The Moscow Rules: Zero Trust Before It Had a Marketing Department
Moscow rules. Man, when Gary Oldman uttered that phrase in the latest and last episode of the year for The Unhurried Equines, I was just loving it. And the funny thing is, it may just be the Cold War predecessor of Zero Trust. We've been throwing that word out in the cybersecurity industry for several years now. Too many years and too many moments of it, not meaning anything more than buzzy buzzwords. I'm sure this is attempt number 9,255 but I thought I'd take a quick stab at maybe putting Zero Trust in another way, in fact, in a Cold War way.
So while they made for great TV, Moscow rules are actually an unwritten set of rules from the Cold War era and everyone assumed that they were being watched. Questioned anything that was normal or that appeared normal, you avoided predictable behavior and understood that one careless assumption could compromise an entire operation.
Assume nothing.
Today in technology, with everything connected, we absolutely have to assume nothing. Every identity within your system has to be verified: every username, every account, every role, every device, every role, every access, and every set of permissions.
Everyone is potentially under the opposition's control.
I think when you look at any account or another endpoint, or perhaps even deeper (your supply chain, your vendors, your HVAC providers, and systems), you have to assume that they're under opposition control. We know they're not always or maybe even not typically. This point is to say that we need to design our systems so that if there are compromised credentials they cannot expose our entire environment. We keep the impact minimal. What did you just expose to them? Critical personal information? Healthcare data?
You are never completely alone.
You totally have to assume that you're not completely alone. Do you have full visibility into your network activity? Do you know what suspicious behavior might be happening? Do you have detection and response capabilities? Did someone just perform the impossible login where they logged in from Saskatchewan, Okoboji, and Twin Falls, Idaho, all at the same time?
Pick the time and place for action.
Having an incident response plan before the attack happens is imperative. With a proper incident response plan you will know what to do when an incident starts and while you might not have picked the time, you may be able to quickly switch the battlefield shifting the advantage back to your side, turning the tables. Decrease the damage. Maybe keep data from exfiltrating, and encrypted just in case. Pick the action.
Keep your options open.
I think my favorite might be keeping your options open and that can very easily be seen as maintaining tested backups, having recovery plans, doing tabletop exercises, and being prepared.
Honestly decades after the Cold War, it was a cool moment, great writing and for me a little cybersecurity light bulb. I enjoyed this episode of Plodding Rosinante’s ( …Apple’s Slow Horses) for this moment of clarity. The Moscow rules weren't a product. You couldn't buy them or install them. It was a way of thinking and operating. Unfortunately, the cybersecurity industry may have over productized ‘zero trust’ losing or at least obscuring that principle. Zero Trust is a way of operating. It's a way of thinking.
If you made this far perhaps you might like to check out our free security pulse. CyberCloak.Tech's free security pulse asks 12 questions in 20 to 30 minutes and gives you a great snapshot of your risk. All on us, no obligation.