Inside Dell Technologies’ zero-trust approach

Paradigm shifts with zero trust

Although zero trust is not new, Roese said the concept is confusing and misunderstood, calling for the need to simplify how zero trust works from a technical perspective through three paradigm shifts.

The first is that in a zero trust architecture, continuous authentication of devices, people, applications and even data, which used to be optional, is now mandatory.

“That is a big shift, but if you go from an environment where unknown entities could be on your infrastructure, to a zero-trust environment that just simply doesn't allow that, your security posture improves dramatically,” Roese said.

The second paradigm shift is with respect to policy, with security architectures today primarily focused on policy controls that prevent known bad behaviour.

“In the security world, there are only three things that exist – the known good, the known bad, and the unknown,” Roese said. “And today’s architectures attempt to apply policy and controls to prevent known bad behaviour and then to discover in the unknown what could be known bad and stop it.

“The problem with that approach is it is always reactive. It cannot deal with a zero-day event. It is slow to respond. And so, the second shift with zero trust is to change policy roles from preventing known bad to defining known good behaviour and preventing everything else.”

That is easier said than done, however, as most organisations do not understand how their applications and systems work. But in a zero trust architecture, Roese said, using advanced machine intelligence to automate security processes can help to define known good behaviour.

The third paradigm shift deals with threat response and management. Today, many threat detection and management systems sit outside of the infrastructure, keeping an eye on things from the outside through telemetry.

“It is extremely hard to do that, and it requires enormous amounts of data and analytics, but in zero trust, because the only things that are allowed to be on the infrastructure are known authenticated entities and you have well-defined policy that defines known good behaviour, your threat management can be deeply embedded, because all it’s looking for is an unauthorised entity,” Roese said.

Dell’s zero-trust reference model

There are three components in Dell’s zero trust reference model. The first element is that zero trust should be defined and driven by business controls, or business rules about what systems should do.

“Examples would be, I want all data in Europe to be pushed to a European datacentre only or I would like only engineers to access my labs,” Roese said. “They have nothing to do with technology, but in zero trust, it is critical that you define them.”

The next element is to convert business controls to technology and action, which can be done via a control plane that consists of identity management, policy management and threat management tools.

Roese said those tools already exist today but in zero trust, they exist together in a common control plane. “The control plane, if done properly, is the same control plane for a public cloud or a private cloud or edge cloud or anything in your environment.

“Devices are all subordinate and controlled by that common control plane and because identity, policy and threat management are now centrally controlled, the definition of an authenticated user whether he’s in a public cloud or private environment is the same.

“The policy roles can be implemented consistently whether you’re coming in through remote access or directly attached to a lab network, and your ability to see the behaviour of your enterprise because threat management has aggregated also becomes significantly better,” he added.

To ease zero trust adoption, Dell will be establishing a zero-trust centre of excellence in the spring of 2023 at DreamPort, the US government’s premier cyber security innovation facility.

Located in Columbia, Maryland, the centre will focus on providing global commercial enterprises and government customers a place to validate their zero-trust workloads and applications.

Roese said the architecture that Dell will be using for the centre was developed with the US Department of Defense and the US government, which is one of the leading implementers of zero trust architectures.

“The net result is that we will now have a capability to essentially pre-integrate and predefined much of the reference architecture customers need to make zero trust real,” he added.