Software-Defined Perimeter Architecture Guide Preview: Part 3

Part 3 in a four-part series

By Jason Garbis, Vice President/Secure Access Products, Cyxtera Technologies Inc.

Thanks for returning for our third blog posting, providing a preview of the forthcoming Software-Defined Perimeter (SDP) Architecture Guide. In this article, we’re focusing on the "Core SDP Concepts” section of the document, which introduces the underlying principles of SDP, and in which we explain the benefits that SDP provides. In the table below, we list five categories, and for each we explain several aspects of SDP that deliver benefits, along with some color commentary.

Information/Infrastructure Hiding

One of the key security benefits that SDP provides is that not only are the organization’s servers protected by the SDP Gateway, but the SDP infrastructure itself is secured against access by unauthorized users. This makes it safer to deploy SDP components in internet-facing roles, compared with traditional security infrastructure (such as VPNs) which are directly and easily accessible to attackers.

Mutual Two-way Encrypted Connections

Another key element of SDP is that all communications between components – typically the Client and the Controller & Gateways—are encrypted with mutually-validated TLS. This ensures that these elements can validate each other, ensuring the integrity of the system.

SDP and the Need-to-Know Access Model

Because SDP is built upon a whitelist access policy model, users are only permitted access to those specific network resources that are permitted by policy—not to an entire subnet or network. The SDP philosophy is that application-level authentication is insufficient security, and that the ability to access a network resource—even without credentials—is in fact a privilege that should be explicitly granted.

Dynamic Firewall

SDP acts as a logical (and in some implementations, actual) firewall, dynamically adjusting network access based on policies. This permits enterprises to create dynamic enclaves—essentially adapting user access to network resources based on membership attributes, such as directory group membership.

Application Layer Access

The final key element of SDP is that users only have access to specified, permitted network resources (referred to as “Applications”, even though they may be admin-level services such as SSH or RDP). By preventing all unnecessary network-level access, organizations benefit by having a reduced attack surface, preventing reconnaissance (such as port scanning) by unauthorized users, and enabling the detection of attempted malicious activity.

That’s a brief overview of the SDP Core concepts. In our next (and final) preview posting, we’ll be discussing the SDP Policy model. You can read our earlier installations here and here.

Jason Garbis is Vice President of Secure Access Products at Cyxtera, a provider of secure infrastructure for today’s hybrid environments, where he leads strategy and management for the company’s security solutions. Jason has over 25 years of product management, engineering, and consulting experience at security and technology firms including RSA, HPE, BMC, and Iona. He is co-chair of the Software Defined Perimeter (SDP) Working Group at the Cloud Security Alliance, holds a CISSP certification, is a published author, and led the creation of the Cloud Security Alliance initiative applying Software-Defined Perimeter to Infrastructure-as-a-Service environments.