Edge series: Stop the fraying, maintaining security in edge-computing architectures
This is a guest post for the Computer Weekly Developer Network written by Aparna Rayasam, CEO, Atsign.
Atsign is known for its open source zero-trust protocol (atsign/atPlatform), a technology built to give users what the company calls “total data ownership” in a manner that works by securing end-to-end encrypted device and application communications without centralised storage, static IPs, or open ports.
Rayasam writes as follows…
Fully-managed edge computing sounds great in theory.
In practice, it breaks the moment a distributed node opens an inbound port to the Internet.
Just like any other open port, it creates a glaring point of weakness for attackers to exploit. While edge computing brings massive operational advantages, it forces us to completely rethink how we handle security.
A zero-trust network fabric
To secure the edge, we have to move away from heavy, centralised firewalls and adopt a zero-trust network fabric.
Zero trust itself isn’t a new concept. But when you push this defence mechanism downward – focusing entirely on how individual assets communicate – the dynamic changes.
Suddenly, you gain complete operational visibility, leave no footprint for attackers to scan and effectively shut down your external attack surface.
Here are the three strategies to make that happen.
Cryptographic identity mapping
Legacy security models fail at the edge because they still rely on shared API tokens or centralised credential stores. If an attacker breaches the central store, they have the keys to the entire kingdom.
A more resilient approach pushes the identity perimeter down to the individual process layer:
- Micro-segmented access: Every single entity is assigned its own unique, cryptographic identity. If a device or process isn’t explicitly authorised to connect, the connection simply cannot happen.
- Keys cut at the edge: These cryptographic keys must be generated directly on the edge, not stored in a central database. By eliminating the central authentication server, you eliminate the target. This also ensures that static tokens never end up exposed in source code or CI pipelines.
Map the network
In full, this means mapping the network with structural blueprints.
Rayasam: The old network perimeter is gone – to stop the edge from fraying, we have to secure it from the inside out.
You can’t secure what you can’t see. To run a secure edge network, you need a strict, visual blueprint of how your systems interact.
This means mapping out every single micro-service interface, model endpoint and database connection. By treating them as discrete nodes behind end-to-end encrypted tunnels, you can use typed permission rules to dictate exactly who is allowed to talk to whom. If a node attempts an unusual connection, the system blocks it instantly, preventing lateral movement across your network.
Eliminate the attack surface
In full, this means eliminating the attack surface so that “no open ports” exist.
We’ve been conditioned to think we need intrusive monitoring tools and massive firewalls to keep things secure. The irony is that these tools introduce their own complexity – and often create fresh entry points for hackers.
You can bypass this entire headache by enforcing a strict “no open ports” policy.
Instead of leaving inbound listening ports wide open to the public internet, endpoints should establish outbound-only connections using peer-to-peer cryptographic relays.
Because the traffic runs through a secure, sovereign messaging layer, your edge nodes remain completely invisible to the outside world. If an attacker can’t see a port, they can’t probe it.
The bottom line
Securing the edge shouldn’t mean constantly expanding your attack surface to accommodate new nodes. By shifting identity to the process layer, mapping your connections, and shutting down inbound ports entirely, you can build an edge architecture that defends itself.
The old network perimeter is gone. To stop the edge from fraying, we have to secure it from the inside out.