This article is based on a piece originally published on cloudcomputing-news.net (May 2020). It includes perspectives from Centrify Chief Strategy Officer David McNeely and references NIST Special Publication 800-207 on Zero Trust Architecture.
The Limits of Human-Centric Cybersecurity
Perimeter-based security has long been the dominant model for defending IT infrastructure: build a strong wall of firewalls, VPNs, and VLANs, and trust everything inside it. That model is breaking down. Social engineering, phishing campaigns, and advanced persistent threat (APT) groups are increasingly successful at exploiting the weakest point in any security system — human judgment.
The COVID-19 pandemic illustrated this risk at scale. As organisations scrambled to enable remote work almost overnight, cybercriminal groups moved quickly to exploit the confusion. The disruption was significant enough that the United States Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC) issued a joint alert warning organisations of malicious actors exploiting pandemic-related uncertainty.
The lesson is clear: defenders cannot rely solely on humans to detect, respond to, and contain every threat in real time. Infrastructure must increasingly be capable of protecting itself.
Cyber as a Domain of Warfare
During his keynote at the 2017 Institute for Critical Infrastructure Technology (ICIT) Winter Summit, General Michael Hayden — former Director of both the NSA and CIA — described cyberspace as an entirely new domain of warfare alongside land, sea, air, and space. He argued that cyber threats should be treated with the same seriousness as invading armies, and that the private sector must take primary responsibility for securing the cyber domain rather than waiting for government action.
“We will have to rely on ourselves and the private sector in a way that we have not relied on ourselves for security.”
— General Michael Hayden, ICIT Winter Summit 2017
That call to action has only grown more urgent. The pace of attacks, their sophistication, and the scale of potential impact on critical infrastructure demand that technology itself take on a more active defensive role.
What “Machines Protecting Themselves” Actually Means
The concept of self-defending machines is not about artificial intelligence autonomously declaring war on attackers. It refers to architectures in which each individual system — server, endpoint, or workload — actively participates in its own defence rather than depending entirely on network-level controls.
David McNeely, Chief Strategy Officer at Centrify, described one practical implementation of this model. The approach embeds a client directly into the operating system that acts as an intermediary, establishing a verified, trusted identity for every machine on the network. That client is then responsible for:
- Authenticating every login attempt and resource request against an authoritative identity service such as Active Directory (AD)
- Enforcing multi-factor authentication (MFA) policies to guard against bots, compromised credentials, or spoofed identities
- Determining whether a login session should be audited and recorded based on defined policy conditions
- Enforcing least-privilege access by granting only the specific privileges each user requires, for only as long as necessary
In McNeely’s words: “The computer account and trust relationship is what enables strong authentication of user login requests. Self-defending machines address the paradigm shift occurring in cybersecurity today where protection cannot be enforced at the network boundary.”
From Network Trust to Zero Trust
Traditional network security assumed that anything inside the corporate perimeter was safe. Administrators defined trusted zones using VLANs, firewalls, and VPNs. Inside those zones, machines were largely trusted by default.
Zero Trust inverts that assumption entirely. No network, device, or user is trusted by default — not even those already inside the perimeter. Every access request must be authenticated, authorised, and validated, regardless of where it originates.
Self-defending machines are a practical implementation of this principle. Rather than relying on the network boundary to determine what is trustworthy, each machine enforces policy locally. It checks identity, validates context, applies MFA, enforces privilege limits, and logs the session — all without depending on whether the network perimeter is intact.
This matters most in distributed environments: multi-cloud deployments, hybrid on-premises and cloud infrastructure, remote workforces, and edge computing. In all of these scenarios, there is no clean perimeter to defend. The machine itself must carry its own armour.
NIST SP 800-207: The Zero Trust Architecture Standard
The National Institute of Standards and Technology (NIST) has formalised the principles of Zero Trust in Special Publication 800-207, Zero Trust Architecture. This document defines a set of tenets and architectural approaches that organisations can use as a framework when designing or evaluating their security posture.
Key tenets from NIST SP 800-207 relevant to self-defending machine architectures include:
- All data sources and computing services are considered resources. Security controls apply to all assets, not just those on a defined internal network.
- All communication is secured regardless of network location. Being on an internal network does not confer implicit trust.
- Access to individual enterprise resources is granted on a per-session basis. Trust is re-evaluated for each access request.
- Access is determined by dynamic policy. Decisions incorporate identity, device health, and behavioural context.
- The enterprise monitors and measures the integrity and security posture of all assets. Continuous monitoring replaces point-in-time validation.
The standard also reinforces the principle that defences should be as close to the protected asset as possible. In a wartime analogy, soldiers carry body armour rather than relying solely on fortress walls. In cybersecurity terms, that means each server and endpoint must be equipped to enforce its own access policies, not delegate all enforcement to a distant network perimeter.
NIST SP 800-207 is a public document available on the NIST website at no cost and without registration.
Identity-Centric Architecture in Practice
Centrify’s approach, as described by McNeely, centres on identity as the primary control plane. Instead of trusting the network to decide who gets access to what, every machine actively verifies identity before granting access. Policy is defined centrally — in Active Directory or a cloud-based Privileged Access Service — and enforced locally by the client embedded in each system.
This identity-centric model delivers several practical security improvements:
- Consistent enforcement across environments: Policies apply whether the machine is in a corporate data centre, a public cloud, or a co-location facility.
- Reduced blast radius: If one machine is compromised, it cannot automatically be used to access others, because lateral movement still requires authenticating against the identity service.
- Auditability: Every privileged session can be captured and reviewed, providing forensic evidence and supporting compliance requirements.
- Least privilege by default: Users and service accounts receive only the access they need, automatically expiring elevated rights when they are no longer required.
Practical Takeaways for DevOps and Platform Engineering Teams
For teams managing infrastructure at scale, the shift toward self-defending machines has concrete implications:
- Treat identity as infrastructure. Privileged Access Management (PAM) and identity verification should be built into your infrastructure-as-code pipelines, not bolted on after deployment.
- Eliminate implicit trust between services. Service-to-service communication should be authenticated and authorised explicitly, using short-lived credentials or mutual TLS, not network segment membership.
- Enforce MFA at the machine level. MFA should protect not just human logins but also administrative access to servers and cloud workloads.
- Automate privilege expiry. Just-in-time (JIT) access grants elevated permissions for a defined window and revokes them automatically, reducing the window of opportunity for attackers.
- Audit everything privileged. Session recording and command logging for privileged access provides both security monitoring capability and audit trail for compliance.
Conclusion
The perimeter is gone. Distributed infrastructure, remote workforces, and sophisticated adversaries have made network-boundary security an insufficient foundation for modern cybersecurity programmes. The response is not simply to add more network controls — it is to push security enforcement down to the asset level, so that every machine is capable of authenticating, authorising, auditing, and defending access to itself.
NIST SP 800-207 provides the architectural framework. Identity-centric platforms that embed policy enforcement directly into operating system clients provide one practical implementation path. The underlying principle — that in an era of distributed, cloud-native infrastructure, every machine must carry its own defences — is sound and increasingly non-negotiable for organisations serious about security.
As General Hayden argued in 2017, and as subsequent years have confirmed: private organisations cannot wait for external forces to secure the cyber domain. The technology to make machines self-defending exists. The standard to guide implementation is published. The question is how quickly teams can adopt and operationalise both.