Introduction

Hello all, we need a preliminary design for Zero Trust Architecture in cloud services. I have a draft of the boundaries but the goal of this meeting is to identify the “must haves” for each service type. “Must haves” include things like boundary isolation, segmentation, no public ips, or public ips acceptable, etc.

Service Types Compute Data Storage Cognitive Utility On-prem to Cloud Cloud to On-prem Cloud to Cloud Cloud to 3rd party SaaS

The goal here is to say if we are working in a particular service in the cloud, we need at a minimum “x requirements met”. I will show you an example. Define the automation we need DevOps to build to accommodate (there is a backlog item today) Draft a policy around ensuring we are protecting our build out

Comments from meeting: What is the level of “best practice” we should use? Can we use Microsoft to help scope the PaaS and ecosystem? ZTA and the environment is massive ZTA for on-prem is being implemented with Guardicore Has applications that tie components together Can we tie it into the CMDB

What does it mean to Seagen? What are we doing today?

What problem will it solve?

Why do we want to do this?

What’s in it for me?

What will it give me?

Fundamentals Missing Source of truth - what defines our tags and applications 802.1x - what constitutes a Seagen owned device (InTune, Lab, cloud service, etc.) Unified tagging scheme for applications How do we classify applications Membership

Apply security to what architecture or systems?
Inventory
Monitoring and Remediation
Hub and Spoke Model for cloud

Next Steps Invite Gartner and Microsoft to describe what ZTA is Use the buzz word to help us How does Seagen define ZTA? What problem are we trying to solve? What is allowed to talk to what, systems and people

Problems

  • Applications and ecosystems

  • Segmentation and permissioning applications that talk to each other

  • Automation of onboarding new environments into the network

  • Developing and accessing cloud resources

  • Cloud native applications or ecosystems

  • Managed containers

  • ZTA between cloud providers (Azure to GCP)

  • Talk back to production systems on premises from cloud

    • What is the workflow and how does it apply

  • Standardize how we get things up and running (model, RA)

  • Technology covered via ZTA strategy

  • Where does threat modeling occur?

    • Train developers on risks, interdependencies

  • App Dev - configuration, what should or should not be stored locally

    • How we handle problems in Azure, critical, high, etc?

    • Who does it?

    • What are we trying to protect?

    • Understanding our data, how it travels, who sees it, who should not see it

  • Does everything have a baseline level of protection?

  • Model based on the basis that everything is dangerous, like if all of our systems were on the internet

  • Control plane or data plane in the design

    • Where they are logging on

    • Device

    • Data, is it normal or abnormal

    • Real time monitoring and catching issues

  • RA for how to connect and where

Scenarios

TOPS data science in the cloud needs to get to a system that is currently locked down on-premises. How would this work?

  • Approval process

  • Personas

    • Application Developer

    • Data Engineer

    • Machine Learning/Data Scientist

    • Cloud Engineer

  • Ownership

  • Delivery

  • Scenarios mapped to security profile

  • Secure Zones

  • Subscription

    • VNET

    • Subnet IPs

    • Firewalls

    • VPNs

Deliverables by EOY

  1. What is the structure in cloud when we use and configure it? RA

  • Publish standards

  • Definition of an application

  1. Process for identification

  • Make sure we know what we have

  • Understand the data we want to grant access to

  1. Verify an identity or things in play, you are who you say you are. Any perspective.

  • Tie an instance to a security group

  • We need a source of truth on grouping

  • Need unified tagging strategy across environments (By end of November)

    • Devices

    • Resources

    • Members

    • Groups

    • What does the app do

    • Where does the data live

    • What happens on the wire

    • Holistic view of applications