all of its uncertainties, Zero Trust is an important security solution for the emerging metaverse that’s currently being built in IT shops near you.
Uncertainties exist because the Zero Trust security model, seemingly a new thing, actually dates back to 1994 and is in need of a modernization update in today’s world of hybrid clouds, remote work, distributed software supply chains and digital transformations.
The more important issue, however, is that Zero Trust has emerged as a go-to security model for modern systems that are based on a flawed, insecure foundation: today’s internet.
Nevertheless, despite those Zero Trust worries and speculation about what the metaverse will actually be, the darling security model is seen by some as a metaverse cybersecurity solution.
Included in that camp is Ian Thornton-Trump, chief information security officer (CISO) at Cyjax, a threat intelligence specialist based in the UK. He shared his views in a recent half-day online summit presented by Virtualization & Cloud Review titled “Getting Started with Zero Trust Security,” now available for on-demand viewing.
“It’s like everyone sees the dollar signs, but they don’t see the risk,” said Thornton-Trump in discussing metaverse cybersecurity with Virtualization & Cloud Review. His metaverse connection came near the end of his presentation, “Zero Trust 101: Why Zero Trust, Why Now, and Justifying Zero Trust,” after he described to the audience of hundreds how Zero Trust is built on the three pillars of visibility, automation and orchestration.
“Well, I’m not going to go into my presentation on, you know, NFTs and the metaverse and everything like that,” he said in winding down his presentation, “but conceptually, I think that the Zero Trust framework is going to be the only thing that will be an enabling level for that metaverse, for Web 3.0, and for all the things that we’ve built on the shaky foundations, which is the internet itself.”
And Thornton-Trump isn’t the only one thinking about metaverse security even though it isn’t really a thing yet.
Earlier this year, for example, Forbes discussed the metaverse in terms of new attack vectors.
“Even though the final implementation might differ from today’s vision, the metaverse will certainly use technologies like augmented reality (AR), virtual reality (VR), the Internet of Things (IoT) and cryptocurrencies,” the February article said. “These technologies promise to integrate and bring into alignment the physical world with digital worlds. But they will also open up new channels for cybercriminals to target businesses and individuals.”
And just last week, an exec at Akamai Technolgogies, Dean Houari discussed Zero Trust and the metaverse in an article on the ETCISO site, from an API angle.
“Given what metaverse promises to accomplish, Houari tells us how important Zero Trust is when it comes to building applications and laying the groundwork for the metaverse,” the article said. “Zero Trust, he explains, essentially means that we do not trust any communication, ‘regardless of whether it’s network communication, authentication or someone downloading a file from the internet.’ In the metaverse, any communication — between endpoints or between applications — will be driven through APIs. Zero Trust will be essential to secure that API communication. So whether it’s for authenticating a user or validating an avatar, an API will be used to secure the transaction.”
Coincidentally, “validating an avatar” was specifically mentioned by Thornton-Trump when we asked follow-up questions about his Zero Trust/metaverse connection, specifically about what makes Zero Trust a good metaverse security model.
“The 100 percent main thing is to verify continuously that it’s your avatar and you’re in control of it,” Thornton-Trump said.
“So if your avatar normally logs in from where you are in North Carolina, there better be some sort of security mechanisms that said that five minutes ago, he was logged in from Russia.”
Ian Thornton-Trump, Chief Information Security Officer, Cyjax
“So if your avatar normally logs in from where you are in North Carolina, there better be some sort of security mechanisms that said that five minutes ago, he was logged in from Russia. And that’s a problem, right? That’s the kind of thing where we need to figure out how to prevent account compromises and account takeovers in the virtual world.”
Validating an avatar ties into identity considerations, a key aspect of Zero Trust and other security models. Thornton-Trump said that when people ask him what they should initially focus on when implementing Zero Trust, he suggests trying to see if they are 100 percent up to speed on identity management within their organization.
“A lot of enterprises are Multi-Factor Authentication with Single Sign On, which is in my estimation the holy grail of controlling your identity management,” he said. “Maybe you’ve gotten visibility, like you have a grip on onboarding people and giving them the correct access. But unless it’s automated, mistakes can happen. If people change rules, a lot of the problem has been inheritable permissions. So they can have one person moved to different departments, and they have keys to everything. And then, of course, if your account is compromised, you lose all that. So visibility of all of your identity information, right. Then automation of — once that identity is created in like the payroll system or the human resources system — automating the creation and assignment of these particular groups. And then finally, under orchestration comes the deployment of the app suitable for the person that has those roles within the organization and access to the identity. And so you can see that if you don’t have the grip on identities within your organization, I would also suggest that you’re going to do — if you immediately moved to automation and orchestration — what you really want to do is make sure your visibility is there, across all of them.”
He offered more insights in the context of the three foundational pillars: visibility/automation/orchestration.
“We’re moving beyond trust, to verify, to verify all the time,” he said. “And when you see anomalous behavior [visibility], that’s where we get to the automation piece of controlling what is going on in your metaverse experience. In order to prevent a very bad thing from happening to — or, for corporation-speak, a negative outcome from your experience. And then finally, the orchestration pieces of this is how can we facilitate … will you be able to deposit your paycheck in the physical world and automatically move a portion of that money into your metaverse so that you have currency to spend in your metaverse? How are we going to orchestrate transactions so that fraud and fraudulent behavior and those type of things are easily identified and suppressed?”
Putting on his prognostication hat, Thornton-Trump offered some views on the future, predicting a five-year event horizon for the metaverse becoming as much a part of our daily lives as email is now.
