CONTACT US
1-844-4ZPE-SYS
ZPE CLOUD

Providing Out-of-Band Connectivity to Mission-Critical IT Resources

Home » Micro-segmentation » Page 8

What is Zero Trust Security?

by | Sep 21, 2023 | Improve Network Security, Micro-segmentation, SecOps, Zero Trust Security

Data,Protection,Cyber,Security,Privacy,Business,Internet,Technology,Concept

As enterprise networks increase in complexity and distribution, and the frequency and severity of cybersecurity incidents also continue to grow, organizations must rethink traditional approaches to network security. That’s where the zero-trust methodology comes in.

What is zero trust security, you ask? This post defines the term and discusses its history before providing a guide to implementing zero trust security in your organization.

Table of Contents
  1. What is zero trust security?
  2. The history of zero trust security: A timeline
  3. Zero trust security benefits
  4. Zero trust security use cases and examples
  5. How to implement zero trust security
  6. Zero trust on the control plane
  7. Zero trust security simplified

What is zero trust security?

Zero trust is a network security protocol that embraces two main principles. The first lends its name and stipulates that networks must “never trust, always verify” any device or account, including those already within the network perimeter. As a result, a zero trust security framework requires any entity accessing network resources to successfully authenticate through a root-of-trust and strong authentication method (e.g., one-time passwords or 2-factor authentication).

The second pillar of a zero trust network is micro-segmentation. Instead of a singular, all-encompassing security perimeter, a zero trust approach uses the same strong authentication and highly specific security policies to establish trust at checkpoints along smaller, segmented perimeters. This combination limits the lateral movement of compromised accounts, which minimizes the impact of breaches and aids in protection, governance, and compliance.

The history of zero trust security

The history of zero trust securing a timeline

The NIST publication answered the question, “What is zero trust security?” using seven core tenets.

7 tenets of zero trust security
  1. All data sources, devices, computing services, and applications are considered resources.
  2. All network communication is secured regardless of where it originates from, even within the network perimeter.
  3. Access to individual resources is granted on a per-session basis, so trust can be re-evaluated upon each request.
  4. Trust is determined by dynamic policies that continuously assess client identity, behavioral patterns, location, time, and other
    attributes.
  5. The integrity and security posture of all enterprise assets are continuously monitored, with no asset inherently trusted.
  6. Access policies are strictly enforced using strong authentication every time a resource is requested.
  7. The network and infrastructure are continuously monitored, and the collected data is used to improve the overall security posture.

Zero trust security benefits

One of networking’s fundamental goals is to allow information to flow between computers, people, and organizations. However, that information is more decentralized now than ever before and must be relayed through various applications, partners, and third-party channels, increasing risk. Plus, the frequency of ransomware attacks and other highly sophisticated cybercrimes makes it a near certainty that a breach will occur even with the best protection strategies.

The zero trust security model operates under the assumption that a breach is already in progress, meaning an account or device is already compromised and accessing the network. It works to restrict an attacker’s movement on the network by erecting security checkpoints around each potential target and forcing them to re-establish trust. Limiting the blast radius of a cyberattack decreases the duration and cost of recovery operations so organizations can minimize the impact on their revenue and reputation.

4 benefits of zero trust security
  1. Zero trust limits how much an attacker can move around the network and how much data they can access before getting caught.
  2. Zero trust monitoring tools provide a high level of visibility into networks, which teams can use to streamline and optimize operations.
  3. Zero trust helps organizations identify malicious actors promptly so they can respond to incidents more quickly and decrease recovery times.
  4. Zero trust aids in compliance with data privacy and security regulations like FedRAMP and HIPAA.

Zero trust security use cases and examples

Organizations across any industry can benefit from the zero trust approach to network security. For example:

  • Ransomware often exploits vulnerabilities in unpatched software to compromise enterprise systems and move around the network, encrypting critical resources along the way. Establishing zero trust checkpoints at each micro-perimeter can help identify compromised resources and prevent their lateral movement, limiting the impact of ransomware and expediting recovery.
  • Operational Technology (OT) is used to automate machines that interact with the real world, such as HVAC systems or industrial robotics, which makes OT-related cyberattacks uniquely devastating. With recent reports indicating these attacks are on the rise, many organizations are using zero trust policies and controls to secure both their OT and their IT networks.
  • Many organizations use Internet of Things (IoT) devices to collect data, provide mobile services, automate critical operations, and more. However, these devices are a huge cybersecurity risk if not managed properly, especially in the financial sector and the medical industry. Zero trust security helps mitigate the risk by making it easier to identify compromised IoT devices and deny access to sensitive resources.

How to implement zero trust security

With an understanding of what zero trust security is, where it came from, and how it can be used, you can create an implementation plan that includes all the tools and processes you must deploy to achieve the zero trust model. There are four key questions to answer:

  1. How will we establish trust?
  2. How will we control and secure user access to resources?
  3. How will we identify and manage our attack surface?
  4. How will we enforce zero trust and detect attackers on the network?

Let’s discuss the best way to answer each of these questions and the natural progression to establishing a zero trust implementation plan.

1. Establishing trust

As the core of the zero trust strategy, this must be addressed before moving on to any subsequent steps. Establishing trust requires four things, implemented in this order:

  • Roots of Trust (RoTs) – Roots of Trust are hardware security mechanisms that provide cryptographic functions, key management, and other important features. An example would be a Trusted Platform Module (TPM). RoTs are inherently trusted and provide the foundation on which to build a zero trust security architecture, so it’s critical to choose solutions that provide the best and most up-to-date security features.
  • Identity and Access Management (IAM) – An IAM solution provides policy creation and deployment, identity verification, and trust assessment functionality. It acts as the gateway at each micro-perimeter, forcing accounts to verify their identity and re-establish trust before accessing enterprise resources.
  • Strong authentication – A password alone isn’t enough to prove someone’s identity, so strong authentication requires a secondary form of proof. Examples include one-time passwords (OTPs), authentication app keys, physical keys like USBs or smart cards, and biometric scans.
  • Privileged Access Management (PAM) – Similar to IAM, privileged access management focuses specifically on accounts with special access rights, such as sysadmin or service accounts.

2. Controlling access to resources

The next step is to establish control over who can access network resources and ensure that access is secured. The four areas to focus on, in order, are:

  • Access control policies – Zero trust requires highly specific policies that are custom-tailored to the resources being protected. The best practice is to use role-based access control (RBAC) instead of assigning individualized permissions to each account.
  • Threat intelligence – Threat intelligence refers to the information used by organizations and cybersecurity vendors to learn about threats to the network. This knowledge is used to determine which security solutions and controls are needed to defend specific network micro-perimeters.
  • Risk management – Risk management involves using threat intelligence and other sources of information to determine how risky it is to deploy particular technology solutions, work with specific third-party partners, or allow access to particular areas of the network.
  • Zero Trust Network Access (ZTNA) – ZTNA provides secure remote access to enterprise resources, similar to (but better than) a VPN. ZTNA connects remote users directly with the specific resource they’re requesting to access without letting them see or interact with anything else on the enterprise network.

3. Managing the attack surface

Creating effective micro-perimeters is impossible without a clear understanding of what’s being protected and what the potential risks are. This involves four components:

  • Asset management – You must have a total accounting of all the assets on the network, including information about software versioning, patch schedules, hardware security capabilities, and location.
  • Vulnerability management – Vulnerability management involves monitoring, discovering, reporting, and resolving software vulnerabilities. A robust vulnerability management strategy is required to prevent malicious actors from using software exploits (like the unpatched Accellion vulnerability) to bypass zero trust security controls.
  • Software Bill of Materials (SBOM) – A software bill of materials lists all the various third-party and open-source components present in a given software product. An SBOM is required to gain a full understanding of the risks associated with a particular solution and determine which policies and controls are required to defend it.
  • Attack surface management – Attack surface management involves identifying all the potential targets of a cyberattack, implementing policies and controls to defend those targets, and continuously monitoring for new threats. Effective attack surface management requires robust asset & vulnerability management as well as SBOMs for all software, so all previous processes must already be in place prior to this step.

4. Enforcing zero trust and detecting attacks

The final stage of zero trust implementation involves enforcing policies, detecting threats on the network, and dealing with those threats. These processes, in order, include:

  • Zero trust enforcement – You enforce zero trust policies using all the tools, processes, and information from previous steps. Many organizations adopt artificial intelligence (AI) and machine learning (ML) technologies for greater visibility into account activity. For example, User and Entity Behavior Analytics (UEBA) solutions monitor and analyze behavior so they can better detect anomalous account activity.
  • Threat detection – Threat detection involves monitoring the network to identify signs of attack, like malware execution, data exfiltration, repeated failed access requests, and unapproved registry changes.
  • Deception – Zero trust deception technology uses an overlay of “false” attack targets to lure malicious actors into revealing themselves and their motives without allowing them access to any real resources.

A NIST diagram of a zero trust architecture.

Source: NIST Special Publication 800-207 (Zero Trust Architecture)

It’s important to note that all of the steps and processes listed above must be followed chronologically because each successive stage builds upon the one before. It isn’t until all these steps are complete that an organization has achieved the zero trust security model.

Zero trust on the control plane

The management interfaces used by administrators to control network infrastructure are often excluded from zero trust implementation plans because end-users don’t typically access them. That means a compromised sysadmin account could potentially hijack the control plane and bring down critical infrastructure.

Organizations must apply zero trust security principles, policies, and controls to management infrastructure. The best practice, according to a recent CISA directive, is to keep the control plane on an isolated, out-of-band (OOB) network – also known as an Isolated Management Infrastructure (IMI). Isolating the management interfaces on a dedicated network prevents lateral movement to or from the production LAN. It also gives administrators a safe environment in which to recover from ransomware or other cyberattacks without risking reinfection; this is known as an isolated recovery environment (IRE).

The easiest and most effective way to implement an IMI is with OOB serial console servers. Ideally, these devices should have robust Root of Trust technology like TPM 2.0, use alternative network interfaces like 5G/4G cellular to ensure isolation and continuous access, and integrate with zero trust solutions such as IAM and PAM for consistent policy enforcement.

Learn more about zero trust on the control plane

Zero trust security simplified

What is zero trust security? It’s both a mindset and a set of innovative technologies and cybersecurity methods that address the current threat landscape of frequent, sophisticated, and disruptive attacks on networks of all sizes. By following the principle of “never trust, always verify,” and using the implementation steps outlined above, you can defend your network and streamline recovery operations.

Are you looking for a way to simplify zero trust without sacrificing security? The Nodegrid platform from ZPE Systems includes a range of all-in-one solutions that combine LAN/WAN/Branch networking, out-of-band (OOB) management, zero touch provisioning (ZTP), and more. Nodegrid solutions are vendor-neutral and can run or integrate your choice of third-party zero trust solutions like IAM and ZTNA, reducing the number of security devices to deploy at each office or branch. Nodegrid boxes are protected by strong Root of Trust technology like TPM 2.0 and employ innovative security features like geofencing to form a robust foundation for your zero trust implementation.

What is zero trust security?

Learn more or request a demo of the Nodegrid solution by contacting ZPE Systems today.

Contact Us

What is a radio access network (RAN)?

by | Aug 25, 2023 | EdgeOps, Failover Connectivity, Improve Network Security, Micro-segmentation, Network Automation, Network Edge Orchestration, Remote Network Management, SD-WAN, Secure Access Service Edge (SASE), Security Service Edge (SSE), Simplify Branch Infrastructure, User Management

This post provides an introduction to radio access networks (RAN) before discussing 5G RAN challenges, solutions, and use cases.
5G cellular technology is used for internet of things (IoT) deployments and operational technology (OT) automation across many different kinds of organizations, including city governments, global logistics companies, and healthcare providers. 5G access is provided by a radio access network (RAN) using mobile towers and small cells, but deploying these networks is challenging due to numerous factors, including poor public opinion. This post provides an introduction to radio access networks before discussing 5G RAN challenges, solutions, and use cases.

Table of Contents:

What is a Radio Access Network (RAN)?

A radio access network (RAN) is the portion of a cellular network that connects smartphones and other end-user devices to the internet. Information is communicated back and forth between smartphones and the RAN’s transceivers via radio waves. Those wireless signals are translated into digital form, passed to the core network, and then to the global internet.

What is 5G RAN?

Every cellular generation has its own associated RAN technology. 4G RAN was the first generation based entirely on the internet protocol (IP) rather than older circuit-based technology. The newest generation, 5G, supports faster speeds, great capacity, and lower latency than previous generations. However, there are significant challenges in the way of 5G implementation.

5G Radio Access Network (RAN) challenges

There are three major hurdles to 5G implementation:

  1. Public opinion – Thanks in part to misinformation and conspiracy theories, there has been a lot of resistance to 5G implementations. While many people already use smartphones with 5G technology, they tend to balk at the idea of giant cell towers and masts going up in their town or city.
  2. mmWave limitations – Wireless frequencies in the mmWave (millimeter wave) spectrum provide the speed and capacity required for 5G, but they have a shorter range and difficulty penetrating walls. That makes 5G tricky in industrial settings and office buildings.
  3. Remote recovery – A 5G RAN typically operates in cramped spaces without a continuous human presence, and administrators monitor and manage the equipment remotely over the cellular network. However, if that cell link goes down due to equipment failure or natural disaster, teams are cut off, and a truck must be rolled to fix the issue, adding significant costs and downtime.

Addressing these hurdles is complicated, as the solutions often create additional challenges. For example, the first two points can be addressed with 5G small cell technology. Small cells are typically compact enough to deploy on top of buildings or street furniture to extend 5G coverage into densely populated areas without a full-size mobile mast. This makes 5G small cell networks more palatable to city officials and the general public alike. However, small cells are still subject to planning restrictions, and the absence of a common 5G small cell framework makes the application process difficult and time-consuming.

In addition, some small cells are tiny enough to deploy indoors, improving 5G propagation and coverage in buildings. However, operators would need to deploy dozens or hundreds of small cells to achieve the speed and reliability needed for industrial IoT and high-tech use cases. Each one requires significant power resources as well as a fiber or wireless backhaul, and due to a lack of standardization, operators may even have to submit many individual planning applications. Plus, a small cell network of that size is complex to monitor and manage, requiring additional hardware and software solutions that add even more costs and complexity.

Addressing the third point requires an out-of-band network connection to 5G RAN deployments. For example, a 4G/LTE serial console provides an alternative internet connection so teams can remotely access RAN equipment during 5G outages. A serial console directly connects to radio access network infrastructure so remote administrators can do things like reboot a hung device or refresh DHCP even if the local network is down.

However, many serial consoles suffer from vendor lock-in, meaning they don’t connect to all devices or support third-party management, troubleshooting, and recovery tools. This either limits an administrator’s ability to remotely recover from outages or forces them to deploy additional hardware and software solutions to gain all the remote functionality required, adding to the expense and complexity of 5G RAN deployments.

A new approach to 5G deployments

The upgrade from 4G to 5G is proving to be more fraught than previous transitions between generations, so it’s clear that a new approach is needed. Small cell technology is a good start, but a lack of standardization severely hampers its adoption. Help is on the way, though – a group called the Small Cell Forum (SCF), which is made up of wireless leaders like AT&T, Cisco, Qualcomm, and Samsung, is working to establish a set of common definitions and recommendations to help the industry standardize 5G small cell networks.

In their definitional report, the SCF highlights the need for vendor-neutral hardware that’s customizable and swappable for various 5G use cases. Architectural design and planning applications are simpler when all of a small cell network’s equipment supports the same common 5G interface. Multi-functional devices combining networking, out-of-band access, and third-party application hosting significantly reduce expenses and management complexity.

Let’s examine some potential 5G use cases that could benefit from this new approach.

Smart cities

A smart city is the ideal use case for a 5G small cell network. Since wireless clients are packed into densely populated areas, an array of 5G small cells should provide sufficient coverage without the need for a full-sized mast. Deploying a small, vendor-neutral, multi-functional device like the Nodegrid Mini Services Router alongside small cells provides flexible backhaul options, out-of-band remote management, and application hosting. Installing small cells and Mini SRs on streetlamps, parking structures, and other public infrastructure gives teams everything they need to remotely monitor, operate, and recover 5G smart city infrastructure without adding more complexity to the network.

Global asset tracking and logistics

The internet of things (IoT) makes it possible for large, global enterprises to streamline asset tracking and supply chain logistics. Organizations use IoT-enabled devices to handle inventory management, fulfillment, shipment tracking, quality control, and more. 5G small cell technology provides the necessary speed, coverage, and bandwidth, but the sheer number of devices – and their global distribution – creates a lot of management complexity.

All-in-one solutions like Nodegrid reduce the tech stack by combining networking, management, and application hosting in a single box. Plus, Nodegrid provides a centralized management platform that can unify all connected devices, apps, and services in a single place. Administrators get a single pane of glass to monitor, control, troubleshoot, and automate the entire global architecture, reducing costs and streamlining operations.

Building automation

Many large property management companies rely on building automation systems that use operational technology (OT) to control door locks, lighting, HVAC, and more with very little human intervention. 5G’s improved speed and lower latency open up even greater automation capabilities, especially in warehouses and manufacturing plants.

Nodegrid’s compact, vendor-neutral solutions give remote operators a reliable, out-of-band connection to automated building systems to keep businesses running 24/7, even during 5G outages or LAN failures. You can deploy the Mini SR in cramped or semi-outdoor spaces to extend monitoring, security, and management coverage to every part of the 5G deployment. Nodegrid enables end-to-end building automation and makes 5G networks more resilient to failure.

Simplifying 5G with Nodegrid

A 5G radio access network (RAN) provides internet access to 5G-enabled systems, such as smartphones and IoT devices. While 5G deployments are proving complicated and fraught with issues, these challenges are overcome using small cell technology and vendor-neutral, multi-function devices like Nodegrid. Nodegrid’s integrated services routers deliver all-in-one networking, out-of-band management, backhauling, and application hosting capabilities to simplify 5G deployments without compromise.

Learn how Nodegrid can help deliver simplified 5G with out-of-band management!

Request a free Nodegrid demo to see how vendor-neutral solutions simplify 5G radio access network (RAN) deployments.

Contact Us

Operational Technology Security

by | Aug 17, 2023 | Improve Network Security, Micro-segmentation, SecOps, Security Service Edge (SSE), User Management, Zero Trust Security

An engineer using a tablet to control robotic machinery illustrates a use case for operational technology security

Managing and securing operational technology (OT) is notoriously challenging because of stakeholder focus on continuity and safety. This is only becoming more difficult as OT systems and networks grow more complex and distributed. Operational technology is a rare but valuable target of cyberattacks due to the severe impact on business operations and a relative lack of cybersecurity monitoring due to physical security requirements and GRC. It is simply harder to blend cybersecurity into operational security when the stakes are high and availability and continuity are the prime focus.

Early attempts to apply IT-specific security controls to OT had mixed success. A particular tool may work well in one scenario, but fail in another project. Some solutions meant to simplify OT management, such as NMAP (or Network Mapper), could even turn into weapons in the wrong hands. For example, the AvosLocker ransomware variant uses NMAP NSE (NMAP Scripting Engine) to scan endpoints for the Log4shell vulnerability and select targets to exploit.

This guide defines OT, explains how to overcome some of the biggest operational technology security challenges, and discusses the importance of recovery in building resilience in OT.

Table of Contents:

What is operational technology (OT)?

Operational technology (OT) includes any equipment interacting with the real world, as well as the systems that control such equipment. Some examples of OT equipment include HVAC systems, door controls, industrial machinery, fluid system sensors, and medical robotics. Examples of OT control systems include programmable logic controllers (PLC), supervisory control and data acquisition systems (SCADA), building management systems (BMS), and building automation systems (BAS). These control systems enable a high degree of automation in fields like industrial manufacturing, water and energy utilities, building management, and medicine.

 
OT-Security-Mockup(2)

Figure: An example of how a typical OT network is isolated from the IT network & security infrastructure.

Operational technology security challenges & solutions

It’s tempting to believe that operational technology is safe from cyberattacks because it’s often isolated from the IT network—the “security through obscurity” approach. However, OT is a very tempting target for malicious actors because it’s so critical to business operations. Recent research from Barracuda Networks found that over 90 percent of manufacturing organizations experienced cyber attacks on their production or energy supply in 2021. An OT attack can completely halt manufacturing lines, interrupt oil and gas supplies, or prevent life-saving procedures from taking place.

Operational technology security is a crucial focal point, but significant challenges exist.

Challenge: OT security tools are a double-edged sword

Network Mapper, or NMAP, is a widely-used network management tool. NMAP started as a simple scanner in 1997 but evolved over the years into a solid open-source tool for OS detection, software version detection, and other network discovery features. NMAP aids in OT security by mapping exposed operational technology controls for teams to patch and secure. However, in the wrong hands, this tool could be used in intelligence gathering to attack vulnerable, out-of-date systems.

The problem with tools like NMAP is that they only discover information about systems with open ports on the same network as the tool – usually the production network. If an authorized network admin can find OS versioning information on the production network, so can an unauthorized user with stolen credentials.

Security teams need an efficient way to discover, patch, and manage operational technology without exposing these systems to cybercriminals.

Solution: Out-of-band (OOB) OT management

An out-of-band (OOB) network uses dedicated network infrastructure to create a control plane that’s completely isolated from the production network. An out-of-band serial console is the most efficient way to create an OOB network. This device directly connects to OT equipment and control systems via management ports (e.g., RS232 Serial), allowing administrators to monitor and patch vulnerabilities without exposing OS/versioning information to production.

An OOB serial console also uses alternative network interfaces—such as LTE cellular or dial-up—to ensure this management network is always remotely accessible by administrators, even when the production ISP, WAN, or LAN goes down from a failure or breach. With this added redundancy, teams can recover and restore critical OT operations much faster, even when the outage occurs in a remote or hard-to-reach location.

An out-of-band OT management solution provides efficient patch management without exposing vulnerable systems to cybercriminals. OOB also streamlines OT recovery efforts to minimize the impact of successful attacks and other failures.

Out-of-Band (OOB) Management Learning Center

Challenge: OT isolation hinders disaster recovery and Zero Trust

Since operational technology is often isolated from the IT network on its own LAN, there usually isn’t any way to access the control systems remotely. Operators must be on-site to use SCADA or PLC systems to monitor and control industrial processes. If on-site access is impossible, for example, due to a global pandemic or natural disaster, OT operations completely shut down. For example, increased tornadoes, floods, and other natural disasters in the midwest have forced major companies like General Motors and Amazon to close regional plants and logistics centers. When workers are sent home, operations grind to a halt unless operators have a way to access their OT control system remotely.

In addition, this separation makes it difficult to extend Zero Trust to operational technology. Without strong authentication, granular security policies, and targeted protection, there’s a significant risk of breaches. Plus, a lack of Zero Trust makes it difficult to contain the lateral movement of a malicious actor who’s using stolen credentials, which increases the blast radius and business impact of cyber incidents. 

Organizations need a way to minimize operational disruptions from natural disasters and apply Zero Trust to OT networks if they want to improve their resilience.

Solution: IT/OT convergence with vendor-neutral platforms

IT/OT convergence involves bringing information technology and operational technology together under one management umbrella and securely bridging the gap between the two networks. 

An IT/OT convergence strategy improves business resilience in two ways:

  1. It brings OT onto the same enterprise network as IT systems which facilitates the use of remote tools (like VPNs or ZTNA), giving operators access to OT control systems from off-site
  2. It brings OT within the purview of Zero Trust security controls like multi-factor authentication (MFA), identity and access management (IAM), and deep packet inspection (DPI)

The easiest way to achieve IT/OT convergence without gaps is to use a vendor-neutral management and orchestration platform. For example, an OOB serial console with an open OS architecture that can dig its hooks into multi-vendor OT systems will give administrators a single-pane-of-glass view of the converged IT/OT infrastructure. A platform that can host or integrate 3rd party Zero Trust solutions will also enable unified orchestration of IT and OT security. 

By converging IT and OT, organizations can keep business running during natural disasters and limit the blast radius of breaches. A vendor-neutral platform also provides unified security orchestration for greater coverage and improved efficiency.

Operational technology security & resilience

A comprehensive operational technology security strategy will help improve resilience by preventing some cybersecurity incidents and reducing the impact of the rest. However, it’s impossible to ensure 100% protection, especially with ransomware attacks on the rise. That’s why it’s important to distinguish between security and resilience; security provides preventative measures, but resilience is your ability to withstand adversity and keep business flowing. 

One of the best measures of resilience is how quickly you can recover from outages caused by failures and attacks. And the best way to ensure a speedy recovery, according to the experts at Gartner and the CISA, is by using isolated management infrastructure such as OOB serial consoles to create an isolated recovery environment (IRE). This gives teams a dedicated environment, insulated from ransomware and production failures, where they can rebuild and restore critical services. 

Download our whitepaper 3 Steps to Ransomware Recovery for more guidance on streamlining IT/OT recovery and improving business resilience.

 

Building OT security & resilience with Nodegrid

The Nodegrid platform from ZPE Systems is a complete resilience solution that delivers OOB operational technology management and vendor-neutral IT/OT convergence. Using Nodegrid out-of-band solutions as your isolated management infrastructure ensures teams will have 24/7 remote access to monitor, patch, troubleshoot, and recover operational technology. The open, Linux-based Nodegrid OS supports VM and container hosting and easy integrations so you can deploy and control 3rd party applications for Zero Trust, OT management, and more from a single platform. Nodegrid can also host all the tools your team needs to recover and rebuild critical services — including to fully destroy and rebuild production networks — making it the perfect solution for building an isolated recovery environment.

Nodegrid can also run 3rd-party automation solutions such as software-defined networking (SDN)/software-defined wide area networking (SD-WAN), infrastructure as code (IaC), and artificial intelligence for IT operations (AIOps). Automating workloads helps reduce the risk of human error, while automating root-cause analysis (RCA) and security event analysis can significantly speed up recovery efforts, creating a more resilient network.

Learn how Nodegrid delivers unified orchestration and out-of-band management!

Nodegrid delivers unified orchestration and out-of-band management to help you build your zero trust security architecture. Contact ZPE Systems today to learn more.

Contact Us

Medical Devices Cybersecurity Risk

by | Aug 16, 2023 | Improve Network Security, Micro-segmentation, Remote Network Management, SecOps, Security Service Edge (SSE), User Management, Zero Trust Security

A hacker’s laptop connects to a stethoscope to represent medical devices cybersecurity risk

The healthcare industry is one of the largest adopters of “Internet of Things” (IoT) technology, using internet-enabled devices to monitor patient health, dispense lifesaving medication, perform medical procedures, and more. Some examples of IoT devices used in healthcare include insulin pumps, pacemakers, heart rate monitors, and intracardiac defibrillators. These devices allow healthcare teams to provide advanced care in bustling urban centers as well as remote or rural areas where frequent in-person visits are impossible.

However, these devices often run outdated software due to the difficulty of patch management and the time-intensive nature of updates, which end up getting bumped from the schedules of busy metropolitan teams. In addition, healthcare organizations and patients alike often sacrifice security hygiene for convenience, increasing the likelihood of stolen credentials and compromised devices. Plus, since these devices often operate in patient homes and other locations outside the organization’s network, security teams may not even know if an IoT device is stolen or compromised until it’s too late.

Many cybercriminals target IoT medical devices to harvest sensitive health data, but in the process could cause a pacemaker to crash and severely injure the patient. To address the growing threat of ransomware and other cyberattacks on patient health devices, the FDA recently issued a set of guidelines for securing medical devices. In this post, we’ll discuss the factors that make medical devices a cybersecurity risk before providing mitigation strategies to help healthcare organizations meet FDA requirements.

Table of Contents:

What makes medical devices a cybersecurity risk?

Every internet-enabled device expands an organization’s attack surface, giving cybercriminals something new to compromise and gain access to data and other resources. Medical devices are particularly risky for three reasons.

  • Outdated software – It’s difficult to update software on remote, wearable, or implanted medical devices without causing a (potentially dangerous) disruption to the patient. A recent FBI report showed that 53% of IoT medical devices had known, unpatched vulnerabilities in their software, making them more susceptible to cyberattacks.
  • Poor security hygiene – Teams often deploy medical devices with easy, insecure passwords for ease of use. While this may make operating and troubleshooting these devices easier for busy healthcare practitioners, it also significantly increases the cybersecurity risk.
  • Inadequate monitoring – Once medical devices leave the central network, it can be difficult for admins to monitor software versioning, account activity, device location, and other critical security metrics. That means they may not be aware of breaches or failures that put patient health at risk.

Medical device cybersecurity risk mitigation strategies

Due to the increased frequency of attacks and the potential to cause patient harm, the FDA released guidance earlier this year to address medical device cybersecurity risks. For the FDA to consider a medical device “secure,” there must be plans and processes in place to monitor, identify, and patch vulnerabilities, both on a routine schedule and as soon as possible in response to specific threats. There are also additional requirements to demonstrate that reasonable security measures are in place, including strong authentication.

This guidance is intentionally broad, giving general rules without detailing exactly how to achieve compliance. Let’s discuss three specific risk mitigation strategies that address the above mentioned risk factors and meet FDA guidelines.

Automated patch management

Medical device manufacturers and service providers must continuously monitor for vulnerabilities and release software patches on a regular schedule to comply with the FDA’s ruling. Automated monitoring, configuration management, and software delivery tools can all help teams stay on top of demanding patch schedules. On the consumer side, healthcare teams can use automated patch management solutions to ensure updates are installed as soon as they’re available, reducing manual workloads and improving device security.

Zero trust security

Zero trust security is a methodology that involves applying highly specific security policies and building checkpoints of security controls around individual network resources. Zero trust requires strong passwords and uses technology like multi-factor authentication (MFA) to prevent compromised accounts from accessing devices or data. Zero trust is difficult to achieve, and it can be challenging to get overworked healthcare providers or elderly patients to follow stricter password guidelines, but it’s quickly becoming standard practice for new medical devices and cloud services. Teams can help smooth the transition by providing additional training and support when deploying new healthcare technology.

Vendor-neutral monitoring

Administrators need to track device metrics to ensure the equipment functions correctly and identify any signs of compromise. Often, devices come with software monitoring solutions that are specific to a particular vendor, but most healthcare teams deploy a wide variety of equipment from multiple vendors. As a result, admins must log in to several different dashboards, all of which provide varying degrees of coverage and granularity. A vendor-neutral monitoring platform can unify all these disparate systems, making it easier to track device health and spot potential problems.

Medical device security, recovery, and resilience

Medical devices pose a significant cybersecurity risk, and the consequences of successful breaches could be deadly. The FDA urges medical device providers to follow guidelines for vulnerability monitoring, patch management, and overall cybersecurity. In addition, healthcare organizations can use automated patch management, zero trust security, and vendor-neutral monitoring platforms to improve their security posture.

It’s also vital that organizations have a plan for how to recover remote medical devices that are compromised by ransomware or other cyberattacks. The faster teams can restore, rebuild, or replace the device, the better the patient’s health outcomes. This combination of security and recovery planning makes healthcare networks more resilient to cyberattacks and failures.

For example, the Nodegrid platform from ZPE Systems allows healthcare teams to deploy automation, zero trust security, monitoring, recovery tools, and more from one unified system. Nodegrid’s out-of-band management solutions can also be used to build an isolated recovery environment where teams can rebuild and restore compromised systems with the risk of reinfection.

To learn more about recovering from ransomware and other medical device cybersecurity risks, download our whitepaper, 3 Steps to Ransomware Recovery.

Download the Whitepaper

Learn more about recovering from ransomware and other medical device cybersecurity risks!

Nodegrid allows healthcare teams to deploy automation, zero trust security, monitoring, recovery tools, and more from one unified system. 

Contact Us

Zero Trust Security Architecture

by | Aug 4, 2023 | Improve Network Security, Micro-segmentation, SecOps, Security Service Edge (SSE), User Management, Zero Trust Security

The words zero trust in a circle with simulated computer architecture as the background.

In today’s economy, businesses can’t afford to neglect their cybersecurity architecture. According to a recent report, cybercrime damages are expected to reach $10.5 trillion annually by 2025. Attacks are more frequent and damaging, thanks partly to the difficulty in establishing a solid security perimeter around a modern enterprise network. With Internet of Things (IoT) device usage on the rise and networks expanding to include remote branch offices and edge data centers, it can be impossible to clearly define the boundaries of a network, let alone effectively defend those boundaries. For example, many organizations use tools like Citrix to enable secure remote access to enterprise resources, but recently, high-risk vulnerabilities were discovered in several Citrix gateway products. The very tools we rely on to defend our expanding perimeter may leave us the most exposed to attacks.

The zero trust security methodology was created to address the challenges involved in traditional, perimeter-based defense strategies. This post defines a zero trust security architecture, discusses some of the gaps typically left in such an architecture and provides tips for avoiding these pitfalls.

Table of Contents:

What is a zero trust security architecture?

A zero trust security architecture is designed around the principle of “never trust, always verify.” Traditional security architectures assume that every user and device should be implicitly trusted as long as they’re inside the organization’s network perimeter. That assumption leaves compromised accounts and malicious insiders free to move laterally around the network, accessing and exfiltrating data or executing ransomware in the process.

On the other hand, a zero trust security architecture assumes that every account and device is already compromised unless trust is continuously established. The zero trust methodology was founded by Forrester analyst John Kindervag in 2009; the same year, Google’s BeyondCorp project launched with the sole purpose of defining and developing a zero trust security architecture.

Zero trust uses network micro-segmentation, advanced authentication, Layer 7 (application-level) threat monitoring, and highly-granular security policies to verify trust and prevent lateral movement. Risk is calculated for each resource on the network, and then micro-perimeters of specific security controls are built around the resource micro-segment. Users and devices must establish trust each time they hit a micro-perimeter no matter how elevated their accounts are or where they’re accessing the network from, making it easier to spot and disable a compromised account. This is how a zero trust architecture limits the blast radius and duration – and thus the cost – of cyberattacks.
.

Tips for building a zero trust security architecture

Tips for implementing zero trust without gaps

Zero trust is not a single solution to purchase and deploy in your enterprise – it’s a combination of tools, policies, and proccesses that contribute to a more resilient network. The complexity of a zero trust architecture makes it prone to gaps. For example, manually configuring and managing so many moving parts increases the risk of human error. Additionally, zero trust doesn’t prevent 100% of attacks, but many organizations lack a comprehensive recovery plan. Plus, you can’t have a zero trust environment unless you isolate all administrative interfaces for infrastructure.

During the planning stage of your zero trust security implementation, you should keep the following three questions in mind:

  1. How will you manage so many different policies and solutions?
  2. Do you have tools to aid you in recovering from a successful attack?
  3. How will you protect your control plane from malicious actors on your network?

Addressing these challenges with the following best practices will help you build a successful zero trust security architecture.

Reduce human error with centralized orchestration

A zero trust security architecture includes hundreds or thousands of individual security policies and solutions. Configuring and managing this architecture is a monumental task prone to human error, leading to potential vulnerabilities. According to Microsoft, configuration errors cause 80% of ransomware attacks, making human error a major threat to network resilience. The best way to reduce complexity and prevent mistakes is to be able to see and manage all your solutions from one place, with the ability to automate regardless of skill level.

A centralized security orchestration platform allows administrators to configure, monitor, deploy, and automation all their zero trust solutions from a single place. The best practice is to use a vendor-neutral platform that integrates with third-party zero trust vendors for identity and access management (IAM), next-generation firewalls (NGFWs), and more. Such a platform allows organizations to build bespoke micro-perimeters using the preferred solutions, regardless of vendor, and still manage the entire architecture from a single pane of glass. Plus, with a holistic view of the security architecture, organizations gain a more accurate perspective on their overall security posture and have the context needed to spot systemic issues or subtle indicators of a breach.

Prioritize incident response and recovery planning

According to a recent report from Check Point Research, the global volume of cyberattacks reached an average of 1168 per week per organization in Q4 of 2022. That means there’s no question of “if” a breach will occur, only “when” it will happen. It’s essential to consider incident response and recovery when you build your zero trust security architecture to reduce the cost of an attack.

Research from Sophos found that 70% of organizations hit by ransomware took longer than two weeks to recover, implying they didn’t have the right recovery architecture in place. Downtime gets more expensive the longer it goes on, so organizations must improve their recovery capabilities. For example, data backups are critical to recovery efforts, so they must be protected by zero trust authentication and policies to prevent compromise or corruption. In addition, backup data, systems, and infrastructure must be validated with security scans before they’re restored to ensure they don’t reinfect the network with malware. Getting business back up and running as soon as possible will decrease the cost of cyberattacks, which means a recovery toolkit is an essential component of a zero trust architecture.

Secure the control plane on a dedicated OOB network

The management interfaces used by administrators to control network infrastructure are often excluded from cybersecurity planning because because end users don’t access them. Only admins have usernames and passwords, and they trust their own security hygiene, so they (incorrectly) assume these interfaces are safe. If zero trust policies aren’t applied to the control plane, a compromised administrator account could completely wipe out your infrastructure and gain unfettered access to sensitive data and backups. The blast radius of such an attack would be devastating and severely hamper recovery efforts.

A recent CISA directive provides guidance for reducing the risk of open management ports. The best practice for a zero trust security architecture is to keep the control plane on a separate, out-of-band (OOB) network. An OOB network uses dedicated infrastructure that’s isolated from the production LAN, preventing lateral movement by attackers. This also allows administrators to perform recovery operations even when ransomware or hardware compromises bring down the production network. In addition, zero trust policies and controls must be applied to the OOB control plane to prevent a compromised administrator account from gaining too much access.

Tips for building a zero trust security architecture
  • A vendor-neutral security orchestration platform reduces management complexity and mitigates the risk of human error
  • Integrating a recovery toolkit in the architecture will help limit the cost and business disruption of successful attacks
  • Keeping the control plane on an OOB network and applying zero trust policies and controls will limit the blast radius of a breach

The zero trust methodology asks us to assume that devices and accounts are already compromised, and attackers have breached the network, requiring everyone to continuously prove trustworthiness before accessing enterprise resources. A successful zero trust architecture is unified by a vendor-neutral orchestration platform, prioritizes business resilience and recovery, and secures management interfaces with the same strict policies and controls as the production network.

Build your zero trust security architecture with Nodegrid

Building such an architecture is easier with the Nodegrid solution from ZPE Systems. Nodegrid is a vendor-neutral security orchestration platform that delivers unified control of the entire architecture of zero-trust policies and controls to reduce complexity and mitigate the risk of human error. Nodegrid branch gateway routers and serial console servers provide secure OOB management, so you get an isolated control plane without deploying an entire secondary network. You can even use Nodegrid to build an isolated recovery environment (IRE) to streamline ransomware recovery and reduce the business impact of attacks.

Learn how Nodegrid delivers unified orchestration and out-of-band management!

Nodegrid delivers unified orchestration and out-of-band management to help you build your zero trust security architecture. Contact ZPE Systems today to learn more.

Contact Us

The Biggest Ransomware Attack You Haven’t Heard of…Yet

by | Jul 6, 2023 | Data Logging, Improve Network Security, Micro-segmentation, Minimize Impact of Disruptions, Network Automation, Out of Band Management, SD-WAN, SecOps, Secure Access Service Edge (SASE), Security Service Edge (SSE), User Management, Zero Trust Security

James Cabe CISSP

This article was written by James Cabe, CISSP, whose cybersecurity expertise has helped major companies including Microsoft and Fortinet.

MOVEit over SolarWinds — The largest and most successful ransomware attack ever recorded is happening. Right now. It’s attacking healthcare and financial institutions with high rates of success, and recently stole sensitive data of 4 million more healthcare patients. It uses something called CL0P ransomware, and the threat actor is a well-known criminal group with the name FIN11. Many organizations are finding it difficult to stop the attack because they have no way to access infected devices, take them offline, patch, or even replace them. So, what exactly is going on?

The group responsible for the attack

FIN11 is a cybercriminal group that has been active since 2016 or before, originating from the Commonwealth of Independent States (CIS). While the group has historically been associated with widespread phishing campaigns, their focus has shifted towards other initial access vectors. FIN11 often runs high-volume operations targeting industries in North America and Europe for data theft and ransomware deployment, primarily leveraging CL0P (aka CLOP).

FIN11 is responsible for multiple widespread, high-profile intrusion campaigns leveraging zero-day vulnerabilities, and the group likely has access to the networks of many more organizations than it is able to successfully monetize. Despite this, they’re currently attacking MOVEit, a well-known SaaS provider who relies on a file transfer appliance called Accellion lFile Transfer Appliance (FTA). This legacy product remains unpatched, which has led to the breach of many Fortune 100 companies and state and federal agencies.

FIN11

How did the ransomware attack start?

The ransomware attack began with several Accellion FTA customers, including those in industries like healthcare, legal, finance, retail, and telecom. Companies such as Jones Day Law, Kroger, Singtel, and many others had no idea that they had been attacked, because the initial breach was quiet and headless.

Their only indication came after receiving a threatening email aimed at extortion. 

In this email, the group threatened to publish stolen data on the “CL0P^_- LEAKS” .onion website, according to an investigation from Accellion. The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint CSA to disseminate known CL0P ransomware IOCs and TTPs identified through FBI investigations as recently as June 2023.

According to the investigation, four zero-day security holes were exploited in the attacks:

  • CVE-2021-27101 – SQL injection via a crafted Host header
  • CVE-2021-27102 – OS command execution via a local web service call
  • CVE-2021-27103 – SSRF via a crafted POST request
  • CVE-2021-27104 – OS command execution via a crafted POST request

And, the published victim data appears to have been stolen using a “WEB SHELL”. These web shells give remote administrative access to the web server and create a jumping off point to attack the rest of the internal network. Mandiant, a well-known cyber investigation arm of Google, added, “The exfiltration activity has affected entities in a wide range of sectors and countries” (Threatpost). Exfiltration is the unauthorized removal of important or damaging data from an organization.

However the biggest problem is that these web shells are what researchers call “PERSISTENCE”. This means that an attacker can remain in your network indefinitely to continue damaging and attacking your resources. Researchers call these “APTs,” or Advanced Persistent Threats.

Why is the ransomware attack still going strong?

The ransomware attack is still going strong because there’s no patch available. According to open source information, beginning on May 27, 2023, CL0P Ransomware Gang began exploiting a previously unknown SQL injection vulnerability (CVE-2023-34362) in Accelion’s appliance that is the backbone of a solution known as Progress Software’s MOVEit Transfer service. Internet-facing MOVEit Transfer web applications were infected with a web shell named LEMURLOOT, which was then used to steal data from underlying MOVEit Transfer databases. In similar spates of activity, TA505, which is the group responsible for the Dridex trojan and Locky ransomware, conducted zero-day-exploit-driven campaigns against Accellion FTA devices in 2020 and 2021, and Fortra/Linoma GoAnywhere MFT servers in early 2023.

What most organizations want to know is: How do you quickly respond to issues like these? How can you be properly prepared to respond to an issue you didn’t cause or didn’t expect?

Patching is a good response. However, it takes an average of 205 days to patch a recently known zero-day exploit like the MOVEit vulnerability. While patching alone is typically the ideal response, it isn’t automatic nor can it be done quickly.

Another approach involves removing the offending software or appliance, or cutting off access to the software or appliance. But once you remove this access, how do you continue normal operations, and how can you easily bring the software/appliance back online? Without adequate infrastructure in place, physically deploying to each site is not practical, especially for distributed organizations.

CISA and the FBI encourage organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of CL0P ransomware and other ransomware incidents. The Mitigations section describes many approaches, including patching, removing software/appliance access, and implementing a recovery plan. But all of these take too much time and too many resources, which leaves organizations vulnerable as they scramble to create an adequate response.

The great news is, organizations can cover all their bases without having to reinvent the wheel. This approach is recommended in one of CISA’s recent directives, and gives organizations somewhat of a silver bullet that allows them to quickly defeat ransomware and remain prepared for any future attack.

What approach does CISA recommend to address ransomware attacks?

CISA’s recent directive (23-02), which addresses the vulnerability of Internet-exposed management interfaces, calls for organizations to create an isolated management infrastructure (IMI) via out-of-band connectivity. This is a drop-in solution that the military, telcos, and hyperscalers/cloud companies use to respond to widespread ransomware and other issues impacting security and resilience. This approach — which ZPE Systems has perfected in the last decade with the help of Big Tech — gives organizations a completely separate control plane through which they can monitor and manage their entire IT infrastructure in a safe and dedicated fashion.

What is isolated management infrastructure?

Isolated management infrastructure consists of the hardware and software that create a management network that’s fully separate from other production and management networks. The key to this is in out-of-band connectivity, which is defined as connectivity other than TCP/IP. Out-of-band can include direct USB, serial, or even non-routed zero-trust connections to crown-jewel assets.

Essentially, the IMI gives an organization complete oversight and control of their widespread IT infrastructure, in a way that is secure and accessible only to their IT teams.

In this diagram, the production infrastructure (blue ring) sits at each distributed location. The out-of-band infrastructure for LAN (OOBI-LAN) is the green ring and surrounds the production infrastructure with one layer of isolated management. The OOBI-WAN (orange ring) is what provides a second layer of isolated management, which teams can access from a central or remote location, to gain access to the OOBI-LAN and ultimately the production infrastructure.

ZPE Automation

Knowing these assets and providing access across the organization can be easy and does not have to disrupt current operations. 

How can IMI stop the FIN11 ransomware attack?

In the ongoing FIN11 ransomware attack, Internet-facing applications are targets of the zero-day exploit. This means that no amount of security solutions can pre-mitigate the attack (i.e., there’s nothing you can do to stop it). This is where IMI shines.

Isolated Management Network diagram sitting beside production infrastructure

Remember the OOBI-LAN/OOBI-WAN diagram? Here’s a zoomed-in view of the isolated management infrastructure sitting beside the production infrastructure. The IMI connects via serial, Ethernet, and USB to production gear, and provides the necessary functions (routing, storing golden images, hosting jumpbox tools, etc.) to recover from attack. But how?

IT teams can use OOBI-WAN to remotely access their OOBI-LAN and production gear. They can pull affected devices offline and bring them in for forensics, which takes place in an Isolated Recovery Environment (IRE). This means these assets and networks are still reachable by analysts and responders, but isolated from other vulnerable assets. This allows an organization to quickly and even automatically deploy tools and resources inside of this environment through devices like ZPE Systems’ Nodegrid.

To combat the FIN11 attack, organizations don’t need to unplug cables or shut their devices off. They can instead deploy their IMI as the framework for closing the attack surface while maintaining access and critical data to aid in recovery.

Get the blueprint for isolated management infrastructure

Don’t wait until the next attack to shore up your defenses. ZPE Systems has worked with Big Tech for ten years developing the isolated management infrastructure. It’s now available inside the Network Automation Blueprint, and walks you through how to implement your own IMI. Download the blueprint now to stay ready for any attack.

Download blueprint

Get in touch with me!

True security can only be achieved through resilience, and that’s my mission. If you want help shoring up your defenses, building an IMI, and implementing a Resilience System, get in touch with me. Here are links to my social media accounts: