Understanding and Getting Started with ZERO TRUST

 

A look at what Zero Trust really is and how to get started by John.

My take away (ZT principles):

• Verify explicitly (on every single session or resources)
  
• Least privilege (just enough and in time) 
• Assume breach

Other notes: 

• A wrong VPN deployment may degrade the security in overall.
• IAM with SSO (MFA, Passwordless, disable legacy auth, RBAC)
• Endpoints (TPM, TLS cert, register-managed-compliant)
• Network (defense-in-depth, end-to-end encryption/IPSec, layers/tiers - microsegmentation, IDS/IPS) 
• Risk Context and controls (Identity, endpoint, network, conditional access)
• Infra and apps (policy, shadow IT, proxy)
• data (data driven protection and travel with data, encryption, classification, Azure Purview)
• SIEM/SOAR (Azure Sentinel + ML + automation)

 

Links:

• https://www.youtube.com/watch?v=hhS8VdGnfOU
• MS Zero Trust Maturity Model
• https://github.com/johnthebrit/CertificationMaterials 
  

Enhancement to Split-Tunnel VPN

Remember the Split-Tunnel VPN?

In case you need a script to manually add some static routes to your corporate network. Here's one:

@echo off

for /f "tokens=3" %%x in ('route print ^| find "10.0.0.0"') do @set INPUT=%%x

route add 172.16.0.0 mask 255.128.0.0 %INPUT% metric 1

route add 192.168.0.0 mask 255.255.0.0 %INPUT% metric 1

Have fun!

This is assuming your VPN login subnet is 10.0.0.0/8 and you wish to add 2 static routes: 172.16.0.0/12 and 192.168.0.0/16.

Split-Tunnel VPN

A lot of time, we work-from-home (WFH). To work, we need to setup a VPN tunnel back to office network, to read email for instance. Once the VPN connected, you loss all the direct connections to Internet: to download torrent, skype, IM, etc.

This technique is called "split-tunneling VPN". It allows you to connect to office network via VPN and Internet directly. Split-tunneling configures the VPN connection so that only traffic headed to computers on the office network is sent through the VPN connection; other traffic goes out through your home router.

Follow these steps to set up a VPN connection in Windows XP/Vista/7 that uses split tunneling:

• Setup your VPN connection using the instruction from your corporate standard.
• Right-click the VPN connection and select "Properties."
• Select the "Networking" tab.
• Highlight "Internet Protocol Version 4 (TCP/IP v4)."
• Click "Properties"
• Click "Advanced"
• Uncheck the "Use default gateway on remote network" box. (This is turned on by default)
• Click "OK" few times to close the windows you opened.

From that point forward, only traffic destined for your corporate network will be sent through the VPN. All other traffic will use the local network.

Note: If your corporate network contain other internal subnets, you will need to add static routes for that manually.

Update: see the enhancement example.