Cyber Defense eMagazine May 2019

Zero Trust Security
Security for the Cloud-Native Era
By Amir Sharif, Co-founder at Aporeto
Cybercrime on the Rise
Every day, hackers succeed at gaining access to the well-protected systems. Adversaries are more
skilled and better funded than ever, and traditional security measures are ineffective. In 2018, cybercrime
cost the global economy an estimated $600 billion – about 0.8 percent of global GDP. Security, previously
an afterthought in the world of cloud-native applications, has come to the forefront with this barrage of
data breaches that highlight critical flaws with legacy data center security systems.
These flaws? In a word (or two): IP addresses, and IP-based security. In the cloud-native era “location”
is no longer bound to a single data center; using IP address as a proxy for identity in an attempt to secure
applications becomes a fool's errand.
Castles and Moats
While most data centers are virtualized, they operate with the assumption that what is inside the firewall
can be trusted, and what is outside cannot. This is also referred to as the “castle-and-moat” mentality,
which focuses on the defense of the perimeters and turns a blind eye to anything already inside the castle
walls (presuming they have previously been cleared for access). This highlights a key failing of firewalls
and traditional perimeter security at large. If a malicious presence manages to gain access to the
infrastructure, it can easily begin both north/south and lateral attacks and wreak havoc before its presence
is even questioned.
Despite its present-day failings, this was an acceptable approach to security when applications were
monolithic or had a classic three-tier architecture. With the dawn of the cloud-native era, however,
applications have become disaggregated across public and private cloud, and using IP addresses to
secure applications becomes risky business. Broad adoption of both mobile and cloud technology has
begun to erase the data center perimeter. (One way to visualize this is as your handheld devices as
60