't have uh those those same resources cannot be applied another in other places, so even with them, they have to consider the the opportunity cost.

A

So when you think of is when you start thinking from a defender's perspective, if you have similar things as well like what is the value of what I'm protecting like?

A

What is what is the value and opportunity of what we're trying to to do and what is the risk attached to that as well so and risk when you start looking at that risk you're looking at not only what is the impact, but also what is the likeliness that something is going to is going to happen, and you tie this down to how much value is lost when an incident occurs, uh that that value loss is what's called an exposure factor, and so these are the type of things when you're approaching it from the defender side that you tend to that, you tend to look at so the cost of the defender.

A

If, when you're working with infos, infosec teams or security teams, you'll very often see this particular or some variation of this, like, I have an incident that happens. What is the? What is the value of that particular system, and what is the exposure factor?

A

Remember how much loss is there or what is the penalty if there is an incident occurs so for a single event, it can be difficult to quantize uh this to quantity, but it, but at the same time, this is something that people will spend the time trying to work out as like across a whole across all of my infrastructure. If I lose a hard drive, what is the? What is the value of that? If a microservice is broken into?

A

What is the value of that and what is the value lost or what are the additional penalties? And then? How often is that going to happen over the year, which gives you the annualized loss expectancy, so over a given year? We can expect to lose this much over various incidents and so on, and that gets us down to the final thing, which is the the the real value of the thing you have is not just the value itself, but the cost of maintenance, the cost of what happens if there's a security incidence over over time.

A

What is that? What is the loss in that? So when you start talking with in with infosec people, this they're looking at it from this using this like if you go and take a cissp exam, they're they're, this is literally the kind of stuff that they're that they're looking at is these type of values, and so uh so as developers. What we have to consider is what is the cost of? What we are producing is not just from the cost of development, but what is the cost of operations?

A

What is the cost of management, and if we cannot keep those cost of management down, then they're not going to take our products they're not going to they're not going to if the cost of spiffy inspire or the cost of zero trust is too high, then it's not going to be applied, so we have to consider that as a whole and so in xero trust, there's three primary areas that we can focus on where we can apply our efforts.

A

The first one is identity, which everyone here I assume you've bought into or you're here to learn, congratulations. The second part is policy, so identity and policy are two different things. We people often will complete them, say: authentication authorization they're. Actually you want to keep the two of them as two separate ideas.

A

Authentication informs authorization and authorization makes the decisions, not not not the authentication. So so we have the second thing here policy. What can we do? The third one we have is control. It used to be listed as automation, but it turns out there's a much more fundamental concept.

A

Why do we automate we automate so that we can control things at scale? So we want to make sure that we can control what we are doing and make sure that we loop in the humans at the right moment, so we can make decisions that get automated across across the system. So, whenever you're focusing on zero trust, you want to focus on these three particular items and make sure that you establish a good foundation for for each.

A

So we focus on identity. If you establish a good identity story that can become the foundation for the rest of your system and what policy should I apply? Attach them to the cryptographic identity, attach them to something like spiffy and over time that that identity becomes very robust, because if you think about how do we identify systems today, we identify them based upon ip and port combinations. In most environments, you look at the network access control list, they're ip imports, they're not looking at what? What cryptographic identity did you bring to the table?

A

So this needs to change, because if we can move away from ip addresses and and ports towards cryptographic identities, that means we can write policies that are declarative, that we're able to say these systems are allowed to talk to that system and they become they become much more robust.

A

You can actually re-ip your entire system underneath and it continues to work you're able to connect to other companies who are running a similar system and say: okay, I'm going to bind to this ca, I'm going to bind to to these specific set of identities in the other environment which allows you to treat internal and external systems with the same policy engine. So the difference is no longer technical. How you treat internal and external, it becomes.

A

What is my policy that I can that I can drive, and this becomes incredibly important for multi-cloud and hybrid, because if you think about spiffy spiffy becomes an identity you can use everywhere, everyone can can land a nest fit if you can pass the testers. So if you've ever worked on a on an amazon environment, you have things like the document identity or if you're in google, you have things like workload, identity.

A

It ties you to the. I am account of those environments, they don't nicely jump over from one to the other or, if you're running a hybrid.

A

So if you use those to to a test into a spiffy identity and that specific identity becomes like water, like dial tone, as was mentioned in the previous talk, then this becomes something that you can rely upon across the infrastructure, and that means that when you have a workload that you need to to drive and need to work out what you want to do with it, you're not asking low-level questions like what cloud am I on what uh what security things have?

A

I have I tossed into that you're saying I have drew the issuance of this identity and continuous maintenance of that identity.

A

You are attesting that this particular identity meets your meets your requirement, so one last part as well is that we also want to focus on open source standards, because when you drive down to drive down the cost, this is something that can become very expensive, especially if you end up with a lot of different identity, a lot of different types of identities.

A

So we want to focus on open standards that allows us to amortize the cost of the maintenance of identity across multiple across multiple groups across multiple end users can advertise across themselves. So, for example, we ended up putting together a support for the aws kms. Now anyone can use it now. Anyone is able to to rely on that and any changes that people make in other works will make will get the use of that as well.

A

So it also helps you reduce the reliance on a single vendor and as the and as the community matures you also find that that will that will give you the talent that you'll see the talent begin to increase. So with that that comes to the end of my of my presentation. So I want to thank you all for coming over and uh and learning and for collaborating, and we will see you throughout the rest of the of the conference. Take care.