Overview of implementation of Zero Trust in Adobe

1. © 2019 Adobe.
A Path to Achieving Network Security ZEN
Den Jones, Aron Anderson, Carlos Martinez

2. © 2019 Adobe. xxx
Zero-Trust: Why Do We Need It?
We mistakenly
consider the corporate
network safe
Network perimeter
no longer a security
boundary
Evolving tactics,
techniques & procedures
(TTP’s)
External (SaaS) Resources
Authentication ignored the
device

3. © 2019 Adobe. xxx
Defining Zero Trust – What Is It?
All networks
considered untrusted
Authentication
is now based on user
and device posture
Security boundary
evolved

4. © 2019 Adobe. xxx
Internal Applications
Defining Zero Trust – What Is It?
Security boundary
evolved
All networks
considered untrusted
ZEN
Platform
Authentication
is now based on user
and device posture
External (SaaS) Resources

5. © 2019 Adobe. xxx
Purpose
§ Transform our network and applications to a “cloud-like” state
§ Enable application access without the need to be internal or use VPN
§ Secure network level access based on user and device posture
5

6. © 2019 Adobe. xxx
Leverages Existing Investments In…
Authentication
Network Access Control
Logging
Endpoint Detection & Response
Device Management

7. © 2019 Adobe.
ZEN Overview
LEGEND
Client challenged for certificate
Active Directory
Compliance check to
Access Policy Engine
AuthN request to IdP
Client challenged for certificate
Compliance check to
Access Policy Engine
Allow access if all
conditions met
1
2
3
4a
4b
4c
5
xxx

8. © 2019 Adobe.
ZEN Overview
LEGEND
Request goes to web app
App makes AuthN request
to Okta
Okta delegates AuthN request
to vIDM
vIDM challenges client
for certificate
Certificate sent for authentication
CRL/OCSP Check
CRL/OCSP Response
Compliance Check
Response (Compliant)
If cert valid, vIDM generates
SAML response and send to Okta
Okta validates SAML, challenges
for MFA generates new SAML
response and sends to app
App validates SAML and if valid,
redirects user to protected
application content
1
2
3
4
5
6
7
8
9
10
11
12
xxx

9. © 2019 Adobe. xxx
Demo – compliant device
9

10. © 2019 Adobe. xxx
Demo – non-compliant device
10

11. © 2019 Adobe. xxx
User Behavior Analytics (UBA)
§ Applying data science and algorithms to identify anomalous activity

12. © 2019 Adobe. xxx
Purpose
§ Scale detection and prioritize analysis
§ Identification of anomalous events based on ML and statistical analysis
§ Leverage existing investments
§ Built using existing log and data sources (user auth events, endpoint posture)
§ Engage the user in the security process
§ User notification with call to action
§ Programmatic activity based on user response
§ Device posture published to central portal (Trust Score Engine)
12

13. © 2019 Adobe. xxx
User Analytics Overview
13
API call to log
sources
• Logon events for
specified window
• User or device specific
info (travel data
example)
• Data filtering to specific
employee and event
types
Generate features
based on checks
• Examples:
• IP correlation (Adobe
owned)
• Match based on
threat intel (UAS, Geo,
IP)
• Inclusion of known
travel data
• Comparison with
attribute whitelists
• Statistical and ML
analysis using
historical data
Data tracking and
escalation
• Add features to dataset
(including DB)
• Escalation to users using
email and portal (API
based)
• Parsing of user
responses (Escalation or
updates to user
whitelist)

14. © 2019 Adobe.
Progress To Date
§ Certificates deployed to over 42,000 devices
§ 2000+ ZEN enabled applications
§ 30+ applications available via proxy
§ Trust Score Engine in production
§ Positive user response and interactions
§ 17,000+ employees don't have to change passwords every 90 days
§ Increased business process and user visibility
§ Identification of previously undetected malicious activity
§ Support for user workflow improvements
xxx

15. © 2019 Adobe.
Lessons Learned
§ No single off-the-shelf solution exists
§ Bringing vendors together is time consuming
§ Technology overlap

16. © 2019 Adobe.
IDSA Participation Benefits
§ Forum for pushing cross-vendor initiatives
§ Provides reality to the vendor ’echo-chamber’
§ Exposure to vendors, technologies, use cases, best practices
§ Improves knowledge and effectiveness of the team
§ Help drive innovation in the industry with vendors and solution providers

17. © 2019 Adobe.
IDSA-DP-002
17

18. © 2019 Adobe. xxx
Resources
§ Adobe Zero-Trust Whitepaper
https://adobe.com/go/projectZEN
§ Trust Center
https://trust.adobe.com
§ Open Source CCF v2.0
https://www.adobe.com/go/open-source-ccf
§ Security @ Adobe blog
https://blogs.adobe.com/security/
§ Advisories and updates
https://www.adobe.com/support/security
§ Twitter: @AdobeSecurity, @DenJonesCyber (Den Jones)

19. © 2019 Adobe.