Searchable transcript of Securing AI Agents with Zero Trust — IBM Technology (13:33). Search for a phrase, then click its timestamp to jump straight to that moment in the video.
Captions sourced from the original video on YouTube, published by IBM Technology. The video, its captions and all related intellectual property remain the property of their respective owners; AINotes claims no ownership. Provided for research, accessibility and search — see the Transcript Notice and Copyright Policy.
00:00 We've entered the age of agentic AI, systems that don't just think, but they also act. Agents can talk to APIs. They can call tools. They can buy things. They can move data, even create sub-agents. But every new capability adds a new attack surface, yet another way the bad guys can get into our systems. So how do we protect this new ecosystem? We bring zero trust.
00:20 Never trust. Always verify. I know, I know, you've heard about zero trust before. Isn't that just a marketing slogan that all the vendors used and abuse in order to get us to buy whatever they had on the truck? Well, yes and no. Definitely the term got hijacked by overzealous sellers trying to meet their quotas. But I'm a cybersecurity architect, and I never got confused by all that noise because I knew there were some solid, even game-changing security principles worth holding on to.
00:54 And now that we have AI agents popping up everywhere, the time is right to dust off the hype and repurpose the good in zero trust in order to face the current security challenge. Okay, let's take a quick review of what zero trust principles are. What distinguishes zero trust from doing things in a non zero trust way? Well, one of the simple things that I mentioned previously is you verify and then you trust.
01:17 So you only trust something that has in fact been verified. Or trust follows verification is another way to think of it. Another thing is we get rid of the Just in Case principle, where we put things out in case we need them, and replace it with just in time. So we give the access rights that are needed only when they're needed, and not for longer than they're needed.
01:41 That's a preserving of the principle of least privilege, which says you have only the access rights that you need for only as long as you need them, and not longer. Another thing is we move from perimeter-based controls, where we're trying to basically put the hard crunchy outside and leave the soft, chewy center. That's not very good. In fact, what we want to move to is a more pervasive set of security controls.
02:05 So the security controls are throughout the system, not just around the outside. then what I think is the most important aspect, and it often gets overlooked in zero trust discussions, is the idea of the assumption of breach. You assume the bad guy is already in your system, already in your network, already in your database, in your application, already has elevated privileges from stolen credentials.
02:28 That's what we're going to operate from. Now design your security. So it's assuming that you've been breached already. And it's a very different model, a very different paradigm and way of thinking about security. So let's take a look and see what zero trust principles would look like if they were applied to an agentic environment. First of all, let's look at a traditional environment.
02:50 How do we apply zero trust in this case? Well, we've got users that have to be secured. They're part of the security equation. So I need to do identity and access management. I need to make sure that the user has an account that they're logged in, that the person logged in is in fact the user they claim to be. So that's strong authentication. Access controls, so that they can only access the things that they're permitted to see.
03:17 The device that the user is using matters as well. It could be compromised. I need to make sure that it is in fact pure, that it hasn't been jailbroken, that an attacker hasn't taken control of the system, because then it won't matter if I have the authentic user trying to do the right thing if the device has already been compromised. I need to look at the data layer of all of this.
03:40 So I need to make sure that the data that's sensitive has been encrypted so it can't be easily seen. I need to make sure that it's not leaving my network if it's not supposed to, things like that. And then another big part, and a lot of people start their zero trust discussions in this particular area. And it's the area of the network. So I'm going to make sure that my network is well secured, that if information is traversing a part and that information is sensitive, then I want to have it encrypted.
04:09 I want to make sure that I do things like micro-segmentation, where I group individual parts of the network together and give some level of isolation so that if this guy gets infected, his infection doesn't easily spread to others. So those are some of the things that we've done traditionally in zero trust and spreading this pervasively throughout the system.
04:26 I've got to do all of that as I move into the agentic world. Plus, I have to do some more. So as we start looking at agents, who are the actors? The actors are in fact software. So we've got an AI agent here that is using a non-human identity. So here we had users, and we could associate them with the identity they were using. But an agent may in fact use lots of these different NHIs, lots of different non-human identities.
04:58 So here we have a proliferation of these things growing. I need to make sure all of them have the same level of control and visibility that we had for the human users, in fact, maybe even more. Because they're operating autonomously and we need supervision of that. We need tools that we're going to be using to also be secure. We need to make sure that the tools that we're leveraging are tools we can trust.
05:28 Again, we have data. In this case, data may be the thing that was the basis for the AI agent. We use data to train the model. We need to also augment the model. We may use preference information and other context information that we put into the model I need to make sure all of that stuff has been secured, that it hasn't been tampered with. And then ultimately, I need to be able to look at the intentions of the agent and make sure those intentions match what the original users intentions were for this particular system.
05:58 Let's take a look at an agentic system and see where the threats might be. So here's how the thing basically works. We have a sensing portion. That is the thing that takes the input. It might be visual. It might be textual. It could be a lot of different things. But that feeds into the AI, which does the thinking. And then in that thinking, we will augment that with policies, preferences and other things like that.
06:20 So we'll have that information affecting the thought process, the reasoning process that's happening. And then ultimately, it takes those actions. So it could do an API call. It might write some data and move some data around. It might use a tool, it might spawn other agents. And then all of this is going to be driven by credentials. So we have Individual capabilities that each one of these things ought to be able to have.
06:50 So if I'm an attacker, I look at this thing and start to figure how might I break this thing? Well, one thing I could do right here is a direct prompt injection. I might send a prompt in that is going to break the context of this system and have it start doing things that it's not supposed to do so that's one of the things I could think about. Another is I could attack right here, and I could do something to manipulate to to mess up the policy, the preference information to poison that information or even poison the
07:18 model that was used to train this thing. So that's another one to look at. Another thing here is looking at all of these interfaces - What if I insert myself at any one of these? That would be a place where I could do some damage if on this and this might be, say, an MCP call, something along those lines. And I would be able to insert and take control of that.
07:43 I might also attack individuals of these services, these APIs, the data source, the tools, the agents. So all of those are an extension of the attack surface. And then right here, their credentials. Maybe I want to go in and attack those. Maybe I can copy those credentials. Maybe I can log into a system and create new accounts or increase my level of privilege.
08:08 So there's a lot of different moving parts in this system. An attacker has a wealth of different places that they could in fact dive into and do a lot of damage. So now, let's apply those zero trust principles to this AI agentic environment, and we'll see what we can do to eliminate some or all of these threats. So first of all we're going to start here with the credentials.
08:31 I mentioned this before. We want unique credentials for every agent, for every user and every agent that those agents create as well. So we need a place to store all of these non-human identities and keep all of them access controlled. Keep them so that they don't have more privilege than they're supposed to have. We want it to be just in time, not just in case.
08:55 In other words, we give the privilege just when it's needed, and then we take it away. We don't give it in advance and say, well, just in case, you might need this later. So we're going to do that. We're going to make sure that these systems also never include credentials buried into the system itself And that's been a temptation of programmers. They put a password, they put an API key, and they bet it and embed it directly into their code.
09:15 That is an absolute no-no. What we want instead is to store all of these in a vault where we have a dynamic system where I can go check credentials in and out. I can get new credentials created over time. I can enforce just in time. I can enforce role-based access control. I can do strong authentication. I can do all of those kinds of things that I'm needing to do in these cases.
09:41 So we're going to cover all of those bases. No static credentials. Everything is dynamic instead. And then we're going to move over to the tools themselves. So I need to make sure that these things have registered versions. So I'm going to have a tool registry where I have verified these are secure APIs that we can afford to use. The others have not been vetted.
10:07 These are a set of secure databases and data sources that we can use. These are a set of tools that we have vetted and we can trust. And all of these kinds of things, if we're going to be using those. It's basically, think about if you're making a cake or a soup, you want to make sure that the ingredients that go into it are pure. So we want to make sure that we're using the pure stuff to begin with.
10:29 Then, I need something that's going to give me some sort of inspection over the whole thing. So something that's going to be able to look over it all. Look here and see if there are improper inputs going into any of these tools that are coming out of the agent. Also, be able to look and check for these prompt injections that may be coming into the system.
10:52 We could use an AI firewall or an AI gateway, whichever term you prefer to do those sort of checks and block. So it will look and see is that something that should be allowed to go in? Do we have information leaking out of systems that shouldn't be? Are we making improper calls? This sort of thing. So it's an enforcement layer here as well. And then ultimately I need to be able to have traceability of all of this.
11:13 So I need a system where I'm logging immutable logs. means that they can't be changed. I don't want a bad guy to come in here and change the information that's in my log. I want to be able to prevent that. So when actions are occurring in the system, it needs to be able to be traceable. So we can go back later and understand why it did what it did. I also want to scan the entire environment.
11:43 Be able to look across all of these different things. And we've got different tools for different types of scanning. We've got network scanning tools. We've got endpoint scanning tools. We've got tools now that can scan AI models and look for vulnerabilities that may be latent and hiding inside of those. Ultimately, at the end of all this, we need still a human in the loop.
12:05 We need an ability to be able to have a kill switch. If someone sees this thing is running out of control, what it's doing is not right and we can go see what it's been doing. We want to put throttles in place in some cases so that if maybe it's a buying application, it doesn't just suddenly decide, hey, I like this, I'm going to buy a thousand of these in a minute.
12:22 Maybe we don't want it to do that. So we throttle back its activity. We have canary deployments where we sort of drop the canary in the coal mine to see what happens. So we're going to see if this system dropped into an environment is going to operate properly or not. A lot of different things you can see here. The agent systems are complex. The number of threats that we face are complex and numerous.
12:50 So our security defenses have to be up to the challenge. Agentic AI multiplies power and risk. Zero trust gives us the framework to keep that power contained. Every agent must prove who it is, justify what it wants and earn trust continuously. As we move forward with autonomous systems, zero trust principles deployed correctly serve as guardrails that keep innovation in alignment with our intent instead of the bad guys.