{"id":39200,"date":"2021-01-19T22:30:50","date_gmt":"2021-01-19T22:30:50","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=92582"},"modified":"2021-01-19T22:30:50","modified_gmt":"2021-01-19T22:30:50","slug":"using-zero-trust-principles-to-protect-against-sophisticated-attacks-like-solorigate","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/using-zero-trust-principles-to-protect-against-sophisticated-attacks-like-solorigate\/","title":{"rendered":"Using Zero Trust principles to protect against sophisticated attacks like Solorigate"},"content":{"rendered":"

The Solorigate supply chain attack<\/a> has captured the focus of the world over the last month. This attack was simultaneously sophisticated and ordinary. The actor demonstrated sophistication in the breadth of tactics used to penetrate, expand across, and persist in affected infrastructure, but many of the tactics, techniques, and procedures (TTPs) were individually ordinary.<\/p>\n

Companies operating with a Zero Trust mentality across their entire environment are more resilient, consistent, and responsive to new attacks\u2014Solorigate is no different. As threats increase in sophistication, Zero Trust matters more than ever, but gaps in the application of the principles\u2014such as unprotected devices, weak passwords, and gaps in multi-factor authentication (MFA) coverage can be exploited by actors.<\/p>\n

\"Zero<\/p>\n

Applying Zero Trust<\/h2>\n

Zero Trust in practical terms<\/a> is a transition from implicit trust\u2014assuming that everything inside a corporate network is safe\u2014to the model that assumes breach and explicitly verifies the security status of identity, endpoint, network, and other resources based on all available signals and data. It relies on contextual real-time policy enforcement to achieve least privileged access and minimize risks. Automation and Machine Learning are used to enable rapid detection, prevention, and remediation of attacks using behavior analytics and large datasets.<\/p>\n

\"Zero<\/p>\n

Verify explicitly<\/h2>\n

To verify explicitly<\/em> means we should examine all pertinent aspects of access requests instead of assuming trust based on a weak assurance like network location. Examine the identity, endpoint, network, and resource then apply threat intelligence and analytics to assess the context of each access request.<\/p>\n

When we look at how attackers compromised identity environments with Solorigate<\/a>, there were three major vectors: compromised user accounts, compromised vendor accounts, and compromised vendor software. In each of these cases, we can clearly see where the attacker exploited gaps in explicit verification<\/strong>.<\/p>\n