In this video, the experts at Tech target
and ESG discuss the impact of XDR, SASE and zero
trust on cybersecurity. And for complete coverage
of RSA conference 2021 click the link above or in
the description below.
Rob Wright: Hello and welcome to this lightning round session
for RSA conference 2021 the impact of XDR, SASE
and zero trust on cybersecurity strategies. I'm
Rob Wright, security news director at Tech Target.
And I am joined by three lead analysts from
Enterprise Strategy Group, John Grady, Dave
Gruber, and John Oltsik. We're going to discuss
three technology areas that have become especially
pertinent for many organizations over the last
year. And since this is a lightning round session,
we're going to jump right into it. Okay, guys,
first question, zero trust, it touches on a lot of
areas that can be implemented in many different
ways. So how best do we describe zero trust in,
say, 30 seconds? John Grady why dont you start us
off?
John Grady: I dont know If there's any way to do that, Rob.
Really quickly, It's about you know, we know
inherently not trusting anything on the network,
but providing more conditional access, constantly
evaluating security posture of the devices and
entities that are making connections on the
network. taking more of a risk based approach.
Everyone understands this takes a large number of
tools to implement, but you have to think about it
as a strategy, and really take a use case specific
mode of getting there overtime.
And John Oltsik, why don't you give your
perspective on it?
Well, there's not much to add to what john said.
It's it's a, but it is a paradigm shift. So we
used to trust everything inside the network and
not trust everything outside the network. And now
we don't want to trust anything. So it's a
journey, we have to get there through a phased
implementation, and we have to coordinate with the
business. So it's a strategic imperative, not any
kind of technology project.
Dave, the shift to remote work over the last year
seemed like the perfect time to have a maybe a
coming out party for zero trust implementation.
But as that happened, has it impacted the
strategies and the implementation plans for zero
trust.
Yeah, so certainly, the remote worker has been a
forcing function for this whole idea. The idea is
not new. But but it's one with the remote worker
has really made this a dramatic need. Now. The
challenge, however, is it's not a flip the switch,
it's not a single solution. effort. Good news is
lots of organizations are committed, we see
strategies in place, we see a ton of support from
individual vendors along the way. So we're making
some progress.
Is it difficult to implement? Because I know that
there's a lot of moving parts here? Does it seem
maybe simple on the surface, but just takes a
little bit more effort and a little bit more
understanding of what you're doing with identity
access management, so on and so forth? Anyone can
answer.
I'll jump in there. Yeah, it is hard. There's no
question but i think you know, you have to take a
longer term view. as John Oltsik said, 77% of the
organizations we've surveyed, have seen both
security and business benefits and may take some
time to get there. I think you have to go in eyes
wide open and understand that it will take time,
but there's absolutely kind of positive light at
the end of the tunnel.
Okay, let's turn to XDR extended detection and
response. There are different perspectives and
definitions for XDR. But how would you define it
and maybe compare it to say, an area like
traditional threat detection and response? That's
an area I'm a little bit more familiar with, but
there are a lot of perspectives out there about
what XDR is and isn't Dave, why don't you start us
off?
Yeah, sure. So at ESG we are taking a fairly broad
view of XDR. XDR is an integrated suite of
security products, it spans IT infrastructures.
It's designed to interoperate and coordinate on
threat prevention, detection and response, and
that it integrates different control points,
telemetry, analytics and operations into a one
broad enterprise system to power the security
operation center.
John Oltsik, is there confusion about this term
compared to regular threat detection and response
amongst customers that are looking to invest in?
Yes, there is a ton of confusion. It's a new term.
But what we're seeing is that customers are where
you think they are. They're doing research on the
products, they're talking to people like Dave and
I, they're calling in their vendors to get a
roadmap perspective. So there's an acute need for
new threat detection and response tools. So
there's a market opportunity there. But at the
same time, confusion doesn't do anyone any good.
So we're advising our clients to do much more
market education. And we're advising end users to
really take a long, slow and strategic approach to
XDR.
There's a lot of hype about this term, though.
What is the best way for, let's say a large
enterprise to approach this emerging category? Is
this something that they should be looking at
should there? Should they be cautious about
investing in it?
First of all, no caution, not for sure that
there's a real need here. So we need to do
something about it. There's some different
approaches to XDR. So it sort of depends a bit on
what your investment in your security operations.
environment is. There's sort of three categories
of XDR that John and I've been talking about. From
a solution standpoint, first, a call it a full
stack XDR solution where the primary security
controls and the analytics and the detection
response is all provided from the single vendor in
an integrated environment. This is really the most
turnkey approach to thinking about detection and
response in the organization. The second is what
we're calling overlay, XDR. This is basically an
analytics based approach that sits on top of your
existing security controls. These are solutions
that are heavily machine learning driven. They
often have cloud delivered data stores, big data
lakes, and it can take inputs from all the
different security controls in the organization.
And it focuses on stitching all that data
together, correlating, aggregating and then doing
the detection response functions, that's a little
easier to approach for a lot of organizations who
are heavily invested in their own infrastructure
already. And then the third category is the
endpoint and EDR vendors who are expanding their
offerings to XDR, many have built big analytics
engines on top of it. Some have invested in other
controls, but most have a partnership approach,
where the EDR technology plugs into a number of
other security control technologies swing that to
get that data together in an analytics platform.
So those are the sort of three different types of
XDR solutions in the marketplace and which one is
right for you. It depends a bit on what your prior
investments strategies have been, and what kinds
of relationships you have with other vendors.
Let's turn to our last category. Last but not
least, SASE secure access service edge. What is
SASE? And how does it maybe touch on or overlap or
connect to zero trust?
SASE is essentially the convergence of network
security and edge perimeter security tools. And SD
LAN ln more of a cloud delivered microservices
based model. That's kind of the core definition.
And the reality is that we're not all the way
there because that's that's a lot, right.
Traditional security tools haven't even gone fully
cloud delivered in a lot of cases, similar to zero
trust, it's a journey, I think the differences,
it's closer to a discrete solution, or product
architecture, whereas zero trust is really about
the how and setting the right policies taking a
different thought process to security and where
they really overlap as with zero trust network
access, which is the evolution of VPN and
incorporating that into a SASE framework or
architecture. So there's overlap, but they are
discrete. cybersecurity trends, for sure.
So because of that, are there different obstacles
or implementation challenges with SASE versus zero
trust because it's more solution oriented?
So there's, I think, two main obstacles that I
see. The first is cloud. And we found that most
organizations still have the majority of their
network security tools and an on premises
appliance based approach, they have to transition
those to the cloud. The second is organizational
dynamics. You're talking about the security team
and the networking team having to come together to
source use, test, implement a converged solution,
but that's a big ask. And it's something that
companies need to start thinking about more before
they they go down the technology path. How are
these organizations or teams within the
organization working together? How are you
starting to think about measuring your security
team more on business outcomes and things that
maybe the network and IT team is more used to to
get them kind of rowing in the same direction?
Great. Well, guys, I think this lightning round is
officially out of time. Thank you so much for
joining me and for weighing in on these three
emerging technologies.