Abstract:
This technical retrospective details the three-year evolution and performance of ING’s "Zero Privilege Architecture" (ZPA) within its Container Hosting Platform (ICHP). The core thesis shifts security focus from perimeter defense to the total elimination of human access and over-provisioned credentials. By enforcing two primary principles—controlled process-driven changes and immutable, ephemeral components—the architecture removes natural persons from production environments. The presentation evaluates ZPA’s efficacy against significant industry events, including the 2024 CrowdStrike outage and various supply chain vulnerabilities, demonstrating how strict version pinning, short-lived tokens, and "deny-all" network policies mitigated risks that traditional patching cycles failed to address.
Zero Privilege Architecture: Operational Analysis and Threat Mitigation
0:49 Infrastructure Scale and Performance: The ING Container Hosting Platform (ICHP) reports 100% uptime and zero security breaches while serving a massive internal namespace-as-a-service ecosystem.
No Natural Persons: Eliminates human access during production runs to ensure consistent quality and reduce human error.
Principle of Controlled Process: All system changes must result from a documented, peer-reviewed pipeline (Desired State Pattern), preventing unilateral modifications.
Immutability and Ephemerality: Any component deviating from the desired state is automatically terminated and redeployed.
3:16 Philosophy of Reduction: Security is defined not by the addition of features, but by the removal of every possible credential. Perfection in architecture is reached when there is nothing left to take away.
4:12 Defense Mechanisms: The architecture eliminates privileged accounts to prevent lateral movement and utilizes "Policy as Code" for anomaly detection and Technical State Compliancy Monitoring (TSCM).
6:39 Mitigation of Ransomware and Over-Privileged Access: By setting mutating permissions (create, update, delete) to zero for all users, including admins, the platform neutralizes the primary vector for ransomware which requires elevated user access.
8:15 Sanitation via Rapid Redeployment: To counter zero-day exploits (e.g., Citrix Bleed), the system enforces a 0-30 day image age. Regular, automated redeployments act as a continuous sanitization process, surpassing the speed of traditional patching cycles.
9:58 Defense Against Faulty Updates (CrowdStrike Case): Protection against systemic failures from third-party software is achieved by pinning all software versions and disabling upstream automated triggers. This ensures the platform state only changes when internally authorized via GitHub-style workflows.
12:03 Token Management and Anomaly Detection: The system prohibits long-lived tokens, utilizing only short-lived credentials. Anomaly detection engines are continuously updated to identify and block new attack vectors in real-time.
14:34 Supply Chain Security: All images are restricted to a single entry point—the secured pipeline—where images are scanned for vulnerabilities. Outbound traffic is restricted via egress filtering and domain-specific allow-lists.
18:01 Infrastructure Hardening (n8n/Webhooks): Mitigation of misconfigured software is handled through three pillars: strict Security Context Constraints (SCC) to prevent high-privilege pods, default "deny-all" network policies, and manual firewall validation for all on-premise egress.
20:05 Addressing the "Nodes Proxy" Vulnerability: Despite a lack of a formal CVE, the platform mitigates this risk by disallowing "node get" permissions for all users and implementing Admin Network Policies that block access to the vulnerable Kubelet API ports.
3. Target Audience Review
Target Review Group:CISO (Chief Information Security Officer) Council and DevSecOps Steering Committees.
This group is best suited to review this material because they are responsible for balancing high-availability requirements (100% uptime) with extreme risk mitigation in regulated financial environments. The ZPA model provides a blueprint for moving away from "reactive patching" toward "structural immunity."
Executive Summary for CISO/Steering Committees:
The Zero Privilege Architecture (ZPA) represents a transition from traditional identity and access management to a state of "Zero Human Intervention" in production. Over a three-year period, this model successfully insulated the organization from major global outages and zero-day exploits by treating all infrastructure as ephemeral and immutable. Key takeaways for leadership include the mandatory elimination of standing administrative privileges, the enforcement of "deny-all" network postures by default, and the replacement of manual emergency patching with high-frequency automated redeployment cycles. This approach effectively shifts the security burden from human vigilance to architectural intent.