Cyber Defense eMagazine May 2019

Legacy Infrastructure
Legacy infrastructure and network devices are most certainly not zero trust-aware. They have no concept
of least privilege or lateral movement, and they do not possess authentication models that dynamically
allow for modifications based on contextual usage.
Any zero trust implementation requires a layered, or wrapper, approach to enable these systems.
However, a layered approach entails wrapping the external access to the resource and rarely can interact
with the system itself. This defeats the premise of zero trust. You cannot monitor the behavior within a
non-compatible application. You can screen scrape, keystroke log, and monitor logs and network traffic
to look for potentially malicious behavior, but your reaction is limited. You can only limit the external
interaction of the legacy device to the user or other resources—but not the runtime itself.
This limits the coverage of zero trust, and based on the characteristics of legacy infrastructure,
organizations may find that even monitoring network traffic is not feasible due to heavy encryption
requirements, including emerging standards like TLS 1.3.
P2P Communication
If you think your organization does not use peer-to-peer (P2P) networking technology, you are probably
unaware of the default settings in Windows 10.
Starting in 2015, Windows 10 enabled a P2P technology to share Windows Updates among peer systems
to save internet bandwidth. While some organizations turn this off, others are not even aware it exists.
This represents privileged lateral movement between systems that is fundamentally uncontrolled. While
no vulnerabilities and exploits have materialized for this feature, it does present communications that
violate the zero trust model. There should be no unauthorized lateral movement—even within a specified
micro perimeter.
In addition, if you use mesh network technology, you will find that they operate completely counter to zero
trust. They require P2P communications in order to operate, and the trust model is based strictly on keys
or passwords with no dynamic models for authentication modifications.
Therefore, if you decide to embrace zero trust, you need to investigate if your organization has P2P or
mesh network technologies, even for wireless networks. These present a huge stumbling block to
embracing the access, segmentation, and microperimeter controls required for zero trust.
Digital Transformation
Even for organizations that are in a position to build a brand-new datacenter, implement a role-based
access model, and embrace zero trust 100%, there is the challenge posed by digital transformation.
43