Zero Trust Architecture and Data & AI

Perimeter Security : Usual Method

The usual method has been focussed on ensuring that a secure network perimeter surrounded the enterprise data center or where the application or service is deployed. This was an easy enough assumption earlier when assets worked almost exclusively within the data center. Security architects were really happy as their design was around traditional network security methods which are matured enough to give you 100s of options and easy to understand landscape.

Trust No one : New method : Zero trust Architecture

The traditional architecture and assumptions are not enough anymore as DEPLOY ANYWHERE and accessible via internet + edge and cloud capabilities become day to day reality

This method assumes that the service/workload/application is out in the open. No protection is provided by the network perimeter. This means that application design should always assume following

• Network Perimeter/region/location is not sufficient for deciding trust in a network. Always assume internal/external threat everywhere
• Every flow is authenticated and authorized.
• Services/Apps must be able to get policies dynamically (from a centralised place - may be) and should be able to self adjust to the changing policies without support from network

What it means to Data & AI?

What makes this whole scenario very interesting with AI is its un relenting appetite for data. AI needs data to be intelligent and keep its identity.

This brings forward so many interesting points for thought

1) How do you prevent data leakage? Its nothing but un authorised transmission of data to unintended recipients or destinations.

2) Most of these data are either significant or sensitive enough that each data breach would be potential to the customer

3) without data - AI is non existent.

Beginning to solve this problem : Stick to the basics

Couple of fundamental principles allows us to design a secure architecture which can be deployed even in a very insecure or unknown network

All of these controls are known to us already

1) Verify everything: No implicit trust. All the services even internal microservices in your stack must verify, authenticate and authorise. This must be done as a first step.

2) Monitor configuration changes and drifts

3) There should be a centralised place dynamic security and compliance policies can be sent to all your workloads. Your application must be smart enough adapt these changes.

4) Encrypt the data in transit and storage. You could use BYOK kind of methodologies to ensure a data leaked is as good as no risk. Patterns like structured encryption could be used to make sure that a LOST DATA IS A STALE data. A structured encryption scheme?encrypts structured data?in such a way that it can be queried through the use of a query- specific token that can only be generated with knowledge of the secret key. In addition, the query process reveals no useful information about either the query or the data.

5) watch your traffic. Log it and make it available for any investigations. STIX makes a lot of sense to me here in this context

6) Since code is going to be a front runner here and not the network - it must always be with ZERO or as much less as possible set of vulnerabilities . OWASP compliance of your stack is a must at the minimum.

7) Contextual Security & Compliance changes : As the workload can get deployed to heterogenous context - there should be dynamic method allowed to measure the compliance and security posture of your application all the time. Your could refer to IBM Cloud SCC

https://www.ibm.com/cloud/security-and-compliance-center

Usually a collector runs in your application and sends the details to SCC kind of entity which can interpret the current compliance level.

8) Notifications : There should be very flexible notification framework you will need to make sure that you can write up custom notifications anytime based on varying needs

9) Common platform to build AI applications quickly: You must need a centralised place to get some of these or all of these done quickly. One good example would be IBM Data Fabric: https://www.ibm.com/resources/guides/predict/data-foundation-ai