SYNERGIA – Reducing the Configuration Management Attack Surface

SYNERGIA is an Innovate UK funded research project to improve security in distributed IoT systems.

A system’s configuration interface is a major part of its attack surface and needs to be protected against both external and internal threats. Complex, generalised interfaces shared by multiple users are hard to use, secure, and audit. Where configuration is controlled by multiple actors, including automated AI systems, with overlapping areas of responsibility each actor needs to be able to operate independently and be traceable through individual trust policies. Distributed IoT systems, which have components in untrusted locations outside of the data centre have additional vulnerabilities, and must be resilient as well as secure; able to recover easily to a safe state if compromised, and protected from configuration drift.

The Configured Things platform demonstrated a secure by design, zero trust approach to distributed configuration management.

In the Configured Things platform the traditional REST API is replaced with a declarative interface, where each iteration is a statement of a desired outcome. In contrast to other declarative systems, which merge multiple individual changes into a single declarative input from a trusted team, the Configured Things platform accepts many individual requests from different sources, which are then merged internally to derive the required state.

Each source has its own interface, constrained by both syntax and policy to align with its permitted role in the system. This mitigates much of the risk associated with accidental and malicious misconfiguration. All requests are treated as ephemeral, and can be updated or removed at any time, and the system will adjust accordingly. This eliminates the need and associated complexity for any concept of “undo”, and allows each source to treat the system as stateless.

Dealing only with declarative inputs allows for digital signatures to be used to implement a zero-trust approach. Each role has its own signature policy; multiple signatures can be required to mitigate lone

actor threats. Signatures avoid needing to trust the origin or transport of any request. While most systems enforce trust only at the edge, our platform can carry signatures throughout the system, supporting internal trust boundaries.

Trust policies can be changed at any time, and are applied retrospectively on all requests; Revoking trust is as if that source had never been trusted, delivering resilience far beyond that of a transactional system. Instead of exposing an inbound interface, requests are fetched from a role specific git repository, which removes a major aspect of the attack surface. Distributed components in untrusted locations fetch their request from the data centre, eliminating the risk of configuration drift and providing a resilient restart. Status is returned as asynchronous structured data, signed by the system form integrity and specialised to each role, to mitigate data leakage.

Configured Things is a Bristol based startup formed in 2018, spun out of Hewlett Packard Labs. We create products and solutions that address the challenges of managing systems and data across trust boundaries. We are alumni of the NCSC for Startups program, and retain a close working relationship with the NCSC and other government agencies.

If you would like to hear further about this work or our solutions generally, please contact: getconfigured@configuredthings.com