<\/p>\n\n\n\n
PARTNER CONTENT: Telco security leaders face a challenging future. Not only must they support essential new revenue-generating plans, but they must do so against the backdrop of a rapidly expanding attack surface, a fast-evolving threat landscape, and growing IT and business complexity. It\u2019s a world in which the old certainties of perimeter-based cybersecurity are gone. And one which Zero Trust was built for.<\/strong><\/p>\n\n\n\n But the journey to Zero Trust is a complex, multi-year endeavour. And one which must feature encryption to protect data and continually and securely authenticate users and devices. The question is how to achieve this kind of strong encryption in a future-proof way that aligns with Zero Trust. It must be dynamic, standards-based and agile enough to mitigate the security risks of today, and tomorrow.<\/p>\n\n\n\n <\/p>\n\n\n\n Zero Trust is not a new concept. But thanks to a push by the US government<\/a>, and the incorporation of Zero Trust principles into Secure Access Service Edge (SASE) offerings, adoption has gained momentum over recent years. It speaks to the IT environment that many telcos and enterprises currently operate: one embracing cloud and edge computing, Internet of Things (IoT) and remote or hybrid working.<\/p>\n\n\n\n It is a world in which the idea of building a wall around enterprise IT assets and defending them from external threats has become virtually obsolete. Instead, the Zero Trust mantra is to assume breach, never trust and always verify. Among other things, it relies on micro-segmentation of networks to contain the blast radius of potential breaches, and dynamic access management to understand who is accessing what, from which device\/machine, and when. Encryption is mandated in this approach, to safeguard data at rest and in transit, and support micro-segmentation, least privilege access and device and user identity checks.<\/p>\n\n\n\n \u201cYou’ve now got stuff in the cloud. You’ve got a variety of different technologies at the edge. You’ve got people working remotely. You’ve got all sorts of different scenarios that don’t really lend well to the old castle-and-moat model,\u201d explains Arqit Director of Professional Services, Phil Burn. \u201cNever trust, always verify is about continuously checking endpoints in different ways to make sure that you know<\/em> they\u2019re trusted rather than just being inherently trusted. It’s asking questions like, what is the endpoint? What resources is it accessing? Who is accessing them? Where are they located? What time is it? And is that normal?\u201d<\/p>\n\n\n\n In mitigating risk like this, Zero Trust is as relevant to a public telco network as a 5G private network. And it aligns neatly with the risk-based approach to cybersecurity that global regulators increasingly want to see from organisations. The potential use cases are almost limitless.<\/p>\n\n\n\n <\/p>\n\n\n\n The challenge for telcos is making this a reality without compromising on scalability, performance and security. The legacy hardware and software that permeate most networks make the Zero Trust transition challenging, time consuming and resource intensive. That\u2019s why security leaders are looking for solutions which are lightweight, standards-based and support existing protocols\u2014reducing the need for \u201crip and replace\u201d.<\/p>\n\n\n\n The Zero Trust Access (ZTA) philosophy demands that all traffic should be encrypted, encryption keys should be rotated often, and that a \u201ccrypto-agile\u201d approach is needed to stay ahead of emerging threats. That is a big ask for many existing market solutions. Public Key Infrastructure (PKI)-based offerings (asymmetric encryption) offer automation and usability but are not \u201cquantum safe\u201d. In time, this means data could be unmasked by cryptographically relevant quantum computers (CRQCs). Already, experts believe threat actors are performing \u201charvest now, decrypt later\u201d attacks.<\/p>\n\n\n\n On the other hand, symmetric, pre-shared encryption keys are more robust, but are usually long-lived and therefore less secure. In Zero Trust, being able to quickly revoke keys suspected of being compromised is essential. This is more difficult with many symmetric key systems. And their long-lived nature is anathema to \u201cleast privilege\u201d, which requires a more granular approach to access control.<\/p>\n\n\n\n <\/p>\n\n\n\n This is where the Arqit SKA-Platform\u2122 comes in. The platform uses a lightweight software agent to enable the endpoints themselves to generate unique keys in order to authenticate devices and establish secure network connections. It introduces fully symmetric authentication and encryption keys, to add protection from quantum attacks. But they also have the advantage of being ephemeral (short lived). This means they can be rotated as often as needed to mitigate the risk of device spoofing, and support the kind of continuous verification and least privilege policies that are central to Zero Trust.<\/p>\n\n\n\n Transitioning to Zero Trust can harm user experience and productivity, and add unnecessary administrative complexity, if not done correctly. That\u2019s why the Arqit platform prioritises both security and usability via a heavily automated, software-based solution that can be simply and centrally managed. In fact, everything from authentication to encryption can be automated to help slot into existing systems, and even support the kind of single-pane-of-glass approach favoured by Italian telco Sparkle<\/a>.<\/p>\n\n\n\n \u201cWe\u2019re really keen on just bringing trust all the way down to the endpoint. There\u2019s no \u2018human in the loop\u2019, which means a huge amount of the key management burden just disappears. It\u2019s all automated in the background for you\u2014which also minimises the risk you would get by letting people have access to keys,\u201d says Burn.<\/p>\n\n\n\n \u201cIt comes back to those three boxes of \u2018security, efficiency and integration\u2019. Anything public key-based loses some of the security, even with the development of post-quantum algorithms. There are solutions that are a lot less dynamic, such as those dependent on pre-shared keys. Whereas we ensure devices generate their own unique authentication keys, and we can group them dynamically, so it\u2019s easy to revoke access if you don\u2019t trust one endpoint. When we generate encryption keys to secure networks, they are established directly between the devices themselves with no human in the loop, which is extremely secure and in line with the ethos of Zero Trust.\u201d<\/p>\n\n\n\n <\/p>\n\n\n\n Crucially, the Arqit SKA-Platform also supports high-performance, security-first Intel processors. The firm\u2019s Enterprise Segment Manager, Michihiro Koyama, explains that encryption requires a great deal of \u201cmathematical problem solving\u201d, which in turn demands specially designed chips.<\/p>\n\n\n\n \u201cSometimes in the past, if you tried to do encryption on your PC hard drive, it would take a lot of computational resources and slow down the applications running on it. But we\u2019ve designed multiple acceleration technologies that mean encryption is no burden\u2014no performance degradation,\u201d he continues.<\/p>\n\n\n\n \u201cWe also created Confidential Computing; an enclave in the computer platform designed for processing secrets that no one can tamper with. Use of this enclave to secure encryption keys is part of the Zero Trust reference architecture we established.\u201d<\/p>\n\n\n\n The Arqit-Intel combination is proven to utilise these capabilities to achieve post-quantum computing and Zero Trust without compromising on performance, while supporting networks that can scale rapidly at the edge and in the cloud, adds Arqit\u2019s Burn. And with the Intel NetSec Accelerator Reference Design, it can fit a smart PCIe \u201cserver on a card\u201d on to existing server infrastructure\u2014meaning legacy hardware can be upgraded at less time and low cost.<\/p>\n\n\n\n <\/p>\n\n\n\n All of these capabilities have been subject to the highest scrutiny, conforming to industry standards from NIST (SP 800-71), CNSA (Suite 2.0), FIPS (140-2) and many more, for extra assurance and interoperability. The Arqit SKA-Platform is also \u201ccrypto agile\u201d\u2014meaning the underlying cryptographic primitives can simply be upgraded or replaced as standards (and threats) evolve.<\/p>\n\n\n\n \u201cFor us it’s about deploying software that runs on Intel in lots of ubiquitously different places. We’re very lightweight, so we don’t interfere with how the hardware works, and we slot into existing protocols that are already supported in lots of different form factors,\u201d Burn explains.<\/p>\n\n\n\n \u201cWe\u2019re all about encouraging a phased approach to Zero Trust: a step-by-step mindset rather than a rip and replace approach.\u201d<\/p>\n\n\n\n Intel\u2019s Koyama agrees.<\/p>\n\n\n\n \u201cZero Trust is not just about deploying SASE or another application and you\u2019re done,\u201d he concludes. \u201cTransitioning from the old castle-and-moat model to a Zero Trust framework takes many years. There will be no 100% Zero Trust moment; it\u2019s a continuous journey.\u201d<\/p>\n\n\n\n The journey starts here.<\/p>\n","protected":false},"excerpt":{"rendered":"Why it matters<\/h2>\n\n\n\n
The problem with traditional solutions<\/h2>\n\n\n\n
Zero Trust plus quantum safety<\/h2>\n\n\n\n
The Intel difference<\/h2>\n\n\n\n
Getting started<\/h2>\n\n\n\n