Good day and welcome to VMware's Tech Marketing session for November 30th 2021 in the new video
series that we've been tracking this month uh for the popper message within cybersecurity
today the journey to Zero Trust and again today we have in the virtual booth with us myself
Andrew Osborne of VMware Tech Marketing as well as my esteemed colleague from the Office CTO Dr
Dennis Moreau how you doing today oh it's a great day good and I hope you had a good thanksgiving
holiday I hope everyone else did as well and I did some time with family was much much needed
it always is and you feel like uh you just don't get enough you need the vacation from the vacation
too but uh hopefully uh we won't break our brains today but we'll continue on with our insightful
uh discussion point and this is our episode two in this four part series
and in this particular one we'll be covering some of our uh next evolution of the journey
and in that we're going to go over Zero Trust defined and its importance to the
industry we're going to go over the Zero Trust standards and the regulatory reasoning behind
Zero Trust its necessities and Zero Trust modeling and highlights that are helping guide uh this for
the industry along the way so um as we go over those highlights uh you know perhaps you know
we can look at this uh journey and I know that we dispelled a lot of those myths
and what it wasn't in the first uh episode and in this journey as we continue on I believe that you
know it's going to be important for that you know continued clarity and definition of Zero Trust so
now that we've dispelled in episode one that it's not a one size fits all it's not just data loss
prevention or least privilege and it's certainly not just a singular endpoint system or solution
being deployed on to those elements and it's not just an extension of the executive order within
the US spectrum maybe you can help us uh dive into that next topic here in the Zero Trust defines
it's moving rapidly so it is good for us to periodically dial in to the conversation
the requirements and the feedback we're getting from what's working and what's not
absolutely and maybe you can uh help us kind of go over some of the
different authorization points of interest around endpoints and assets yeah Zero Trust everything's
important um and that that is everything end to end so it's from the authorization of the
users the authorization of the service accounts the authorization of just about everything that
has an identity in the environment that can do something of import but it's also about the assets
the uh the devices their posture uh how they were provisioned and how they're both acting and what
their posture is currently there's this constant sense and zero trust of continuous verification
and then of course there is the behaviors of the system as a whole the interactions between APIs
the interactions uh in terms of the calls from the application down into the system uh
itself the underlying platform and all of that works together in a coherent way to tell you
whether your trust anchors that are that are embodied in the pillars um are being satisfied
do I know who I'm talking to is the device they're using have integrity is the application
trustworthy is the data from a provenance that I can deal with and is it classified appropriately
um all of that comes together in xero trust and realizing that level of protection
and I know that we've really kind of covered some of those uh initial steps also from not
just just dispelling the myths but also about you know how to begin tackling it and looking at what
you talk about those assets right and uh trying to discover what those uh crown jewels are and
then best how to create the appropriate measures you're talking about in the Zero Trust modeling
you know there's there's a lot of detail in it and it's a focus at a fairly fine level of
granularity you tend to focus on the uh container level of granularity and deciding how something
should behave how it is behaving and what to do when you you see the telemetry that you do from it
um the way to make sense of Zero Trust as always is to concentrate on that one thing that
fundamental assumption that the compromise has already occurred and so containment is getting
brought into the security picture uh as we haven't in any other previous
uh transformations in insecurity that we've gone through the evolution of security over time
and once that occurs once you get in your head that what you're really trying to do is contain
the unknown the anticipated the inside the supply chain mechanism you get off of a pure
protection mentality you begin to focus on granularity and resistance resilience
as a result of of your efforts and that's what really justifies all this work and it really
seems to harp back to your earlier point from the episode one about you know the presumption
of you know compromise from within and you know really trying to hone you know what you're trying
to protect in those you know uh capacities without you know compromising the usability of the systems
yeah and that protection's important but so is the the ability to get to the market for VMware
in particular in fact for anybody doing doing business being able to demonstrate
that you've made headway and have a viable plan for Zero Trust
becomes one of the gating mechanisms for being able to sell your technologies and services
be able to operate in the ecosystem that is increasingly intolerant of the problem that
we're facing that that seemingly endless stream of ransomware attacks and zero
in supply chain intrusions that have been giving us so much both disruption and problem
um and that is is just as much an importance uh as is the level of protection that we're providing
and maybe you can harp on just very quickly the uh that last bullet about uh you know Gartner
you know defining ZTNA or Zero Trust network access as being that predominant uh enforcement you're
talking about in the next couple years yeah the market movement has been uh pretty and
pretty high speed uh and sometimes chaotic uh in that everybody wants it done now yet
it's a big and hairy thing to approach and because of that there is this tension about
how do I move forward when there's a lot of work involved everybody's
looking for what gets me there the quickest gartner's estimate is it's going to be about
2024 so before we see 40 percent of all remote access gated by Zero Trust technologies um that's
a pretty pretty rapid growth for something so intrusive and that implies so much change
um at the same time we're seeing lots and lots of that work that needs to be done being
mandated by regulatory actions and uh standards efforts it is the critical mass the idea that
everybody's aiming toward a target where there's a common view of what success looks like as opposed
to everyone trying to secure independently where their finish lines might all look different yet
they all satisfy their own individual security requirements it is the security of the ecosystem
at the end of the day that is the aim of Zero Trust not the security of India and participants
in isolation if that makes sense well it's a great segue then when we jump to the next uh
major point here and we talk about those standards and regulatory and I know that's in
you know obviously my neck of the woods from the uh you know fertilization of all this so
maybe um you can cover some of the groundwork on those standards regulatory reasoning behind
the necessity for Zero Trust yeah the the discussion of Zero Trust of course started in
2007 and it's culminated um probably with the the largest single definition that has the most
consistent uh consumption population is there is the missed definition the special
publication 800-207 um which was out at the end of last year uh and distilled together an awful
lot of what had been discovered and learned uh and proposed about Zero Trust prior to that
point and in that distillation um we now have uh sort of a definition that's being picked up
not just domestically in the federal space but also by international interests the UK has the
NCSC Zero Trust architectural guidelines which mirror almost perfectly the missed regulatory
assumptions behind what you need to do to facilitate Zero Trust almost the reference
architecture that's included in the definitional document the EU at the end of October voted in
the uh um NIS2 initiative in full force uh and delegated to ENISA to pursue one of their top um
security mandates which of course was Zero Trust understanding where it fits into their
overall scheme of things there's lots of inter standards agency work going on at the IETF and
of course we see with ASD and ACSC in Australia a market that's moving towards Zero Trust probably
faster than the regulatory agencies and the standards groups can make sense of it so a little
bit of chaos but an awful lot of momentum uh and that that that is sort of the case with all
all levels of change that are this dramatic if that makes sense no and I can see where the
importance of being able to have and you hate to say the word standardization of standardization
you know is important right because out those fundamentals the pillars the elements the
foundational elements of all these organizations and you know foundation groups you know being
able to agree on a certain set of those that it's going to be continually a moving target
it is already anyway and you know with the advent of you know the change in the
you know perimeter to no perimeter I think it's really important that uh these groups are
you know coexisting with one another and you know facilitating a handshake of all this type
of information exchanges that's exactly right at the end of the day we're an ecosystem that has
um businesses talking to each other and systems talking to each other globally
and in that uh we need to be in agreement about the vocabulary we're using when we're talking
about security in order to get the level of trust that we need in an order to sustain it
so that's exactly why the standardization is such a critical part of bringing security and trust to
the overall ecosystem very good well so maybe we ought to take the next point then because it
seems to lead into that so let's go over some of the zero trust modeling you know taking the
foundations of what it is and the regulatory and framework compliance requirements and then how is
Zero Trust modeled for the industry and the end users who are deploying it yeah you know Zero
Trust has that perspective uh that was that was evoked in the original five pillars conception
of the idea that you needed trust in the device you needed trust in the users you needed trust in
the session that was going on in the application and of course the classification and provenance
of the data that that's being involved but in that there's a caveat that those five pillars are like
mom and apple pie everybody wants to do them but Zero Trust is a very opinionated way of consuming
the values of those five pillars they have to work together because you're trying to get Zero Trust
as an enhancement of the security of the system not of the asset in isolation and in doing so you
wind up having these pillars being considered in concert in fact in many ways the pillars wind up
reinforcing each other um the investments in the pillars also have to be co-aligned
because I'm saying things like authentication and authorization and that only really happens if my
device can be trusted and the things that are in my device like second factor of authentication uh
can be relied on so the integrity of the device is an integral part and parcel uh component of that
you can't perceive the pillars and therefore the basis of Zero Trust uh in complete isolation the
the investments the technologies the telemetry have to be integrable and they have to work
together and in that is the challenge in that we have ecosystems where the products and the
technologies have evolved relatively independently and that is the most fundamental of the changes
that it begins to occur um with the Zero Trust mandates and finally each of these is life cycled
when when you authorize and you provide your password that's great I know you are at that point
in time and after that all sorts of things can and do happen and so this continuous verification
whether it's continuous over time making sure I understand that you still are who you are
and your location is still consistent with a viable human being on the planet and not
hop it all over the globe looking like the the uh the authority you have has been stolen as
being leveraged the device you have was not only solid at provisioning time but it stayed that way
even in the face of emergent threats and all sorts of usages it is that continuous verification of
the assumptions behind the policy uh assertions that you make that is such a characteristic um
of Zero Trust and so transformative um in that we get a good sense of where it's headed
and I see you know and hear these different you know uh topics coming up like the death
of VPN and you know in and understandably those who have actually implemented them use them on
a daily basis can see where they fundamentally have not been designed to provide for that type
of resiliency and you know the continuous authentication continuous monitoring um you
know and I can foresee that there's going to be some challenges to overcome and
the implementation of this you know and from just a large investment that companies and people
have made into these yeah but every challenge is also an opportunity right and so that's the game
and nobody's suggesting this all happens has to happen tomorrow um there's a lot of work between
between here and there and in all of that work is a great opportunity for the company absolutely
well I can't uh say enough that uh with this guidance and with these discussions is going to be
uh a continued uh need for more discussion and more review uh as we go along because I know that
uh there's going to be you know foundationally uh probably one of the largest shifts in you
know at least in my lifetime that i have seen in uh in a way in which you would implement uh
your you know good services solutions and securing them uh that uh and probably uh many would see
in their uh near term as well uh although I think uh we can all agree for the benefit of
of all of uh both public and private sector and uh globally so I couldn't agree more
the opportunity to both make things better and to be of value to our customers and our prospects
couldn't be bigger absolutely well again uh Dennis I'd love to thank you for coming on for these
sessions with me and like to remind everyone out there that this will be a follow along there will
be three and fourth sessions uh post uh coming here before the holiday break uh in the new year
so I hope that you can uh enjoy uh both the previous episode and these future episodes and
this topic is on point and relevant and timely for you all please uh feel free to reach out to us our
contact information is there and to follow along with the third and fourth sessions as they come
and uh to uh look at Tech Zone uh on vmware.com and all the other wealth of resources available
to you out there thanks again Dennis appreciate it thank you Andrew have a great one you too