Comments on Least Privilege, Microsegmentation, and Visibility for High Value Assets

# Comments on Draft Report to the President on Federal IT Modernization
P.J. Kirner, Chief Technical Officer, Illumio

Thank you for the opportunity to provide comments on the Draft Report to the President on Federal IT Modernization. Illumio applauds both the Administration’s recognition that IT Modernization must focus on cybersecurity as a major risk to national security and citizen services, and its transparency in making the Draft Report accessible to all.

It’s great to see that the Draft Report focuses on a range of best practices for identifying and prioritizing the defense of High Value Applications/Assets(HVAs). I believe that these best practices can be further enhanced by emphasizing how to understand and limit the devices and components that can connect with HVAs. This approach dramatically improves HVA security by reducing the attack vectors that intruders can exploit and that defenders must secure. In this comment I offer a few specific examples of this approach that would fit with and strengthen the Draft Report.

## Recommendation 1: Expand the definition of “least privilege” between Users and Systems as addressed in the report, to also include System-to-System privileges.

The Draft Report lists “least privilege” as one of the foundational capabilities that should be implemented for all Federal IT systems. The report discusses least privilege as it applies to users (i.e. ensuring that users only have access to the specific systems and information they need in order to execute their official duties). This principle of least privilege should also be applied to system-to-system access, restricting communications to the minimum required for systems to perform the functions they are designed for.

In most organizations today, systems are far more connected than they need to be. In fact, we have found that many organizations use less than 3% of the connections that they permitted between their internal systems. Each unnecessary connection within a data center or cloud provides an intruder with a path to exploit compromised credentials or a vulnerability and move laterally to find targets where they can steal data or cause significant damage.

This ‘System to System’ dimension of least privilege is often referred to as “segmentation,” and it is an essential complement to user-based least privilege. In his recent Enigma talk(https://www.youtube.com/watch?v=bDJb8WOJYdA), Rob Joyce – currently Cybersecurity Coordinator, and previously head of NSA’s Tailored Access Operations Unit – details several key steps defenders should take to protect high value assets, and he emphasizes both traditional user-based least privilege and segmentation. Together, both sides of the least-privilege coin are vital to ensuring secure environments and secure high value applications.

## Recommendation 2: Expand the discussion of how to “improve visibility beyond the network level” specifically to address proactive application analysis.

On page 7, the draft report calls for agencies to improve their “visibility and resilience against more sophisticated attacks.” Current processes generally focus on reviewing security logs, triaging information security events, and detecting and preventing intrusions. These are important goals, but there is another component to application visibility that begins long before the intruder arrives: identifying the systems that make up key applications and mapping how those systems communicate with each other. This sort of real-time environmental understanding (sometimes called Application Dependency Mapping) is an essential first step to identifying potential threat vectors, and determining where to apply controls to proactively secure high value applications. Without it, organizations often miss critical opportunities to prevent an attack rather than just react to it, leaving themselves open to unnecessary risks. Agencies that emphasize this type of proactive application visibility would be more prepared and on more stable footing in the face of the type of sophisticated intruders that often target federal systems.

## Recommendation 3: Recommend that agencies seek out infrastructure-agnostic security tools.

Data centers today are heterogeneous, including everything from bare metal servers to virtual machines and containers. Most environments today also include cloud deployments with multiple cloud service providers, private clouds and simple virtualized environments. Security solutions that rely on uniform infrastructure to provide controls (both physical and virtual) are limiting, and can force organizations to either avoid investments in new technologies, deploy those technologies without security, or use multiple security tools to accomplish the same goal in different parts of their environment. Any of these choices can expose agencies to risk and threat. This is particularly serious in the context of agencies moving to the cloud, as security solutions that rely on physical infrastructure simply cannot work when the agency itself does not own the infrastructure in a cloud deployment. Recommending infrastructure-agnostic security solutions will ensure that federal agencies can (a) keep up with new and emerging technologies; (b) remain secure in increasingly heterogeneous environments; and (c) move to the cloud to operate more efficiently and increase their security.