1 of 25

Agentic Zero Trust

Frederick F. Kautz IV

2 of 25

Reality/Assumption Gap

  • Attackers and advanced persistent threats take advantage of the gap between our assumptions and reality.
  • Effects can be seen in the form of cyber attacks such as:
    • Data breach and exfiltration (Confidentiality)
    • Ransomware (Integrity)
    • Denial of Service (Availability)
    • Forging identities (Non-repudiation)
  • Regulations and Policies may ossify the assumption
    • Static Network Architectures with diagrams
    • Tracking services, ports, and protocols is difficult and error-prone
    • Network Segmentation Mandated
    • Identity is IP/Port based, primary control is IP/Port (also easily spoofable)
    • Internal/External IPs, Subnets, DNS. Internal = Segmented Globalization

3 of 25

Drivers

  • Security Posture is shifting:
    • Towards more granular perimeters with active
    • away from reactive/active(e.g. Regular checkups) to proactive.
  • Processing and sharing of data and outcomes are vital to success!
  • Slow adoption of key technologies is now a risk!
  • Enabling technologies include:
    • Cloud
    • Edge
    • IoT
    • 5G

4 of 25

Change comes with Risk

Uncoincidentally, staying still also comes with risk

  • How do we mitigate risk?
  • Risk: Magnitude * Probability
  • How do we limit blast radius of a failure or successful attack?
  • How do we control complexity?
  • How do we adapt to changing conditions?

5 of 25

Triangle of Trust

Identity

Policy

Control

6 of 25

Perimeter Defense -> Zero Trust

Before we can describe an Agentic Zero Trust approach, we need to look at where we are at. In the following slides, we describe Perimeter Defense and contrast it with Zero Trust.

7 of 25

Perimeter Defense

An untrusted client connects to a trusted server through a firewall.

Untrusted

Trusted

πŸ”₯

8 of 25

We’re defending our infrastructure with

11th century techniques!

Source: https://commons.wikimedia.org/wiki/File:KronborgCastle_HCS.jpg

9 of 25

We’re defending our infrastructure with

11th century techniques!

What if the attack starts here?

Source: https://commons.wikimedia.org/wiki/File:KronborgCastle_HCS.jpg

10 of 25

Perimeter Defense

Trusted

Network

Trusted

Network

VPN

Workload

Workload

Workload

Workload

Workload

Workload

11 of 25

Zero Trust Environment

Untrusted

Network

Untrusted

Network

Attested

Workload

Attested

Workload

Secure Connection

12 of 25

Zero Trust Environment

Untrusted

Network

Untrusted

Network

Attested

Workload

Attested

Workload

Secure Connection

πŸ‘Ή

Attacker

13 of 25

Perimeter Defense

Untrusted

Network

Untrusted

Network

πŸ–₯️

VPN

πŸ–₯️

πŸ–₯️

πŸ”₯

​

πŸ”₯

πŸ–₯️

πŸ–₯️

πŸ–₯️

πŸ‘Ή

Attacker

14 of 25

Zero Trust Environment

Untrusted

Network

Untrusted

Network

πŸ–₯️

πŸ–₯️

πŸ–₯️

πŸ”₯

πŸ–₯️

πŸ–₯️

πŸ–₯️

πŸ”₯

πŸ”₯

πŸ”₯

πŸ”₯

πŸ”₯

πŸ”₯

πŸ”₯

πŸ”₯

πŸ”₯

πŸ‘Ή

Attacker

15 of 25

How do we achieve this?

  • Establish trust domains
  • Attest workloads
  • Establish policy
  • Establish trust between organizations

16 of 25

Establish Trust Domain

CA

17 of 25

Attest Workloads

CA

Agentic Service 1

Attest

Agentic Service 2

18 of 25

Establish Policy

CA

Agentic Service 1

Agentic Service 2

Policy:

​

package envoy.authz

import input.attributes.request.http as http_request

​

# allow only the frontend service to GET /pets/owners

default allow = false

allow {

http_request.path == "/pets/owners/{id}"

http_request.method == "GET"

source_spiffe_id == "spiffe://domain.test/frontend"

}

​

source_spiffe_id = client_id {

[_, _, uri_type_san] := split(http_request.headers["x-forwarded-client-cert"], ";")

[_, client_id] := split(uri_type_san, "=")

}

​

Source: openpolicyagent.org (with modifications)

​

19 of 25

Establish Trust between Organizations

Org 1

CA

Agentic Service 1

Agentic Service 2

Org 2

CA

20 of 25

Establish Trust between Organizations

Org 1

CA

Agentic Service 1

Agentic Service 2

Org 2

CA

Allow connections from:

source_spiffe_id == "spiffe://org1.test/user_agent"

Allow connections to:

dest_spiffe_id == "spiffe://org2.test/calendar_agent"

21 of 25

Agentic System Workflow

User

User Agent

Scheduling Agent

Hotel Agent

22 of 25

Translating the pattern

Control Plane

Data Plane

User Client

Sarah’s

App

User Agent

User Agent

Scheduling Agent

Scheduling Agent

Hotel Agent

Hotel Agent

23 of 25

Establishing Trust

User

Internet

User Agent

Scheduler Agent

Hotel Agent

Org 1

CA

Org 2

CA

Trust

Attest

Attest

OPA implementing policies at each relevant location

24 of 25

Tie to the hardware!

Identity

Identity

Identity

Agent

Service Mesh

Pod

Hardware

TPM

Infra

Hardware

TPM

Agent

Service Mesh

Pod

Hardware TPM

25 of 25

Thank You!

https://spiffe.io

​

https://zt.dev

​