SDP与零信任：云安全联盟的指南

需积分: 18 193 浏览量更新于2024-07-15 收藏 875KB PDF 举报

"本文档由云安全联盟CSA发布，主要介绍了软件定义边界(Software Defined Perimeter, SDP)和零信任(Zero Trust)的概念，是理解这两种安全模型的重要参考资料。" 软件定义边界(SDP)是一种新兴的安全架构，旨在通过在用户访问网络资源之前建立严格的验证和控制，来保护网络不受未经授权的访问。SDP的核心理念是“无连接即隐藏”，即除非经过身份验证和授权，否则所有网络服务和资源都是不可见的。这一概念对于应对现代网络安全挑战至关重要，因为在传统的网络安全模型中，一旦攻击者进入内部网络，他们可以自由地访问各种资源。零信任模型是基于“永不信任，始终验证”的原则，无论用户或设备位于何处，都必须进行身份验证和授权。这个模型强调了对内部网络边界的弱化，不再假设网络内部的流量是安全的，而是要求所有访问请求都要经过严格的验证。零信任包括多个组件，如身份验证、设备完整性检查、访问控制和持续监控，确保只有经过验证的实体才能访问所需资源。在SDP和零信任的结合中，SDP可作为实现零信任的一个重要步骤，通过创建一个动态的、高度安全的访问环境。例如，当用户尝试访问网络资源时，SDP首先会验证用户的身份，然后检查其设备是否符合安全策略，最后才允许访问。这一过程确保了即使在不安全的环境中，也能保护敏感数据和关键系统免受攻击。文档的贡献者包括Juanita Koilpillai、Nya Alison Murray等多位业界专家，他们共同为这个领域的理论与实践提供了深入的见解和建议。云安全联盟CSA的这个工作小组提供了一个官方的在线平台（https://cloudsecurityalliance.org/software-defined-perimeter/），供专业人士交流和获取最新信息。 SDP和零信任模型代表了现代网络安全的前沿思想，它们改变了我们对网络保护的理解，强调了对访问控制的重视，以及在不断演变的威胁环境中，如何确保企业信息安全的关键措施。企业应当考虑将这些概念纳入其安全策略，以提高防御能力并降低风险。

Introduction

Software Deﬁned Perimeter (SDP) is a network security architecture that is implemented to provide

security at Layers 1-7 of the OSI network stack. An SDP implementation hides assets and uses a

single packet to establish trust via a separate control and data plane prior to allowing connections

to hidden assets. A Zero Trust implementation using Software Deﬁned Perimeter (SDP) enables

organizations to defend new variations of old attack methods that are constantly surfacing in existing

network and infrastructure perimeter-centric networking models. Implementing SDP improves the

security posture of businesses that face the challenge of continuously adapting to expanding attack

surfaces that are increasingly more complex.

Originally, Zero Trust Network (ZTN) concepts were developed by the US Department of Defense

(DoD) in the early 2000s while deﬁning Global Information Grid (GIG) Network Operations (NetOps)

Black Core routing and addressing architecture, part of the DoD’s Netcentric Service Strategy. Over

time, this concept evolved within the DoD intelligence and security communities into the current

ZTN/SDP framework and test lab

. Around the same time, Forrester, a market research company that

provides advice on technology began promoting ZTN as a worthwhile consideration for enterprise

security teams. Today, Zero Trust has grown widely in adoption, as well as scope.

In the report entitled "Zero-Trust-eXtended-ZTX-Ecosystem," Forrester analysts observe that

the changing nature of the network perimeter means that the historical context of Zero Trust

architecture is transforming rapidly from "segmenting and securing the network across locations and

hosting models." Forrester asserts that the current model, which supports the need to challenge and

eliminate the inherent trust assumptions in current security strategies, suggests that a variety of

new adaptive software-based approaches should also be considered. However, it does not identify a

new direction for the "extended ecosystem framework."

Essentially, Zero Trust is a network security concept centered on the belief that organizations

should not automatically trust anything inside or outside traditional perimeters and aims to defend

enterprise assets. Implementing Zero Trust requires the veriﬁcation of anything and everything that

tries to connect to assets before granting access and the continued evaluation of sessions during

the entire duration of the connection. This is illustrated in Figure 1 where the National Institute of

Standards and Technology (NIST) describes using ‘trust boundaries.’

https://www.secureworldexpo.com/industry-news/pentagon-zero-trust-security-framework

https://www.em360tech.com/wp-content/uploads/2019/04/The-Forres-

er-Wave%E2%84%A2_-Zero-Trust-eXtended-ZTX-Ecosystem-Providers-Q4-2018-1-1.pdf

剩余23页未读，继续阅读

xray2005

粉丝: 441
资源: 33

SDP与零信任：云安全联盟的指南

零信任视频教程.mp4

软件定义边界和零信任.zip

Altium Designer：捕获向导在软件定义边界和零信任中的应用

软件定义边界与零信任：云安全新范式

Altium Designer：软件定义边界与零信任过滤技术

验证测试点：软件定义边界与零信任策略

复用查询表达式：软件定义边界与零信任实践

元件管理与软件定义边界：零信任环境的关键

优化测试点策略：软件定义边界与零信任原则

手动创建结构类：软件定义边界与零信任实践

最新资源