In my previous blogs, I’ve consistently emphasized the risks associated with the traditional security model, which necessitates constant, unvalidated updates to the kernel. This approach, not only ineffective in preventing breaches from what it can’t detect, can lead to catastrophic outcomes, such as the incident involving CrowdStrike. The need for a more robust and secure model is evident, and the Zero Trust framework emerges as a solution that doesn’t rely on these flawed mechanisms.
The Hidden Costs of Legacy Security Architecture
As highlighted in my earlier discussions, the legacy security architecture’s dependency on kernel updates poses significant risks. CrowdStrike’s catastrophic outage serves as a stark reminder of these vulnerabilities. The traditional approach leaves systems exposed at two levels:
a) Security: Because they use a default allow security posture, they provide much worse security posture by allowing new unknown adversaries to execute simply because they can’t detect them.
b) Safety: Because of their constant need to continually update the kernel with unvalidated content/code/script, they are playing Russian roulette with the availability of the enterprise they are supposed to protect.
The Zero Trust Paradigm
The Zero Trust framework addresses these vulnerabilities comprehensively:
a) Security: Zero Trust eliminates the need for a default allow security posture. Instead, it ensures that every access request is thoroughly validated, significantly reducing the risk of breaches. This prevents new unknown adversaries from executing undetected, thereby providing a much stronger security posture.
b) Safety: Zero Trust removes the necessity for constant kernel-level updates. By avoiding the inclusion of unvalidated content, code, or scripts in the kernel, Zero Trust greatly enhances the stability and availability of enterprise systems. This mitigates the risks associated with the legacy approach and prevents playing Russian roulette with the enterprise’s availability.
Microsoft Endorses Zero Trust
On Jul 25, 2024, Microsoft has validated this vision, in response to CrowdStrike incident. In their blog, Microsoft underscores the importance of modern Zero Trust approaches. They state, “These examples use modern Zero Trust approaches and show what can be done to encourage development practices that do not rely on kernel access.” This marks a watershed moment, drawing a line in the sand and putting all legacy vendors on notice to abandon their old, vulnerable architectures.
A Shift Towards a More Secure Future
The transition to a Zero Trust security model is not just a theoretical recommendation but a practical necessity. The legacy model’s inherent risks and the recent validation by Microsoft make it clear that Zero Trust is the future of endpoint security. This approach mitigates the risks associated with kernel updates and provides a more secure and resilient architecture.
In conclusion, the recent endorsement of Zero Trust by Microsoft aligns with the points I’ve been advocating in my previous blogs. The shift away from unvalidated kernel updates towards a more secure and validation-driven approach is not just advisable—it’s essential. As we move forward, adopting the Zero Trust framework will be pivotal in safeguarding our digital environments from catastrophic failures and breaches.
### References
1. [The Hidden Costs of Legacy Security Architecture: System Crashes and Cyber Breaches – CrowdStrike’s Catastrophic Outage](https://melih.com/the-hidden-costs-of-legacy-security-architecture-system-crashes-and-cyber-breaches-crowdstrikes-catastrophic-outage/)
2. [Windows Resiliency Best Practices and the Path Forward](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-resiliency-best-practices-and-the-path-forward/ba-p/4201550)
3. https://www.forrester.com/blogs/falcon-fallout-whats-next-for-crowdstrike-competitors-and-cisos/