Great discussion. I’d like to expand a little bit on this point. But first, I want to review the idea of a Zero Trust Architecture because in the end, it’s not just Epicor that we are worried about. Microsoft summarizes Zero Trust into three points:
- Verify explicitly
- Use least privilege
- Assume Breach
Verify Explicitly
This means use all data points possible to determine if the request is valid. Do I know this device? Is it patched? Is this a normal time to do this kind of work? Does this person regularly use this service? Is the IP from a range of known logins for this account? If not, I can request MFA, issue a biometric challenge, require a hardware token, etc. Azure calls these Conditional Access rules. With a firewall, you generally just need to know the IP and Port and your request is forwarded regardless of who you say you are. Yes, you can create inbound rules for known IP addresses, etc. but that is a lot more work than Conditional Access.
Use Least Privilege
The best non-computer example of this is the safe at the convenience store. “Give me all your money.” “I can’t. The safe only lets me have $50 once an hour. You can have $50 though…” The idea is to give the least amount of access for the least amount of time. Many of us now use different accounts for different purposes (or should anyway). I have an Epicor Admin account but it doesn’t have an email address so it’s more difficult to attack.
Apple does something similar with the iPhone fingerprint scanner (and I assume Face Scan). The biometric hardware is completely separate from the rest of the phone. The phone and scanner communicate through a secure enclave. The system puts a message in the enclave, “Hey, is this Mark?” The scanner picks up the message, does the scan, and puts the reply back into the enclave. There is NO WAY for a remote user to access your biometric info because the phone does have have that privilege. Similarly, we can use the Gateway as an enclave where we exchange messages instead of having the privilege to go through a hole in the firewall.
Assume Breach
Threat actors can fail many times. Companies only have to fail once. Complex passwords and even MFA are great, but this is whack-a-mole. The actors will work around those with supply chain attacks, zero-day bugs, and simple social engineering. The problem with a firewall is that it assumes it is protecting a secured network. Talk to anyone who has experienced a malware attack and they know that there is no secure network. The recommendation is to microsegment the network. Take the ERP servers off the domain. There is no business reason for them to be in there. Moving it to the cloud is not more secure if you have a “not least privileged” VPN connecting it to your local network. Use Web API’s, which can be secured with conditional access. Separate your Operational Technology (production machines), your security network, your video network, your HVAC network, each building from the main network. If any one of those gets breached, restrict the blast area.
And if I haven’t made you uncomfortable enough already: Active Directory is dead. You cannot do this stuff in an AD only world. Even Microsoft is not installing any more AD servers. They will retire AD within the Microsoft internal network as existing AD servers age out. Yes, they will still support AD for years to come but the AD Trust Model just doesn’t work well in a Zero Trust world.
in this project.
)
I thought that’s what I posted. My bad.
