Hi everybody, welcome back to salted hash. My name is Steve Regan. I'm joined by Wendy Nathan. We're gonna talk about zero trust
Do you trust us will we trust you and I'm trusting that you'll be right back?
Welcome back as I said, my name is Steve Reagan senior staff writer at CSO online and this is salted hash all this week
I'm at the RSA Conference in San Francisco. This is
Well, I'm gonna be honest. I forgot what day this is. I think I said that earlier in another video, too
And in fact, it's I've just been going nonstop, but windy here Wendy
Nathan has just gotten done giving a talk about zero trust now
I'm gonna trust you to tell me about zero trust, you know, you really shouldn't
All right. Well this videos starting off quite well, so I'm gonna hope that I can deny
I'm just kidding. Tell me what it is. It seems like this kind of the
Concept of zero Trust has been around for a while, but the terminology and the hype behind and people talking
It's only here been recently. So
Give me your take on it. What does it mean for an organization?
And how do they know if they're actually ready for that kind of a model?
well, first of all, let's go back to about 2003 ish when the Jericho forum a bunch of
Financial services CISOs and who got together in the UK?
started talking about the fact that we really should not trust anything just because it's inside the perimeter and
so they
proposed a collaboration type architecture
And I remember at the time as a Cecil, you know reading about that and going well, that sounds great
But how in the world would you do that?
in around
2009 John Kendrew vog when he was an analyst at Forrester coined the term zero trust and
Started talking about how you might implement that and you know
According to his model within the enterprise and about six or seven years later
Google had figured out how to implement this model inside of their
Organization and they started issuing white papers and doing talks about how they implemented it and they called their model beyond Corp
so especially when Google sat up and said this is how we did it people started thinking maybe this is within reach of
our organization as well and
It's just gathered steamed from there. And so now you'll hear alternatively zero trust you might hear a little
software-defined perimeter sprinkled in there you will hear beyond Corp and
all sorts of other different ways of describing the same thing which again is
Don't trust something just because it's inside of your classic network perimeter
But what that actually means and how you implement it is all over the map and at RSA
We are seeing a lot of companies that are you know
Using these terms so you might even say that zero trust is the new cloud
Because everybody's going to be arguing about oh, that's not real cloud. Yes, that's real cloud. That's not zero trust. Yes
That's a zero trust printer. No, it's not
So I think we're gonna see a lot more confusion before we see things really I'm imagining
We're imagining someone behind the booth talking about. I have a zero trust printer and a zero trust kitten
Do you want to see the zero trust kidney?
So when it when it comes to me and you actually hit on a point on one of the razors in fact that when you
Walk the halls and you see some of the vendors on the floor
They're talking about zero trust as if they've had it all along when in reality
I don't think it's it that they've had it all along
I think they've had small components here and there but the actual bigger picture
What does an organization need to do to really put themselves into the mindset of you know?
Not trusting it just because it's on a network
How do they balance that out with actually using what's on the network inside the perimeter? Well, that's a really good question
I mean Google had their way of doing it and at duo
We worked out a way to put this within reach of even smaller
Organizations that are cloud-first now where it makes a lot of sense things are not inside their perimeter
They don't have one a lot of them don't have data centers
So it may be possible for them to go straight to this sort of model
But how do you put it together yourself?
what components you know, does it take and
Again, you're going to see all different answers based on whether you believe that this should really be done at the application layer
or whether
You want a more network centric model?
That's a good question because more security is always better right
I think the idea here is not to get rid of the firewall not to get rid of the perimeter
perimeter
just start raising the security of the inside of your network until it looks more like the outside and be more consistent in how you
authenticate users
how you make authorization and access decisions based on what you know about the devices they're using right now and
A lot of other things including including, you know, user behavior and things like that
I was just leading a peer-to-peer session where I was gathering that input from people what they believed was necessary
to build a zero trust model, so
Obviously without naming names or giving too much away from the session what were some of the concerns that they were expressing or talking about?
well part of it again is that it's not always clear where you start and
That's one thing that I did ask them in the session, you know
For those of you who believe you are already doing this sort of model. Where did you start?
And what would you recommend? And the first thing is generally?
Consistent authentication of the users so both inside and outside. So they say if you're not already federating identity and authentication
You should start doing that
Of course
we would say add multi-factor authentication to that make sure you're really sure which
Users are accessing your application. So that's step one
the next thing that a lot of them were very excited about is the idea of
Knowing what devices are accessing the applications you can have what you think is a BYOD policy, but are you sure?
How are you enforcing it?
and in fact
There are a lot of customers who start down this road and they find that they thought they were forbidding
Personal own devices from accessing applications, but when they got down to it and looked they saw that they were you know
Two or three times the number of devices accessing their applications
So if you can start controlling that you're already reducing your attack surface from what it was before
That's excellent. So I guess to
Kind of wrap this up when it when it comes to considering this model. What are your
first thoughts or advice you would give to someone who's who's basically been dumped into the pool out there and they've heard
Term all week long and they're going back and have to report. So what's your advice to them?
Just because they've been walking the floor and heard zero trust. Are they ready for it?
That's a good question. Some may not feel as though they're ready for it
Some may listen to the concepts and and look at the components and go
Oh, we're already doing half of this
for example
If you already have a reverse proxy in place and you're channeling all of your external
Traffic into your internal apps through there and you've got controls on that that's part of the way there
so I think the the
The takeaway that I would give to listeners is
Look at all the different descriptions of it figure out what it means to them
but always go back to the very basic premise which is
treat all of your users and their device is consistently regardless of where they are and regardless of where the
Application is if you want to learn more about Xero trust check us out at CSL
online.com or begin following this topic quite heavily over the next couple months and
Of course duo has some thoughts on this where can they find information?
Yes at duo comm
Just start right there and you can learn a lot about our vision of this type of model
See the the look of momentary panic says she had no idea
I was gonna have her plug that stuff, but thanks for hanging out with us
This has been salted hash and we'll see you next time