Wednesday, November 14, 2018

Tabula Rosa Systems Blog Of 11/16/2018 - SDP Overview

                 Do Something Special!



Buy the books at

 www.amazon.com/author/paulbabicki
====================================================









software-defined perimeter (SDP)
https://cdn.ttgtmedia.com/rms/onlineImages/rouse_margaret.jpg
Posted by: Margaret Rouse
Software-defined perimeter (SDP) is a security framework developed by the Cloud Security Alliance (CSA) that controls access to resources based on identity. The framework is based on the U.S. Department of Defense's "need to know" model -- all endpoints attempting to access a given infrastructure must be authenticated and authorized prior to entrance. The SDP approach is sometimes said to create a "black cloud" because it obscures systems within the perimeter so that outsiders can't observe them.
The SDP uses an approach to cybersecurity that mitigates network-based attacks, protecting all classification levels of legacy IT assets and cloud services. The software-defined network works by hiding critical IT assets within an opaque black cloud that can't be accessed by outsiders, whether the assets are in the cloud, on premises, in a DMZ (demilitarized zone, sometimes known as a perimeter network), on a server in a data center or even in an application server.
An SDP functions as a broker between internal applications and users and only provides access to services if the correct criteria are met. This enables companies to determine which users have access to which applications. Segmenting applications via SDP enables organizations to secure sensitive information more easily.
The SDP creates an invisible screen to protect against malware, cyberattacks and other threats. This framework was designed to let enterprises provide secure access to network-based services, applications and systems.
SDPs are used to lower the chances of successful network-based attacks, including denial-of-service (DoS) attacks, man-in-the-middle attacks, server vulnerabilities and lateral movement attacks, such as SQL injection or cross-site scripting (XSS).
Uses of an SDP
SDPs are implemented for many different reasons, including:
·        SDPs support a variety of devices. The perimeter can authenticate laptops and PCs, as well as mobile devices and internet of things (IoT) devices, and SDPs ensure that connections can't be initiated from unauthorized or invalid devices.
·        SDPs restrict broad network access. Individual entities aren't granted broad access to network segments or subnets, so devices can only access the specific services and hosts that are permitted by policy. This minimizes the network attack surface, as well as prohibits port and vulnerability scanning by malicious users or malicious software.
·        SDPs support a broader risk-based policy. The SDP systems make access decisions based on numerous risk criteria, including threat intelligence, malware outbreaks, new software and more.
·        SDPs can be used to connect anything. Software-defined perimeter technology enables connectivity to only the IT resources required by employees without the cumbersome management requirements or mounting hardware costs.
·        SDPs enable control of services, applications and access. SDPs are capable of controlling which applications and devices are allowed to access specified services. This limits the attack surface and stops malicious users or malware from connecting to resources.
SDP framework
Software-defined perimeter technology enables a secure perimeter based on policies used to isolate services from unsecured networks. The goal of the CSA's SDP framework is to provide an on-demand, dynamically provisioned, air-gapped network -- a segmentation of network resources that mirrors a physically defined network perimeter but operates in software rather than via an appliance -- by authenticating users and devices before authorizing the user/device combination to securely connect to the isolated services. Unauthorized users and devices can't connect to the protected resources.

The Cloud Security Alliance explains software-defined
perimeters.
When the authentication is completed, the trusted devices are given a unique and temporary connection to the network infrastructure. The SDP framework lets companies streamline operations when it comes to user authentication and application security.
SDP deployment models
SDP deployment models can be characterized by the way they structure interactions among clients, servers and gateways. The primary approaches to implementing software-defined perimeter technology include: are the greatest challenges you've encountered Client-to-gateway deployment positions the servers behind an Accepting Host, which acts as a gateway between the protected servers and the clients -- Initiating Hosts in SDP terminology. The client-to-gateway SDP can be deployed inside a network to reduce such lateral movement attacks as operating system (OS) and application vulnerability exploits, man-in-the-middle attacks and server scanning. It can also be deployed directly on the internet in order to segregate protected servers from unauthorized users, as well as to mitigate attacks.
·        Client-to-server deployment is similar to the client-to-gateway deployment except that the server being protected by the SDP is the system that runs the Accepting Host software -- instead of the gateway. Deciding between the client-to-gateway and the client-to-server deployment is usually based on a number of factors, including analysis of load-balancing needs, the servers' elasticity -- how adaptable the cloud server is to changes in workloads -- and the number of servers an enterprise needs to protect behind the SDP.
·        Server-to-server deployments use servers that offer any kind of application programming interface (API) over the internet, can be protected from all unauthorized hosts on the network -- including a Simple Object Access Protocol (SOAP) service, a remote procedure call (RPC), a representational state transfer (REST) service or similar -- and use it to communicate between the Accepting Host and the Initiating Host.
·        Client-to-server-to-client implementations depend on a peer-to-peer (P2P) relationship between the clients that can be used for applications such as chat, video conferencing, IP telephony and similar applications. In this deployment, the SDP obfuscates the IP addresses of the connecting clients, with the server acting as the intermediary for both clients.
This was last updated in October 2018

+++++++++++++++++++++++++++++++++++++++++++++++++++===================================  
Good Netiquette And A Green Internet To All!  =====================================================================Tabula Rosa Systems - Tabula Rosa Systems (TRS) is dedicated to providing Best of Breed Technology and Best of Class Professional Services to our Clients. We have a portfolio of products which we have selected for their capabilities, viability and value. TRS provides product, design, implementation and support services on all products that we represent. Additionally, TRS provides expertise in Network Analysis, eBusiness Application Profiling, ePolicy and eBusiness Troubleshooting

We can be contacted at:

sales@tabularosa.net  or 609 818 1802.
 ===============================================================
In addition to this blog, Netiquette IQ has a website with great assets which are being added to on a regular basis. I have authored the premiere book on Netiquette, “Netiquette IQ - A Comprehensive Guide to Improve, Enhance and Add Power to Your Email". My new book, “You’re Hired! Super Charge Your Email Skills in 60 Minutes. . . And Get That Job!” has just been published and will be followed by a trilogy of books on Netiquette for young people. You can view my profile, reviews of the book and content excerpts at:

 www.amazon.com/author/paulbabicki

Anyone who would like to review the book and have it posted on my blog or website, please contact me paul@netiquetteiq.com.

In addition to this blog, I maintain a radio show on BlogtalkRadio  and an online newsletter via paper.li.I have established Netiquette discussion groups with Linkedin and  Yahoo I am also a member of the International Business Etiquette and Protocol Group and Minding Manners among others. I regularly consult for the Gerson Lehrman Group, a worldwide network of subject matter experts and I have been contributing to the blogs Everything Email and emailmonday . My work has appeared in numerous publications and I have presented to groups such as The Breakfast Club of NJ and  PSG of Mercer County, NJ.


Additionally, I am the president of Tabula Rosa Systems, a “best of breed” reseller of products for communications, email, network management software, security products and professional services.  Also, I am the president of Netiquette IQ. We are currently developing an email IQ rating system, Netiquette IQ, which promotes the fundamentals outlined in my book.

No comments:

Post a Comment