Fortifying Autonomous Systems: Adopting a Zero-Trust Approach

As we move into an era that utilises increased autonomy through the Internet of Things (IoT), ensuring a resilient cyber-security posture is paramount. While presenting countless opportunities, it also massively increases the number of attack vectors for hostile actors to target.

Paul Ellis, Business Development – Aerospace and Defence, ANGOKA, explored how a zero-trust approach and robust identification measures can increase resilience when there are an increasing number of attack vectors.

A Complex Threat Environment

Encrypted communications often instil a false sense of safety. Companies feel that having put encryption in place they are safe, however, it’s crucial to recognise that encryption does not provide protection against a wide range of cyber attacks.

The most common way of secure networks remains the “walled garden” approach, in which access to a network is controlled. The challenge for this approach is that once a malicious actor is on a network, they are seen as trusted and able to go anywhere. While new technologies can actively monitor networks for anomalous behaviour, they detect a cyber breach after it has occurred.

Ellis commented: “The IT industry, the cybersecurity industry, I’d go as far as saying some parts of the national security system have got it into our heads that as long as everything’s encrypted, it’s safe, and I would argue it’s not.

“We have a secure network. The problem with secure networks, of course, is they’re fine while they’re secure, but once someone’s on that network, they can go anywhere on the network, usually. And that’s a huge risk.”

If those networks being compromised present a big risk, there is an imperative to ensure there are robust security measures in place – especially when you consider how many attack vectors autonomous systems and the IoT present.

Adding Reliance Through Zero-Trust

One potential approach to better cyber security for autonomous platforms is to operate a Zero Trust network. This approach which has been around for just over two decades, operates on a principal of “never trust, always verify”. This approach would apply to every communication on the network.

This concept has been increasingly discussed as a potential defence solution. However, implementing a zero-trust network is challenging. At present machine identities are software based which means they can potentially be hacked, and use parameters such as IP or MAC address, or the device serial number as the basis for the identity all of which are a weak root of trust.

ANGOKA has been looking at an alternative solution which involves establishing a unique machine identity for each device based on a hardware root of trust. Devices are then bound into a Device Private Network where ANGOKA’s integrated identity and key management platform creates trust, even over un-trusted networks, allowing devices to communicate securely by verifying: the Integrity of the device; data provenance and non-repudiation of data. The system uses a decentralised, automatic and dynamic key exchange which provides the additional benefit of removing the need for a 3rd party certificate authority to exchange keys.

As we navigate the complexities of an increasingly interconnected world, fortifying our cyber-security posture becomes ever more pressing.

Embracing a zero-trust approach based on robust machine identities offers a promising path towards mitigating the escalating risks posed by the proliferation of attack vectors for autonomous devices.