In one of the biggest data breaches ever, a hacker gained access to more than 100 million Capital One customer accounts and credit card applications affecting 100 million people in the U.S. and 6 million people in Canada.
According to Capital One, the breach was attributed to a simple vulnerability allowing a bad actor to gain access by exploiting a misconfigured web application firewall. The company expects to incur between $100 million and $150 million in costs related to the hack, including customer notifications, credit monitoring, tech costs and legal support due to the hack.
The incident is the latest in a series of high-profile attacks that exploited simple vulnerabilities that could have been prevented by implementing a Zero Trust strategy.
Zero Trust is a philosophy for designing network security architecture in a way that withholds access until a user, device or even an individual packet has been thoroughly inspected and authenticated. Even then, only the least amount of necessary access is granted. An adage commonly ascribed to zero-trust security is “never trust, always verify,” an evolution from the old “trust but verify” approach to security.”
Waverley Labs believes that Zero Trust as a strategy is an improvement and makes sense but is complicated to implement with current networking architectures.
In the Zero Trust strategy as outlined by Forrester, firewall, VPN and other vulnerabilities still exist. Unauthorized users who clone a VPN client and steal the keys can also access the mail server and then guess other user names and passwords and perform malicious acts such as DDoS, credential theft, and more. A VPN may allow you to log into the network and not allow you use other services (e.g. SharePoint) that are not on the mail server network segment. But, because unauthorized users are already in the network, they can get to a SharePoint server by using hacking techniques. By allowing users to access a network and then access to services, and then letting the service to determine whether the user can access the service, is an issue. Access before authentication allows users (good and bad) to have access to all the services – not just login, but access.
According to the Cloud Security Alliance, what is missing is the “deny all, authenticate first” security architecture that is the signature of the Software Defined Perimeter (SDP). SDPs dynamically create one-to-one connections between every authorized device, user and the data they access. Anyone attempting to access a resource must “authenticate first.” This applies the principle of least privilege to the network and completely reduces the attack surface. By default, users are not allowed to connect to anything – the opposite of traditional corporate networks, where once a user is given an IP address, they typically connect first prior to logging in and potentially have access to everything on the network.
Instead, SDPs ensure that once proper access criteria are met, a dynamic one-to-one connection is generated from the user’s machine to the specific resource needed. Everything else – including vulnerabilities – are completely invisible making the solution truly secure.
To learn more, check out this webinar Utilizing a Zero Trust Model to Defend IoT Driven DDoS Cyber Attacks where the CSA endorses the implementation of its own SDP as the most advanced architecture for a Zero Trust strategy. Also, check out this Zero Trust use case utilizing SDP.