Stephan Schwichtenberg

This talk will give an introduction to the up and coming concept of Zero Trust. It will briefly point out shortcomings of security in the past. We will discuss why there are signs for a paradigm shift and illustrate what security of the future looks like to us. We show different approaches and concepts and share our vision of how we believe data sovereignty can be established. We hope to exchange thoughts and ideas with the audience to make this a valuable and interactive talk in which we can all bring in our knowledge to build secure digital environments.

An introduction into ZeroTrust followed by an interactive discussion with the audience.

This talk will give an introduction to the up and coming concept of Zero Trust. It will briefly point out shortcomings of security in the past. We will discuss why there are signs for a paradigm shift and illustrate what security of the future looks like to us. We show different approaches and concepts and share our daily hands-on experience as enterprise architects. We hope to exchange thoughts and ideas with the audience to make this a valuable and interactive talk in which we can all bring in our knowledge to build secure digital environments.

Agenda

1) Current situation: complicated & incomplete threat models 2) Concepts worth looking into 3) data sovereignty 4) named data networks 5) zero trust 6) Our hands-on experience with the above

The current state of play to protect data is a tedious task that involves many stakeholders and blocks resources. The shift from on-premise to private/public cloud systems requires a careful inspection of an assumed threat model. The application of a zero-trust model is one radical shift to authenticate and authorize at any given point in your IT landscape, but most importantly it breaks with the assumption that we can design systems that are "safe and secure". The talk will highlight the above mentioned concepts and will give a brief outline of a new approach called Named Data Network (NDN) and how this could improve the situation in terms of data sovereignty.

CHALLENGE The exchange of data between applications continually raises concerns as to the authorization and dynamic network of devices.
In particular, within the realm of IoT, some messaging paradigms are used which from a security perspective offer little to no value. Closed systems arise, yet the future data value remains unclear. Additional project and integrations costs are a direct result of delays in connections. Data quality, data transparency, and data sovereignty of users, companies, and organizations suffer as a result of this.

SOLUTION What is Neuropil? We all have it in us: The fibrous network of tissue which forms the gray matter in our brain. Neuropil facilitates the networking between individual cells. It is in this manner that the Neuropil layer, an open source solution, assures the stable communication between machines and applications. What makes it so unique is that the secure exchange of data between the IoT devices and applications is dynamic, decentralized, and fully automated.

The Neuropil® layer, therefore, ensures data quality, data transparency, and data sovereignty all the while reducing IT costs, maximizing availability, and increasing reliability. A secure IoT is a crucial prerequisite for secure collaboration and competitive businesses.

The Neuropil® layer provides: - Automatic discovery of data channels across enterprises - Attribute based access control to authorize data exchange - Asymmetric end-to-end encryption between the participating systems - Protection of IoT devices regarding excessive payloads - High scalability without central infrastructure - Centralized governance, but decentralized messaging

The neuropil messaging layer combines several proven IT concepts, but rearranges them to accomplish a secure interaction of things. The combination is a mixture of MQTT, VPN and DNS, with a strong focus on privacy (meta-data obfuscation) and security (double encryption).

Unlike other pure messaging systems we have designed our solution without additional components. Each system or application, which uses the neuropil messaging layer becomes part of an overlay network.

Most encryption solutions are designed to protect two communicating parties using a direct connection. The neuropil messaging layer accounts for intermediate hops within the (overlay) network. It defines a routing and discovery protocol to automatically exchange required security credentials or other information.

Due to this approach it is possible to address fingerprints of identities (belonging to a system, person or device), without prior exchange of IP addresses or certificates. This eases the setup and build-time to a minimum and reduces the time to market of IoT solutions.

What makes it so unique is that the SECURE exchange of data between the IoT devices and applications is DYNAMIC, DECENTRALIZED, and FULLY AUTOMATED. Furthermore, it is highly SCALABLE without needing a central infrastructure.

DYNAMIC: We have a strong focus on attribute-based authorization supported by digital identities for devices, applications and users alike. Compared to other systems this allows neuropil® messaging layer to establish highly secure connections that are dynamic and can, therefore, be changed at any time.

DECENTRALIZED: Moreover, traditional messaging systems cover the horizontal value chain within a single enterprise and its internal connections. Neuropil® messaging layer on the other hand can work throughout different organisations and systems (vertical), greatly reducing legislative burdens. As an example it enforces technical SLAs (i.e. the number of messages a second party may send into your IT infrastructure) and follows a decentralized, distributed network setup (please see attachment for visualization), which eliminates single points of attack.

Combining a dynamic and decentralized system allows neuropil® messaging layer to cut down project costs. This includes development and collaboration transaction costs, while new B2B connectivity can be setup within several days rather than several months.