Zero Trust: Palekana

Zero Trust: Palekana

Speakers: Dave Lewis, Global Security Advocate, Akamai Technologies

Conference: LocoMocoSec

YouTube: https://www.youtube.com/watch?v=fYFMkWHbmyM

Overview

In his LocoMocoSec talk, "Zero Trust: Palekana," Dave Lewis, Global Security Advocate at Akamai Technologies (formerly Global Advisory CISO at Duo Security, part of Cisco Systems), delves into the critical paradigm shift that Zero Trust represents in modern cybersecurity. Drawing inspiration from the Hawaiian word "Palekana," meaning "to be safe and protected" and "to ward off danger," Lewis argues that Zero Trust is far more than a mere marketing buzzword; it is a fundamental and necessary approach to security in today's increasingly complex and decentralized digital landscape.

Lewis emphasizes that the traditional "castle-and-moat" security model, which assumes trust once inside the network perimeter, is utterly broken and has been for centuries. The talk systematically dismantles this outdated notion, illustrating why a model of "never trust, always verify" is essential for protecting users, devices, and applications in an era defined by remote work, hybrid clouds, and Bring Your Own Device (BYOD) policies. His presentation serves as a clarion call for security practitioners to return to core fundamentals, advocating for a proactive and adaptive security posture that reduces risk and fosters a more resilient organizational defense.

The article explores the historical context of Zero Trust, outlines practical steps for its implementation, and highlights the pervasive vulnerabilities that continue to plague organizations. Lewis provides actionable insights into how businesses can devalue stolen credentials, complicate lateral movement by attackers, and ultimately achieve a state of "Palekana" – a deep and pervasive sense of safety and protection – across their entire digital ecosystem. This comprehensive overview sets the stage for a deep dive into the technical and strategic imperatives of adopting a Zero Trust framework.

Background

▶ Watch: Introduction: Zero Trust as Palekana (safety) (0:00)

The concept of Zero Trust is not a recent invention, though its urgency has never been greater. Dave Lewis traces its origins back to the Jericho Forum in 2003-2004, a group that published papers on de-perimeterization, recognizing the inherent flaws in perimeter-based security long before the widespread adoption of cloud computing and remote work. This foundational work laid the groundwork for what would later be formally coined "Zero Trust" by Forrester analyst John Kindervag in 2010. Kindervag's terminology, Lewis notes, was crucial in capturing attention and galvanizing interest in principles that security practitioners should have been adhering to for decades.

A pivotal example of Zero Trust in practice comes from Google's BeyondCorp initiative. Google transparently published papers detailing their multi-year journey to implement a Zero Trust framework, offering invaluable lessons learned for the wider industry. This demonstrated that while the transition to Zero Trust is a long and iterative process, it is achievable and yields significant security benefits.

The contemporary landscape, however, has dramatically accelerated the need for Zero Trust. The "new normal" characterized by ubiquitous remote work, the shift to cloud-enabled applications, the prevalence of multi-cloud access, and the necessity of BYOD (Bring Your Own Device) policies has rendered the traditional network perimeter obsolete. As Lewis aptly states, "the perimeter is anywhere an access decision is being made." Organizations, often forced into rapid digital transformations (some pivoting to remote work in as little as 10 hours during the early days of the pandemic), frequently accumulated significant security debt. This debt, stemming from accepted risks and expedient solutions, continues to compound, highlighting the critical need for a structured and verifiable approach to access.

Lewis powerfully illustrates the historical failure of perimeter-based security with an anecdote from 410 AD: the Sack of Rome. The Visigoths didn't breach Rome's walls; they surrounded the city and waited until its resources ran out, proving that a perimeter alone is insufficient against a determined adversary. Fast forward to today, and organizations continue to face a barrage of threats, from misconfigured Amazon S3 buckets leading to massive data exposures to pervasive vulnerabilities like Eternal Blue, Heartbleed, and BlueKeep found on internet-facing systems. These persistent issues, often exacerbated by weak credentials (implicated in 81% of data breaches) and compromised devices (70% of breaches), underscore the urgent need for a security model that trusts nothing and verifies everything.

Key Findings

▶ Watch: Five high-level steps to implement Zero Trust (10:15)

Dave Lewis's talk distills several key findings and principles essential for understanding and implementing a successful Zero Trust framework. Foremost among these is the assertion that Zero Trust is fundamentally about reducing risk and cost within an organization, ultimately leading to "a better night's sleep" for security professionals. It shifts the focus from an implicit trust model to one of explicit verification, regardless of whether the user or device is "inside" or "outside" a traditional network boundary.

A core finding reiterated throughout the presentation is that the perimeter has evolved to be "anywhere an access decision is being made." This means security controls must be applied at the user, device, and application level, rather than solely at the network edge. Lewis categorizes these critical areas into three buckets: workload (applications, data), workforce (users), and workplace (devices, environments).

The journey to Zero Trust is presented as an incremental process, not an overnight transformation. Lewis advises against trying to "boil the ocean," instead recommending that organizations "pick their battles" by focusing on manageable steps such as network zone segmentation, user management, device management, and multi-factor authentication (MFA). Each of these elements contributes to reducing overall risk.

Lewis highlights prevalent and ongoing security weaknesses that Zero Trust aims to address:

• Weak Credentials: Citing statistics from reports like the Verizon DBIR, Lewis notes that 81% of data breaches involve weak or stolen credentials. The reuse of passwords across multiple sites is a critical vulnerability that attackers actively exploit.
• Compromised Devices: 70% of data breaches are linked to compromised devices, emphasizing the need for robust device posture assessment and management, especially in BYOD environments.
• Misconfigured Cloud Resources: Amazon S3 buckets are frequently misconfigured, often set to public by default or due to user error, leading to significant data exposure. Lewis stresses that this is a communication failure on the part of security practitioners to educate non-security personnel.
• Unpatched Systems: Despite being known for years, critical vulnerabilities like Eternal Blue (found on 952 systems in the US), Heartbleed (48,000+ systems), and BlueKeep (21,000+ systems) remain prevalent, demonstrating a widespread failure in patch management that attackers readily exploit for initial access and lateral movement.

Finally, Lewis underscores the critical role of communication within organizations. Security teams must move beyond being the "Flaming Sword of Justice" constantly saying "no," and instead foster better dialogue with business units to convey risks effectively and gain buy-in for security initiatives. This collaborative approach is essential for successful Zero Trust adoption and sustained security improvement.

Technical Deep Dive

▶ Watch: Why traditional perimeter security no longer works (14:15)

Dave Lewis outlines a clear, multi-step framework for implementing Zero Trust, focusing on establishing trust in identities, devices, and applications. He presents two complementary models: a conceptual five-step approach and a more granular seven-step operational flow.

The five conceptual steps for approaching Zero Trust are:

1. Confirm All User Identities: This involves a thorough audit to ensure that every user account corresponds to a legitimate, active employee or authorized entity. Lewis shares a cautionary tale of finding superuser accounts belonging to individuals who had left, or even passed away, years prior, highlighting the dangers of poor user management.
2. Gain Visibility into Access Requests: Organizations must monitor what users are attempting to access. An individual in finance trying to access a code repository, or a backend system administrator suddenly taking interest in HR systems, should trigger alerts and policy enforcement. This requires continuous monitoring and a robust asset inventory of applications and data.
3. Ensure Device Security: All devices accessing organizational resources, whether corporate-owned or BYOD, must meet defined security standards. This includes ensuring they are patched to current (or N-1), have up-to-date operating systems, and possess necessary security configurations (e.g., hard disk encryption, screen savers). Device posture assessment is critical to prevent vulnerable devices from introducing risk.
4. Enforce Contextual Policies: Access decisions are not binary; they are based on context. Policies should dictate who can access what, from where, on what device, and at what time. For example, a user attempting to access sensitive data from an unknown device in an unusual geographic location should be challenged or denied. This prevents unauthorized access and limits the blast radius of compromised credentials.
5. Secure Access to All Applications: All applications, whether on-premise or cloud-based (SaaS), should be accessed through a secure gateway, often functioning as a reverse proxy. Users authenticate strongly (e.g., with MFA) to this gateway, which then presents them with the applications they are authorized to use. This eliminates direct public exposure of applications and centralizes access control.

The operational Zero Trust flow expands on these concepts:

1. Establish Trust in User Identities: This is achieved through strong authentication mechanisms, primarily Multi-Factor Authentication (MFA) and increasingly passwordless authentication solutions like WebAuthn. MFA is described as the "gateway drug" to Zero Trust, effectively devaluing stolen credentials by requiring a second factor.
2. Evaluate the Trustworthiness of the Device: Beyond basic patching, this involves assessing device posture (e.g., jailbroken status, presence of default SSH passwords, disk encryption, security software).
3. Enforce Access Policies on User/Device Combinations: Policies are dynamically applied based on the combined trust level of the user and their device. An unknown device or an unusual user behavior triggers stricter controls.
4. Enable Secure Connections to All Applications: All connections to applications are secured and brokered by the Zero Trust platform, ensuring encrypted and authorized access. Lewis stresses that there's "no reason that any John Q. Public can connect to it from a coffee shop."
5. Collect All Sorts of Data: Comprehensive logging and data collection are essential for understanding network activity and user behavior.
6. Look for Anomalies: The collected data is analyzed to detect unusual or suspicious activities, indicating potential compromises or policy violations.
7. Continually Validate for Authorization: Trust is never absolute or permanent; it's continuously re-evaluated throughout a session.

Beyond these flows, Lewis emphasizes several critical technical enablers:

• Network Zone Segmentation: This is paramount to prevent lateral movement by attackers. He recounts working at an organization with a "flat network that spanned the globe," enabling him to query systems in Southeast Asia from Toronto—a glaring security flaw. Proper segmentation restricts an attacker's ability to pivot from a compromised system to other critical assets.
• Asset Inventory: A foundational requirement is a detailed, up-to-date inventory of all users, devices, and applications on the network. Without knowing what needs protecting, effective Zero Trust is impossible.
• Defined, Repeatable Processes: Implementing methodologies like ITIL can significantly reduce incidents. Lewis shares an anecdote where an ITIL rollout reduced incidents by 76% in three months, demonstrating the power of structured operational processes.
• Encryption: Data must be secured in flight and at rest. He mentions MIT's CryptDB as an example of an encrypted database that allows for searchable encrypted data, showcasing advanced cryptographic solutions.
• WebAuthn: Presented as the "next new hotness," WebAuthn is an open standard published by the W3C for passwordless authentication. Lewis passionately advocates for its adoption as a superior alternative to static passwords, acknowledging its current limitations (e.g., with legacy applications, user training, server-side signature handling) but stressing its potential to revolutionize authentication.

In essence, the technical deep dive reveals Zero Trust as a holistic, data-driven approach that leverages strong authentication, granular policy enforcement, continuous monitoring, and robust foundational security practices to create a resilient defense against a constantly evolving threat landscape.

Demo / Proof of Concept

▶ Watch: Practical starting points for Zero Trust adoption (26:30)

This presentation focused on conceptual frameworks, historical context, strategic implementation methodologies, and defensive implications of Zero Trust rather than a live demonstration or proof of concept. Dave Lewis's talk provided a comprehensive overview of the philosophical and practical aspects of adopting a Zero Trust model within an organization.

Defensive Implications

▶ Watch: Q&A: Security debt and WebAuthn for authentication (40:00)

The adoption of a Zero Trust framework has profound defensive implications, fundamentally altering how organizations protect their assets and respond to threats. Dave Lewis outlines several key actions defenders should take based on Zero Trust principles:

1. Devalue Stolen Credentials: The primary goal is to render compromised usernames and passwords useless to attackers. This is achieved through:

• Mandatory Multi-Factor Authentication (MFA): Lewis calls MFA the "gateway drug" to Zero Trust. Even if an attacker obtains credentials, they lack the second factor, significantly hindering access.
• Passwordless Authentication (WebAuthn): Implementing open standards like WebAuthn eliminates static passwords entirely, removing a major attack vector and making credential theft far more difficult.
• Eliminate Password Reuse: Enforce policies and educate users against reusing passwords across multiple services.

1. Complicate Lateral Movement: Once an attacker gains initial access, their next goal is typically to move deeper into the network. Zero Trust aims to make this exceedingly difficult:

• Network Zone Segmentation: Break down flat networks into smaller, isolated segments. This limits an attacker's ability to pivot from a compromised system to other critical resources, forcing them to re-authenticate and re-verify at every segment boundary.
• Granular Access Controls: Enforce least privilege access, ensuring users and devices only have access to the specific applications and data absolutely necessary for their function.
• Contextual Policies: Implement policies that dynamically assess risk based on user, device, location, and behavior. If an anomaly is detected (e.g., unusual access patterns, a device with poor posture), access can be denied or escalated for further verification.

1. Establish a Robust Asset Inventory and Management: Defenders cannot protect what they don't know they have.

• User Management: Implement rigorous onboarding, offboarding, and regular auditing processes for user accounts. Ensure accounts for departed employees are immediately disabled or removed.
• Device Management: Maintain a comprehensive inventory of all devices accessing the network, both corporate and BYOD. Implement device posture assessment to ensure devices meet security baselines (patch levels, security configurations, encryption).
• Application Inventory: Understand all applications in use, their data flows, and their criticality.

1. Prioritize Patch Management and Vulnerability Remediation: Lewis highlights the persistent threat of known vulnerabilities like Eternal Blue, Heartbleed, and BlueKeep on internet-facing systems. Defenders must:

• Maintain Current Patch Levels: Implement strict policies for patching operating systems and applications to mitigate known exploits.
• Regularly Scan for Vulnerabilities: Actively identify and remediate vulnerabilities in both internal and internet-facing systems.

1. Implement Continuous Monitoring and Behavior Analytics: Trust is never static; it must be continuously evaluated.

• Collect Comprehensive Logs: Gather data on all access attempts, user activities, and device states.
• Monitor for Anomalies: Use behavior analytics to detect deviations from normal user or device behavior, which could indicate a compromise.
• Automate Responses: Where possible, automate responses to policy violations or detected anomalies, such as isolating a device or requiring re-authentication.

1. Foster a Culture of Security Communication: Security teams must bridge the gap between technical controls and business understanding.

• Educate Users: Communicate risks clearly, especially regarding common pitfalls like password reuse, phishing, and the dangers of misconfiguring cloud resources (like S3 buckets).
• Collaborate with Business Units: Engage stakeholders to understand their needs and integrate security into business processes, rather than acting as a roadblock.

By embracing these defensive implications, organizations can move away from a reactive, perimeter-focused defense to a proactive, identity- and context-aware security model that is far more resilient against modern threats.

Key Takeaways

• Zero Trust is a Fundamental Shift, Not a Buzzword: It moves beyond the outdated "castle-and-moat" perimeter model to a "never trust, always verify" approach, recognizing that the security perimeter is now "anywhere an access decision is being made."
• Implementation is an Incremental Journey: Organizations should not attempt to "boil the ocean" but rather focus on manageable, incremental steps like network zone segmentation, robust user and device management, and multi-factor authentication to gradually reduce risk.
• Strong Authentication is Foundational: Multi-Factor Authentication (MFA) is a critical "gateway drug" to Zero Trust, effectively devaluing stolen credentials. Future-proofing involves embracing passwordless authentication standards like WebAuthn.
• Visibility and Control Over Assets are Paramount: A comprehensive, up-to-date inventory of all users, devices, and applications, coupled with strong user and device management processes, is essential for enforcing contextual access policies and preventing unauthorized access or lateral movement.
• Network Segmentation and Contextual Policies are Crucial: Breaking down flat networks and applying granular, context-aware access policies (who, what, where, when, on what device) significantly complicates an attacker's ability to move laterally and reduces the potential impact of a breach.
• Continuous Monitoring and Communication are Key: Organizations must constantly collect data, monitor for anomalies, and foster open communication between security teams and business units to effectively manage risk and adapt to evolving threats.

About the Speaker(s)

Dave Lewis is a seasoned cybersecurity expert with a remarkably long and diverse career in the field, spanning back to his early days in 1983. Currently serving as a Global Security Advocate at Akamai Technologies, he previously held the influential role of Global Advisory CISO for Duo Security, which is part of Cisco Systems. Lewis is known for his passion for fundamental security practices and his ability to communicate complex security concepts with clarity and engaging analogies. He holds a deep appreciation for Hawaiian culture, reflected in his choice of "Palekana" (meaning safe, protected, and warding off danger) for the talk's title. Throughout his career, Lewis has been a vocal advocate for proactive security measures, emphasizing the importance of strong authentication, robust asset management, and effective internal communication to reduce organizational risk. His talks frequently draw on historical context and real-world anecdotes, including his own past mistakes, to illustrate enduring security principles.