제로트러스트 기반의 원격 근무 환경을 구축하기 위한 보안요구사항 분석 연구
A Study on the Security Requirements Analysis to Build a Zero Trust-Based Remote Work Environment
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
최근 클라우드의 사용량이 해마다 증가하고 기업 내 원격 근무가 새로운 근무 형태 중 하나로 자리 잡으면서 클라우드 기반 원격 근무 환경의 보안이 중요해졌다. 내부 네트워크 안에 있는 모든 것은 안전하다고 가정하는 기존의 경계 기반 모델의 한계로 인해 제로트러스트 도입이 요구되고 있다. 이에 따라 NIST 및 DoD는 제로트러스트 아키텍처 관련 표준을 발간하였지만, 해당 표준의 보안요구사항은 추상적인 수준에서 논리적 아키텍처만을 기술하고 있다. 따라서 본 논문에서는 OpenStack 클라우드에 대한 위협모델링을 수행하여 NIST 및 DoD 표준에 비해 보다 상세한 보안요구사항을 제시하고자 한다. 이후 본 연구팀은 해당 요구사항에 대한 검증을 위해 상용 클라우드 서비스들에 대한 보안성 분석을 수행하였다. 보안성 분석 수행 결과 본 연구팀에서는 각 클라우드 서비스가 만족하지 못하는 보안요구사항을 식별하였다. 본 연구팀은 제로트러스트가 적용된 클라우드 서비스에 대한 잠재적 위협과 대응 방안을 제안하였으며, 이를 통해 안전한 제로트러스트 기반 원격 근무 환경을 구축하는데 도움이 되고자 한다.
Abstract
Recently, as the use of the cloud increases year by year and remote work within the enterprise has become one of the new types of work, the security of the cloud-based remote work environment has become important. The introduction of zero trust is required due to the limitations of the existing perimeter security model that assumes that everything in the internal network is safe. Accordingly, NIST and DoD published standards related to zero trust architecture, but the security requirements of that standard describe only logical architecture at the abstract level. Therefore, this paper intends to present more detailed security requirements compared to NIST and DoD standards by performing threat modeling for OpenStack clouds. After that, this research team performed a security analysis of commercial cloud services to verify the requirements. As a result of the security analysis, we identified security requirements that each cloud service was not satisfied with. We proposed potential threats and countermeasures for cloud services with zero trust, which aims to help build a secure zero trust-based remote working environment.
참고문헌 (51)
- "Microsoft Build 2020:CEO Satya Nadella's opening remarks" (2020)[URL]
- "Gartner Forecasts Worldwide Public Cloud End-User Spending to Re ach Nearly $600 Billion in 2023" (2023)[URL]
- A Constant State of Flux: Trend Micro 2020 Annual Cybersecurity Report, "Trend Micro", Trend Micro Research, ~ (2021)
- "DEV-0537 criminal actor targeting organizations for data exfiltration and destruction By Microsoft I ncident Response" (2023)[URL]
- No More Chewy Centers: Introducing The Zero Trust Model Of Information Security, "John Kindervag", Forrester, ~ (2010)
- National Institute of Standards and Technology, "NIST SP 800-207 Zero Trust Architecture", ~ (2020)
- Defense Information Systems Agency (DISA) And National Security Agency (NSA) Zero Trust Engineering Team, "Department Of Defense Zero Trust Reference Architecture, Version 2.0", ~ (2022)
- Forrester, "The I&O Pro’s Guide to Enterprise Open Source Cloud Adoption, Q1 2018", ~ (2018)
- Beyondcorp – A New Approach To Enterprise Secuirty, "Ward, Rory", Google, ~ (2014)
- "The Gartner IT Security Approach for the Digital Age" (2023)[URL]
- Bryan Zimmer, "LISA: A Practical Zero Trust Architecture", Usenix, ~ (2018)
- Theo Dimitrakos, "Trust Aware Continuous Authorization for Zero Trust in Consumer Internet of Things", 2020IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp.1801~1812 (2020)
- Mandal, S., "Cloud-Based Zero Trust Access Control Policy : An Approach to Support Work-From-Home Driven by COVID-19 Pandemic", New Gener. Computing, 39, pp.599~622 (2021)
- P. García-Teodoro, "A novel zero-trust network access control scheme based on the security profile of devices and users", Computer Networks, 212 (2022)
- Nisha T N, "Zero trust security model:Defining new boundaries to organizational network", Proceedings of the 2023 Fifteenth International Conference on Contemporary Computing, pp.603~609 (2023)
- Zero Trust Report –Lessons Learned From Vendor And Partner Resear, "ACT-IAC", ~ (2021)
- IMPLEMENTING A ZERO TRUST ARCHITECTURE, "Alper Kerman", NCCoE, ~ (2020)
- DISA, "Department of Defense (DOD) Zero Trust Reference Architecture Version 1.0", ~ (2021)
- NSA, "Embracing A Zero Trust Security Model", ~ (2021)
- CISA, "Zero Trust Maturity Model", ~ (2023)
- National Institute of Standards and Technology, "NIST SP 800-53 Security and Privacy Controlsfor Information Systems and Organizations", ~ (2020)
- "Zero Trust security" (2023)[URL]
- Microsoft, "Evolving Zero Trust - How Real-World Deployments And Attacks Are Shaping The Future Of Zero Trust Strategies", ~ (2021)
- "Understanding Zero Trust principles" (2023)[URL]
- "Google Cloud Architecture Framework" (2023)[URL]
- Victor Escobedo, "Beyondcorp 5 – The User Experience", Google, ~ (2017)
- R. Khan, "STRIDE-based threat modeling for cyber-physical systems", 2017 IEEE PES Innovative Smart Grid Technologies Conference Europe (ISGT-Europe), pp.1~6 (2017)
- M. Cagnazzo, "Threat modeling for mobile health systems", 2018 IEEE Wireless Communications and Networking Conference Workshops (WCNCW), pp.314~319 (2018)
- Zaina Abuabed, "STRIDE threat model-based framework for assessing the vulnerabilities of modern vehicles", Computers & Security, Computers &Security, 133 (2023)
- "Microsoft Threat Modeling Tool" (2022)[URL]
- "OpenStack documentation -design" (2023)[URL]
- Sean Metcalf, "Attacking and Defending the Microsoft Cloud (Office 365 & Azure AD)", Black Hat USA, ~ (2019)
- "CVE-2022-47951" (2023)[URL]
- "The MITRE Corporation" (2023)[URL]
- "OpenStack documentation -security checklist" (2023)[URL]
- "CVE-2023-40585" (2023)[URL]
- "CVE-2023-3637" (2023)[URL]
- "CVE-2023-2088" (2023)[URL]
- "CVE-2023-1636" (2023)[URL]
- "CVE-2023-1633" (2023)[URL]
- "CVE-2023-1625" (2023)[URL]
- "Huge Cloud Market Still Growing at 34% Per Year; Amazon, Microsoft & Google Now Account for 65% of the Total" (2023)[URL]
- "Azure documentation" (2023)[URL]
- "Welcome to AWS Documentation" (2023)[URL]
- "Google Cloud Document ation" (2023)[URL]
- Cost of a Data Breach Report 2021, "IBM Security", ~ (2021)
- "The Critical Role of SSL Decryption & Inspection in Web Security" (2020)[URL]
- Unit 42 Cloud Threat Report, Volume 6, "Paloalto Networks", ~ (2022)
- "Andariel" (2023)[URL]
- Data Breach Investigations Report, "Verizon", ~ (2022)
- Threat Trend Report on TeamTNT Group, "AhnLab Security Emergency Response Center (ASEC)", AhnLab, ~ (2021)