Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using Identity-First Zero Trust to Stop Lateral Movement
Transcript
- Lucas: So there's a phrase I've been hearing a lot lately from CISOs — 'identity is the new perimeter.' And it sounds like a bumper sticker, but it actually maps to a real shift in how security teams are deploying zero trust. Luna: I've heard that too, but I always thought zero trust was about network segmentation and not trusting anything inside the perimeter. How does identity change that? Lucas: Great question. Traditional zero trust was network-centric — you put micro-segmentation in place so that even if an attacker gets inside, they can't move laterally. But the problem is, networks are getting blurry with cloud apps, SaaS, and remote workers. IP addresses aren't reliable anchors anymore. Luna: Right, because an attacker can spoof an IP or use a VPN. But a user's identity — that's harder to fake, at least in theory. Lucas: Exactly. So identity-first zero trust means you start with who the user is, what device they're on, and what context they're in — then you grant the minimum access needed, for the shortest time possible. It's sometimes called 'just-in-time access.' Luna: Give me a concrete example. What does that look like in practice? Lucas: Let me walk through a real case I heard from a CISO at a mid-size healthcare organization. They had about 3,000 employees, including remote clinicians who accessed patient records from home. They realized that if an attacker compromised a single nurse's laptop, they could potentially move laterally to the billing system or the research database. Luna: That's the classic lateral movement scenario. And healthcare is especially sensitive because of HIPAA and the value of medical records on the dark web. Lucas: Exactly. So what they did was implement an identity-first zero trust model using Azure AD Conditional Access and a third-party tool for just-in-time privilege elevation. Here's the key change: instead of giving every nurse access to the entire patient record system all day, they set up policies that grant access only when the nurse logs in from a trusted device and only for the specific patient they're scheduled to see. After the appointment, the access is automatically revoked. Luna: So even if a nurse's laptop gets compromised, the attacker can only see data for patients that nurse saw that day — and only during the appointment window. Lucas: Exactly. And they extended that to administrative staff and IT. No one has standing privileges. If you need to access the billing database, you request it, it's approved via a workflow, and it expires after 30 minutes. That kills lateral movement because the attacker can't just find a privileged account and use it whenever they want. Luna: But doesn't that create friction? Nurses are busy — they don't want to request access every time they see a new patient. Lucas: That's the trade-off, and it's why adoption hasn't been universal. But the healthcare organization I mentioned used a combination of role-based access and just-in-time for sensitive data. So for routine tasks, they still have some baseline access — but anything high-risk requires a temporary elevation. They also used analytics to learn patterns: if a nurse always accesses the same set of patients, the system can pre-provision access. Luna: So it's not all-or-nothing. You can tier the sensitivity. Lucas: Right. And the results were significant. Within six months, they saw a 70 percent reduction in the number of credentials that had any kind of admin-level access. And when they did a red-team exercise, the simulated attacker couldn't move laterally beyond the initial compromised device because every other system required a separate authentication step that the attacker didn't have. Luna: That's a strong outcome. But I imagine the hardest part is the cultural shift — getting employees to accept that they can't just have full access all the time. Lucas: Absolutely. And that's actually where I want to pause, because this is the kind of deep, practical conversation that this show is built for. If these conversations are useful for what you're building or running, there's a small way you can help keep the show ad-free. If today's episode was worth a coffee to you, you can find us at buy me a coffee dot com slash fexingo. No pressure — just a genuine thank you for being part of this community. Luna: Yeah, honestly, this is the kind of detail we dig into every week, and listener support directly lets us keep doing it without sponsors. So if it's helpful, that link is buy me a coffee dot com slash fexingo. Lucas: So back to the cultural shift. How do you get buy-in from a busy nurse or an engineer who doesn't want to re-authenticate? The CISO I spoke with said the key was to start with a small, high-risk group — IT admins — and then show the rest of the organization how much safer they were. Once the IT team accepted it, they became champions. Luna: So it's a bottom-up approach? Start with the most sensitive roles and let the success stories trickle down. Lucas: Exactly. And the technology has gotten better too. Modern identity platforms can do step-up authentication silently in the background — using device posture checks, geolocation, and behavioral biometrics — so the user doesn't even notice most of the time. Luna: Let's talk about the numbers. You mentioned 80 percent of breaches involve compromised credentials. Is that from a specific report? Lucas: Yeah, that's from the Verizon Data Breach Investigations Report, the 2025 edition. It's been hovering around 80 percent for years. And the trend is actually getting worse because of phishing as a service and ai generated social engineering. So identity-first zero trust directly addresses that root cause. Luna: So even if credentials are stolen, the attacker can't use them because they don't have the right device or context. Lucas: Exactly. And that's the core principle — never trust, always verify, and verify continuously. Not just at login, but throughout the session. If a user suddenly starts downloading thousands of records, the system can revoke access mid-session. Luna: What about the legacy systems that don't support modern authentication? Like an old on-premise application that only accepts a password. Lucas: That's a real challenge. Many organizations use a 'front-door' approach — they put a reverse proxy or a VPN in front of that legacy app that handles the identity verification. The app still sees a password, but the proxy enforces MFA and device compliance. Microsoft has something called Application Proxy for Azure AD that does this. Luna: So you don't have to rip and replace. That makes it more feasible for enterprises with decades-old infrastructure. Lucas: Exactly. And that's why I think identity-first zero trust is going to become the dominant model. The network-centric approach assumed you could define a perimeter, but that perimeter has dissolved. Identity is the one constant — every user has one, every device has one, every workload has a service account. If you secure that, you secure the attack surface. Luna: It sounds like the biggest barrier isn't technology — it's policy and process. Figuring out who needs what access, and for how long. Lucas: That's exactly right. And there's a growing role for identity governance and administration tools — IGA — that automate that policy definition. Some of the major players are Saviynt, SailPoint, and Okta's lifecycle management. They help you map roles to access rights and enforce separation of duties. Luna: So if I'm a CISO listening, what's the first step? Do I need to buy new tools, or can I start with what I have? Lucas: Start with an identity audit. Find out how many service accounts have domain admin privileges that haven't been used in six months. That's usually a shocker. Then pick a high-value application — like your financial system or HR database — and implement just-in-time access for it. Prove it works, then expand. Luna: And measure the time to revoke access when someone leaves the company. That's a metric that often stuns boards. Lucas: Great point. One healthcare organization I know reduced their offboarding time from an average of four days to under two hours by automating identity deprovisioning. That directly reduces the risk of former employees retaining access. Luna: So the episode really boils down to: stop thinking about security in terms of networks and start thinking about it in terms of identities. And use technology to make that scalable without destroying productivity. Lucas: Exactly. And as ai driven attacks become more sophisticated, the credentials-as-first-line-of-defense model is going to fail. Identity-first zero trust with continuous verification is the most pragmatic path forward. I'd love to see more CISOs share their metrics on how this has reduced incident response times. Luna: Maybe we can revisit this in a few months and check on the latest adoption numbers. For now, I think the takeaway is clear: if you haven't started your identity-first journey, today's a good day to begin. Lucas: And that's a wrap for this episode. We'll be back next week with another deep dive into the cybersecurity business.