Software defined perimeter: A Zero trust security model

Introduction

Think about the case where an IOT device is accessing a service via VPN. A VPN allows access to a network. It means that simply hacking the IOT device can allow to access the critical network of your company. And the hacker can access critical servers in this network. Can we avoid this? This topic helps in this direction.

Laymen explanation

A software-defined perimeter (SDP) is a way to hide Internet-connected infrastructure (servers, routers, etc.) so that external parties and attackers cannot see it, whether it is hosted on-premises or in the cloud.

Another way to think of SDPs is to imagine a front door that is always kept locked. No one can come through the door, or even look inside, until the person on the other side of the door verifies who the visitor is and what they are doing. Once the visitor is allowed inside, the person in the house locks the door again.

Technical explanation

With an SDP, it should not be technologically possible to connect with a server unless authorized to do so. SDPs allow access to users only after 1) verifying user identity, and 2) assessing the state of the device. The goal of the SDP approach is to base the network perimeter on software instead of hardware. A company that uses an SDP is essentially draping a cloak of invisibility over their servers and other infrastructure so that no one can see it from the outside; however, authorized users can still access the infrastructure.

Why this is needed

Traditional fixed perimeters (For example, VPN based setup) help protect internal services from external threats via simple techniques for blocking visibility and accessibility from outside the perimeter to internal applications and infrastructure. But the weaknesses of this traditional fixed perimeter model are becoming ever more problematic because of the popularity of user-managed devices and phishing attacks, providing untrusted access inside the perimeter.

Next step to VPN?

While VPNs enable all connected users to access the entire network, SDPs do not share network connections. This helps to provide finer control. In the world of IOT devices accessing network, any hacking can expose the critical resources for VPN based solution.

How it works

Connectivity in a Software Defined Perimeter is based on a need-to-know model, in which device posture and identity are verified before access to application infrastructure is granted. Application infrastructure is effectively “black” (a DoD term meaning the infrastructure cannot be detected), without visible DNS information

Simple SDP flow

In its simplest form, the architecture of the SDP consists of two components as mentioned below

• SDP Hosts and

• SDP Controllers

SDP uses two separate channels

• • Control channel

  • Data channel

Below are SDP properties.

• SDP Hosts can either initiate connections or accept connections.

• These actions are managed by interactions with the SDP Controllers via a control channel (see below figure).

  • SDP Controllers decides list of servers (SDP Hosts) to be allowed for access by client. It informs servers for accepting connections and then gives these servers list to the client.

• In a Software Defined Perimeter, the control plane is separated from the data plane to enable greater scalability. In addition, all of the components can be redundant for higher availability.

Security factors to grant access

• User identity verification

• Device verification

• SDP controller approval

Reference

https://en.wikipedia.org/wiki/Software_Defined_Perimeter

https://www.cloudflare.com/learning/access-management/software-defined-perimeter/

https://www.linkedin.com/posts/dpkumar_informationsecurity-zero-cybersecurity-activity-6704029556745089024-uy6v

https://youtu.be/1D5mg9an19o

https://www.brighttalk.com/webcast/19298/535272