Latest / Identity at the Center / #92 - Zero Trust Network Architecture with Brian Deitch

Transcript

#92 - Zero Trust Network Architecture with Brian Deitch · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:27
center podcast I'm Jeff and that's Jim a gem.
0:30
Hey Jeff, how are you? Oh, not so bad yourself.
0:33
I'm doing good. Actually, I've been living in
0:35
PowerPoint he'll like non-stop for the past week or two and
0:41
more of that this week. But so long as you know, I've
0:46
realized that what I do when I build power points where I start
0:51
is like paper and pencil. You know, I kind of start with i
0:54
Like, during a presentation, you need to tell a story and you
0:59
should be able to tell that story without slides, right?
1:02
You should be able to conversationally.
1:04
Tell that story. So that's why I like to start
1:06
with paper and pencil. I know you kind of probably the
1:10
first time you met me. I was taking notes, in a meeting
1:13
with paper and pencil, and it's just some kind of an old-school
1:16
guy from that perspective, but I feel like if I sit down at a
1:20
computer and I start, you know, working out that that strategy
1:24
like what's the Problem today what are we recommending for the
1:27
future and things like that. Then I get to bound up in
1:30
formatting and how the slide is going to look versus focusing on
1:35
the message. Yeah I remember the first time I
1:38
looked at your notes and it was probably a diagram that you had
1:43
drawn out and so just you know draw it on a piece of paper and
1:46
send it to me and I'll figure out, you know, how we want to
1:48
kind of showed on the screen and we used to have scheduled time
1:52
where I would have to You Jim and decipher his handwriting is
1:58
what is this trying to say like, is that Sanskrit or some other
2:02
language? I'm not exactly sure.
2:03
You have, you definitely have doctors handwriting.
2:05
That is for sure. Yeah, I mean that's probably the
2:08
only perspective I qualified to be a doctor, but I definitely
2:12
have doctors handwriting. It's gotten better in that.
2:15
We've gone a little more digital and using, you know, tools like
2:18
Visio and lucidchart and stuff like that.
2:20
But it's kind of a combination between girl.
2:24
VT and just plain chicken, scratch chicken scratch with a
2:30
funky style. You know I think what we should
2:32
do is digitize some of your work and create some NF tees off of
2:36
it and then put it out there for people to collect us, you know,
2:40
collectors items like here is, you know, a drawing that Jim
2:44
made. You figure out what it says.
2:45
What does it mean to you? Or we could create a fun.
2:49
Yeah, Microsoft is replacing the Colibri or I'm not sure how you
2:54
say it. Tell it calibri 'calibri calibri
2:56
'calibri. Yeah.
2:58
So there are going to replace the default font, which is, I
3:01
guess kind of a big deal. Yeah, they probably will.
3:03
They probably would not replace it with my chicken scratch, I
3:07
hope not. But all right, now we're getting
3:09
a little bit of softer Side Track.
3:11
If you have a Windows PC and you have inking capabilities, you
3:16
can actually create a font based on your own handwriting.
3:20
It's built into Windows somewhere, Windows 10, and one
3:23
of those settings, Is you can actually go through a process
3:26
where you write out the alphabet numbers, you know, some things
3:29
like that and it will basically create a true type font for you
3:33
based on your own handwriting. So you could theoretically
3:37
create your own font, put that into a PowerPoint and then have
3:41
like a PowerPoint that looks like you actually wrote it out
3:44
by hand, which is So Meta. I don't even know where to go
3:47
with it. After that, it's kind of like,
3:49
like Comic Sans, but actually, I think that would be really fun
3:53
to do actually. It look into that and I did not
3:56
know. That's why people listen to the
3:58
podcast Jeff, as for the gems or some might say the doggie
4:02
diamonds. Yeah.
4:05
The you know the the solutions to problems that you don't have.
4:09
I think that's part of it as well.
4:10
Didn't know you had. All right.
4:14
Why don't we talk about some identity and access management
4:18
stuff since that's pretty much why we're here.
4:20
And what we do we're going to talk today about Zero.
4:25
Trust Network architecture also known as ztn a.
4:29
So as you hear us may be talking through that.
4:32
I know zero trust has been top of mind for a lot of folks
4:34
especially with the pandemic and people doing remote work.
4:37
And you know we talk with Eric Anderson from Adobe last week
4:40
about their approach to znz tiene and they're actually ahead
4:44
of the curve. They've been in this ztn a model
4:49
for a couple years so they were well prepared for a mass, you
4:53
know, work from home. EP unless environment, right?
4:56
Things like that right to make it more secure to access
4:58
resources. So to help us with the
5:00
conversation today. We've invited Brian D H, who is
5:03
a Solutions architect at Z scalar and an all-around good
5:06
guy to the show. So, welcome to the show.
5:08
Brian, what's up everyone? Thanks for having me and I would
5:11
tell you that the greatest lie, the Dever that I'm told that the
5:15
devil ever told was that he didn't create PowerPoint.
5:18
I feel that I feel that pain guys, I you know I I've learned
5:22
so much about PowerPoint having turned And to the dark side and
5:26
Consulting, you know, five, six years ago at this point, I use
5:29
it for way more than just presentations.
5:31
It's a simple. You know, flowchart thing.
5:34
It's basic Bare Bones image editing.
5:36
So you know, I have a love-hate relationship with it.
5:41
I just wish that the feature parity between Microsoft and Mac
5:46
OS was a lot closer because it is clearly a first-class citizen
5:50
on Windows devices, which, you know, you would I guess expect,
5:53
right from our Product to Microsoft Hardware, but I am
5:58
glad to see that the Mac OS versions catching up because I
6:00
do use. Both OS, has quite a bit and
6:03
it's always interesting going from one to another, but I
6:05
digress, as I get off, my PowerPoint, soapbox there.
6:10
Brian, this is your first time being on the show and one of the
6:13
things that we like to ask our guest is is to learn more about
6:16
their background and how they got into the infosec or the
6:19
identity space. Is that something that that you
6:22
chose or did you choose it? So, Oh, it's funny conversation.
6:26
So I started my journey back in the day at US Airways, which is
6:30
now American Airlines and I was a systems guy, supporting US
6:33
Airways.com and I quickly wanted to make sure that I solidified
6:38
my position and didn't ever be like, you know, part of a riff
6:42
or anything like that and I took responsibility over an F5.
6:48
Appliance at that point in time was used primarily for web
6:50
acceleration and load balancing. And it was kind of a funny thing
6:56
is, he's like this mixed bag of tricks where it was, it was a
6:59
layer for device was also later seven.
7:01
And I want to be part of the cool group with network security
7:04
guys and they didn't like me for some reason I couldn't get them
7:07
to accept me and lo and behold it turned out to be a good
7:10
thing. They want to nothing, they
7:12
wanted nothing to do with the device that can talk over.
7:15
Therefore they are seven. That was me in that kind of
7:18
opened the door to Pandora's boxes.
7:20
And then from there, I moved from there to Apollo Group which
7:23
is University of Phoenix. And they said, well, knowing
7:26
that 5 is great, but we need you to understand, you know, the
7:29
Cisco has say the checkpoint firewall snort IPS.
7:32
I mean, you name it, they own that particular product and oh
7:35
by the way you're going to be on call here in 30 days or less.
7:38
So you better wrap up quick. It's a little bit of a trial by
7:42
fire. It sounds like yeah, absolutely
7:45
Best Mistake I've ever had. What else do you work on when
7:48
you're not doing stuff for Z scale?
7:51
Or I know you've got a podcast called PEB kak, maybe you can
7:54
talk to us about that as a fellow identity, kind of related
7:57
podcaster. Yeah, right on, thanks for the,
8:01
the name drop on the area. Me a couple buddies from Z
8:03
scalar decided that, you know what, maybe kind of cool idea to
8:07
have her own podcast. And so pep kak actually stands
8:10
for the, the problem exists between the chair in the
8:14
keyboard, right? User are so many times, right?
8:17
We get involved, whether it was Network or security, where we
8:20
were, you know, we are the ones to be blamed and at the end of
8:23
the day, it's always the user. So we go over a lot of security
8:26
topics. Sometimes, we do like silly dad
8:28
jokes. Reviews and whatnot.
8:30
But we are going to be recording episode 7 today.
8:33
So we were quite a distance behind.
8:36
You guys gotta start somewhere. So Brian one of the things that
8:43
we like to do with the podcast, right?
8:44
It's called identity at the center, right?
8:46
A lot of the focus of our podcasts on identity and access
8:50
management, but we think it's, you know, becoming the, the
8:55
central tenant of information security strategies.
8:58
I mean, that's what we're seeing.
8:59
Seeing I think in a zero trust World it resonates very well but
9:04
we want to use this as a forum to introduce kind of the other
9:09
technologies that make up a full 0, trust information security
9:15
portfolio. So maybe what you could do is
9:18
kind of talk to us about what your, what your company's e
9:22
scalar does and where that fits into a zero, trust architecture.
9:26
Gotcha. So if you think about it, Z
9:29
scalar, Sí tiene their kind of synonymous and at the end of the
9:32
day what we want to do is Federated with identity, right?
9:35
Let them be the gatekeeper of the users who you know who they
9:38
are, what they do, what groups, they're a part of and take that
9:41
and apply that principle to users going out to the Internet.
9:44
So allow the good block the bed and then for users that need to
9:48
talk to internal applications where they reside at the Legacy
9:53
data center or in the private Cloud.
9:55
Allow them to interact with those applications based off an
9:58
identity. So how does does this actually
10:00
work? What's the user experience like?
10:02
Is it something that kind of sits behind and the user?
10:05
If it's if it's being done? Right, never actually sees or is
10:09
this something that is a little more up front and present to a
10:11
normal user, who would be accessing resources?
10:15
Yeah, we really want to make this as transparent to the end
10:18
user as possible. So from a user experience, if
10:21
they are sitting in a branch office and they close your
10:24
laptop lid, and they go home, or they go to Starbucks, they open
10:27
it up. It's like they're already
10:28
connected to the network, they do.
10:29
Have to do anything. They're not, then roll, they
10:32
don't have to re-authenticate things.
10:33
Now, you could if you wanted, but the, the premise between the
10:37
ztn a right, is that number one, we want to keep users off the
10:42
corporate Network. So you need to treat all
10:44
applications, like you would Office 365 and so you can't get
10:48
into Office 365. Unless we know the identity of
10:51
the user, right? You're not actually on the
10:53
Office 365 Network, we have access to it.
10:55
So even your internal applications to be treated like
10:57
that and then the second part, To this is we really want to
11:01
reduce your tax surface, meaning you can't hack, what you can't
11:05
see, you can't do DDOS, Brute Force, credential stuffing SQL
11:09
injection if there's no inbound access to your applications,
11:12
wherever they might reside in the last part is, if you're not
11:15
on the, the network you eat, there is no lateral movement.
11:19
And so really, the idea is the internet becomes the new network
11:24
being able to give the company true end-to-end privacy, right?
11:29
Beauty It's tunnels right. That way.
11:31
You don't have prying eyes, cannot see but at the same
11:35
breath, right? You know, what is that user
11:36
experience? It, they just connect to it and
11:38
they are good to go. Now, the best part I think of
11:41
doing this correctly would be a user going to Starbucks
11:45
historically on a, maybe a legacy VPN.
11:48
They might have to turn that off to interact with like a captive
11:51
portal been, but in a true, ztn a world, right?
11:55
I just want to allow them to transparently access.
11:57
That click the button that says Going to be a good little
12:00
internet Citizen and then boom. They are connected back to their
12:03
applications without having to attend a Kate, you know, kind of
12:06
in my mind to the place that ztn a fills as kind of a replacement
12:13
for the traditional VPN, maybe you could validate or re-educate
12:19
me on that. But is that the case?
12:22
And maybe you talk a little bit about the architecture because I
12:25
guess my understanding is that, you know, ztn a at least.
12:29
Our is provided as a cloud-based service, but ultimately you're
12:36
providing access back into the network so people can reach
12:40
applications, file shares on the network.
12:42
So maybe you could talk a little bit about the architecture
12:46
because I'm assuming, like I said in the first part of the
12:49
question that, you know, we should look at this as kind of a
12:52
replacement for VPN absolutely. So definitely, I wouldn't say
12:56
that, you know, true. Ztn a is If a user is just a VPN
13:01
because we don't really want to dumb it down to that and there's
13:04
kind of like three moving parts to this entire puzzle.
13:07
So one on the end point the end-user right, they're going to
13:10
have a client that is used to steer traffic either towards the
13:14
cloud, broker the zero trust exchange and then you can also
13:18
which is the the policy enforcement everything that goes
13:21
on happens in the cloud. It says, who are you?
13:24
What groups are you apart of? Can you do this now?
13:26
Earlier I mentioned that I don't all out any inbound.
13:29
Access. So you're like where's the
13:31
Kool-Aid here? Brian.
13:33
How are you allowing this user that's working from anywhere to
13:36
interact with this application back of the data center or the
13:39
private cloud? And that's where you need to be
13:40
able to deploy a lightweight VM. Sometimes you refer to it as
13:44
like an application connector. But this guy will be reaching
13:47
out bound to the cloud. It should do this in a fashion
13:51
that doesn't require user name and password, probably
13:53
certificate based authentication as well as a connection that
13:57
can't be man in the middle or Object to replay attacks.
14:00
So doing TLS plus perfect forward secrecy to it.
14:04
Basically allow them to meet in the middle.
14:06
The end user hits the cloud. The cloud says, yes, you can do
14:09
you or you can go to this and that that outbound connection
14:13
now becomes a reversed tunnel back in to the network to allow
14:17
the end user to interact with the application in the key.
14:20
Here really is to be able to support all ports and protocols,
14:24
right? You have active directory, which
14:26
can be kind of noisy. You got file shares, like sifts,
14:30
You have almost all applications.
14:32
Now they're running on 84 for three, but we still have a
14:35
handful of applications. It could be sequel.
14:38
Could be SSH RDP. Those are more of the corner use
14:42
cases, right? We don't want to open up like,
14:45
SSH and RDP to all the users because now they're back on the
14:48
network right now, they become that wild child in the
14:51
environment, they can do lateral movements with that's that's the
14:53
anti zero trust. We want to basically keep them
14:56
off, allow them to access the applications that they have.
14:59
Have access to based off of that business logic.
15:02
And then all of a sudden, your Cloud becomes a strategic point
15:05
of not only control, but visibility what users are
15:09
connecting to what applications at any given point in time.
15:12
Yeah, and I know from past experience with a VPN, you, you
15:17
know, with let's just make a generalization here, with mostly
15:20
p.m. products you can limit access to certain IP, ranges, or
15:26
addresses and ports, but you know, that very few
15:32
organizations that I talked with actually do that, right?
15:35
It's more like, you're on the network and you have pretty much
15:39
full access, but I think with ztn Technology.
15:43
That's not really how it works. But it was interesting is you're
15:46
talking about 80 and 443, I'm wondering also about like Legacy
15:52
Technologies like, hey, we've run into a lot of organization,
15:55
still that have mainframes and those would operate over like a
16:01
telnet port or something like that.
16:02
Is that all? I'm assuming, that's possible as
16:05
well. Yeah.
16:07
So not only is it possible as well.
16:10
The ability to support all ports and protocols from like a client
16:13
to server initiate, a conversation is key.
16:16
But the cool part about this is if you think about telnet or
16:19
even poor 80 these are protocols that they're like this, it's
16:22
clear text in transit. So if you have Jim hanging out
16:26
at Starbucks, right and he's making a Mainframe connection or
16:30
telnet or Port 80, What would a threat actor?
16:34
See right. And that's really the part need
16:37
to kind of hone in on so true. Ztn a is going to say.
16:40
Basically that threat actor. That's hanging out at Starbucks
16:43
is going to see an IP address inside Starbucks.
16:46
Is reaching out to the Z to the ztn a cloud and everything
16:50
that's going on in between there is completely encapsulated in a
16:53
TLS tunnel. That is not subject for prying
16:56
eyes to see that. Make sense.
16:58
Yes, you're encrypting all the way from the end device.
17:03
This case, probably a laptop all the way to that.
17:09
I'll call an appliance that you put on the clients Network,
17:13
right? So if somebody was to tap, The
17:16
wire and kind of see the traffic.
17:17
It would just all be encrypted data.
17:20
Yeah. At the very best, right?
17:22
They can't man the middle it because the connection won't
17:24
even set up, right? So the very best they could try
17:27
to do a replay attack. But even then, it's completely
17:29
encrypted. We're enforcing perfect forward
17:32
secrecy. Which means the ephemeral keys
17:34
are not in transit, right? So to do a replay attack
17:36
through, they're not going to get anything else, you know, get
17:39
anything from that. I'm also wondering what's that
17:41
implyin. So the thinking of large, you
17:44
know, multinational organizations where they have,
17:48
you know, data centers on multiple continents, is the
17:52
typical approach to put the appliances where the end systems
17:56
are or do most clients you see, put those appliances just in one
18:01
location like say North America and then once they're kind of
18:05
behind that through that firewall then spanned the
18:08
traffic globally. So yeah we don't want to try to
18:12
hear pin them to you singular areas, right?
18:14
Because that creates a back. All scenario which diminishes
18:18
user experience. So the idea would be deployed
18:21
connectors as close to Applications as possible.
18:27
And so if you had, you know, a couple data centers in North
18:30
America a couple and a Mia, right?
18:31
And you had to users that are hanging out in London, you don't
18:34
want them connecting all the way back.
18:36
Like let's say I'm taking it back, let's say application one
18:39
is been distributed both in a Mia and an in the Americas you
18:44
don't want to use her to have to train, you know?
18:45
No Traverse the entire Atlantic Ocean to get the application
18:49
one. If application, one exists in
18:52
Amia somewhere as well. Right?
18:53
Right. And so the idea would be as
18:55
traffic is coming in and it hits that ztn a cloud.
18:59
It can it can do the measurements right?
19:01
The the for a lack of better words, free GSL be.
19:05
Where's the user? Where's the application is
19:07
available in two places, let me stitch together that connection
19:10
to the quickest and user experience for them.
19:14
Without changing applications at all.
19:16
So I'm going to put my project manager had on for a minute and
19:20
I'm kind of wondering what do these ztm a deployment.
19:24
Usually look like as a kind of a big bang replacement of VPN or
19:29
do companies typically go after smaller use cases and kind of
19:34
build out either by including more users or you know what is
19:39
the approach to kind of get started and then to kind of
19:43
reach your end goal. Is the end goal usually
19:46
replacement of all VPN it is 100% replacement of all VPN so
19:51
pre covid it was little bit more of a corner use case, right?
19:54
Like it was a new idea adopting for a lot of customers, didn't
19:59
really have a need to have or to replace their vpns, right?
20:02
Users were on Prem, they didn't really need it.
20:05
Then all of a sudden covid hit and it was like a dis, a ticking
20:08
Time Bomb, right? You have all these users that
20:10
are now off the network and you have two options.
20:13
She won by more Legacy Hardware, deploy that and there was crazy
20:18
like whole times for that kind of stuff or adopt a cloud
20:21
service friendly architecture, right?
20:23
Which is ETA. Now by doing that, I would say
20:28
that in large with covid, we saw a lot of big bang actually
20:33
happen. I had talked to one customer in
20:36
particular, like, on a Thursday, 60 thousand users, right?
20:41
And then on a Tuesday, they cut a p.o.
20:43
They were ready to move. Like, it was that big of an
20:45
issue for them. I think the, the most compelling
20:48
thing here, that the story was the ability to on board all
20:52
60,000 people. By the end of the month.
20:55
So I think the the total time from P0 to the time that they
20:58
had rolled this out was like less than three weeks.
21:00
Like, they had to move very, very quickly.
21:03
That is something you just can't do on Legacy platforms.
21:07
Absolutely. That's that's, that's pretty
21:09
impressive numbers there. So I want to back you up a
21:15
little bit. I think you kind of covered what
21:19
the authentication scenario looks like.
21:24
But I'm kind of During okay, so walk me through a scenario,
21:27
where got a new person, joined the organization, they're
21:30
getting a new laptop. How do I get their laptop to be?
21:36
You know, do I push the push the client onto their laptop, Etc?
21:42
And then how is it authenticating?
21:44
Is it leveraging? The authentication into the
21:47
laptop and other words like my active directory sign in or and
21:51
then you know, the other thing I want to layer in there.
21:54
Right, I do this. Sometimes I asked multi-part
21:56
questions layer in there. You know, could be a Windows
22:00
laptop. It could be a Mac OS, I don't
22:04
know. Maybe you could be a Chromebook.
22:07
Walk me through that scenario of like, how do I get the client?
22:10
And then, what is it doing from an authentication standpoint?
22:15
What is it leveraging or am I pushing like some kind of
22:18
certificate? Things like that.
22:21
So there are a handful of customers that have gone down
22:23
the route of Bring your own Best Buy device.
22:26
And when they do that, there's a manual enrollment, right?
22:29
They'll have the user go to company named OCTA.com, for
22:32
example, they'll set their credentials and then from there,
22:35
they'll start downloading software to do whatever you
22:37
want. There's also the notion of like,
22:39
Hey, we're going to, if you are a net new employee, right?
22:44
Or I should say, not new to ztn a, you won't be able to push
22:48
that out silently to the end point.
22:49
You want to be able to pick up whatever the user uses to
22:52
authenticate, right? So if it's active directory,
22:54
Boom. One of the prove record,
22:56
prerequisites for that will be iwa integrated Windows
22:59
authentication because I don't want to make it hard to secure,
23:03
my users. I want to make it more or less
23:05
transparent. And so the, when you talk about
23:08
the client, that's being pushed out, the secret sauce behind
23:13
there, is that the authentication is going on the
23:15
background. You can, you can push it out
23:17
like, with SCCM or your MDM of choice, but it can be told.
23:21
Hey, go ahead and try to connect by the way, this is the Vacation
23:25
to main pick up the local credentials.
23:27
If they've already signed in once and take that and
23:29
transparently, put him through. Now on the back end that's
23:34
that's basically sam'l right ID. The in this particular use case,
23:38
your IDP would be peeing, OCTA Azure active directory.
23:41
Some of the big ones that are out there.
23:43
So the ztn a cloud is going to be the service provider, all we
23:46
really want, is a valid sam'l assertion.
23:49
But the, the next bigger part is that with the identity comes to
23:54
Things one you have users going out to us as based applications
23:58
but they also have access to internal applications.
24:01
So, when I fed her eight, I also want to support skim.
24:04
I want to make sure that I have the latest and greatest group
24:07
attributes for that user. So let's say that Jeff is
24:10
working diligently and then one day he has been promoted to
24:13
customer or he decides to lead the organization if you burn him
24:17
Bert you know completely any anything he has in his device
24:22
Now, he could upload it to his own personal OneDrive Dropbox
24:25
and things like that. The appropriate way to do this
24:28
is from a, ztn, a perspective is no matter what happens if he's
24:32
going out to the internet, whether it's SAS or naked,
24:35
always protect that always keep that in line and always
24:38
protecting it. But if he has access to
24:41
mission-critical, internal applications, go ahead and
24:44
immediately revoke that once you have burned that user in
24:47
identity, whether that's you know, your ping OCTA, you name
24:50
it and you're my Will vary based off of the IDP that you're using
24:55
some of them like an OCTA, right?
24:57
The Integrations are so tight that the moment that you revoke
25:00
access for Jim, Jim or Jeff, going into an application, it's
25:04
immediately picked up versus like in Azure active directory.
25:07
It's synchronized like every I think 15 minutes maybe 45
25:10
minutes or on demand but spelling that out for customers
25:14
like, Hey, listen, this is what you're going to do, let's
25:16
operationalize this and then that way if Jeff decides that he
25:19
wants to put his two weeks in and you want to burn his Has
25:22
access to internal applications. Now, you don't have to worry
25:24
about him, grabbing this stuff and then uploading it to his own
25:27
personal Dropbox. You can be able to block that
25:30
and secure the company of minimize the risk.
25:32
And I think that's an important part here is is, you know, we've
25:36
been talking about network access and, you know, getting
25:40
access to data. But, what happens, once the data
25:42
is on the device is typically challenge, we see things, you
25:45
know, like sandboxing and DMS and, you know, all kinds of
25:49
exotic ways right to protect the data, that's no longer And it's
25:53
at rest on a device. I think that's part of the
25:55
challenge. You mentioned, a couple things
25:57
are as you were talking around the transparency to the end user
26:01
is obviously a big deal, right? For a security perspective
26:04
because if it just works, you're going to gain alignment.
26:07
And you know that people are using the, the secure Pathways.
26:11
I've been defined when it comes to the price of ztn, a versus a
26:19
traditional kind of VPN only. Network access.
26:23
How do you see the comparison between the two is cost a
26:27
factor? That is something that, you
26:30
know, might be prohibitive for some companies?
26:32
Or is it pretty equivalent? I guess, help me understand if I
26:36
may say so. And, you know, I'm thinking
26:37
about making the spend to address this ZT.
26:41
N a, you know, where do I make the spend and how does it
26:44
compare to what I already have in place through something like
26:47
a VPN? We can anyconnect.
26:48
Yeah, exactly. So the first thing you have to
26:51
really identify Is that you really are subscribing to a
26:54
premium cloud, service for ztn a write-in that you were doing so
26:59
based off of identity. So, to figure out exactly what
27:02
your cost is. When adopting cloud is very
27:05
easy, if you have 5,000 users, where I need 5,000 licenses, and
27:09
I don't need to buy an appliance that can go from 5,000 to
27:12
10,000, right? Because now you have this thing
27:15
that you've you're hedging about that.
27:17
If I buy this one particular, Appliance it's going to be good
27:19
for the next seven years. Maybe not.
27:21
What happens if we We acquire a lot of companies, I'm going to
27:23
have to rip and replace that. And so that's one of the, the
27:26
definitely, the nice things about ztn a, from a cloud
27:29
perspective, and I can't speak on behalf of all the vendors
27:33
that are out there, but I know for my organization right at
27:36
user 5001, we are not going to start blocking them randomly,
27:41
right. In fact, we're just not allow
27:43
them to keep can keep connecting.
27:45
But at some point, I'm going to have a true up, whether it's at
27:48
a quarterly Business review or the annual renewal and say, hey
27:50
you know what you buy. Thousand you had 5500 From This
27:56
Moment forward. We're going to start charging,
27:58
you 5,500 will forget the past, right?
28:00
This is an adult relationship. We're going to, you know, it
28:03
behooves us both the, you know, be having a good time here and
28:07
not be tripping over, you know, silly things in life.
28:10
Yeah, I think we see a lot of things like, you know, monthly
28:12
active users and kind of an average over a year, period,
28:14
time frame. I think that's pretty common.
28:16
I've seen that with a lot of different vendors that have play
28:18
in the sophistication space and you certainly hope that it is a
28:22
A mutually adult conversation and approach to services at
28:27
least until, you know, our procurement and maybe legal
28:31
friends, get involved and start cranking over some things.
28:34
I've certainly seen things get rude, dear Elder on that.
28:37
One of the things that I'm alternate is also interested in
28:40
is around the privileged access management component, 40 trust.
28:46
When you have resources that are maybe on the network, Windows
28:50
servers like a domain controller.
28:52
Unix boxes or even just you know any server that's been
28:56
identified as kind of sensitive and under-privileged kind of
28:59
management in addition to the cloud is that something also
29:03
that zero trust can help? Or is it more focused on stuff
29:07
outside the firewall? I would say that we complement
29:10
that scenario right there in the be transparent, what I want to
29:13
do is bring to the front door of that server and however, you do
29:17
privileged access management today, that's fine, right?
29:19
That's that's between the server and however your chicken In your
29:22
credentials and what not. But one of the things that I
29:25
would like to say is that, you know, I see a lot of customers
29:28
that are doing multi-factor authentication.
29:30
Like, you can't even talk to the front door that server unless
29:32
you've done MFA MFA, like, if you're bored, go out and watch a
29:37
video, zon something called evil Jinx and how incredibly it easy,
29:42
it is to fish a user, get them to sign in take their session
29:46
keys and have access to everything OneDrive in all the
29:49
chaos that I can do from there. So MFA can be We defeated, so
29:53
from my perspective, I love like.
29:55
If I'm going to pick on conditional access I would love
29:57
to see like hey, you know what, if you want to come in and talk
30:00
to this the segment of the network where it's a Windows
30:03
server is a database server has all of our PCI information, then
30:07
how about our posture it right? Make sure you coming from a
30:10
domain join door, Jim domain, join PC as opposed to Grandma's
30:14
PC where there might not be any point security that's running on
30:18
there. I can posture for certificate,
30:20
right? I can do it.
30:22
Two different things that to do the Integrity of the user coming
30:26
in. But probably the coolest thing
30:28
that I have seen recently is around an integration that my
30:33
company has with crowdstrike. And basically the agent that's
30:37
running on Jeff's Windows PC can talk to crowdstrike and it can
30:42
actually posture for what he's called a zero trust access
30:45
score. So zero meaning you are like,
30:49
it's bad news. There's something terribly wrong
30:51
with your PC. 100 being benign, like you're a good dude.
30:54
We allow this stuff and then I can marry that's core to policy
30:57
like, hey, you can get in and talk to anything with a score of
31:01
a risk score of 70 or higher, right?
31:03
But if you want to talk to the PCI DMZ, before we even give you
31:06
that front door, you need to have a risk score of the 90 or
31:09
higher and it gives the, you know, the end users or the
31:13
people that the stakeholders in this, the Peace of Mind knowing
31:15
that it's going to have some random person coming in, its
31:18
true zero trust, they're going to get him past the cloud.
31:21
The It stops there. So Brian you're our expert on
31:24
the ztn a industry. We don't know the industry and
31:29
what we would like to ask would be your you to be a Visionary,
31:34
put on your Visionary cap for a second and tell us what's coming
31:38
down the road. In terms of what is the future
31:40
for the industry terms of, you know, big changes and features.
31:46
You see ztn a becoming like a platform where a third party
31:50
Developers. Go to or do you see ztj being
31:55
folded into other platforms likes?
31:58
A single sign of platforms, OCTA, or Microsoft.
32:03
Do you see a consolidation in the industry?
32:05
What's your perspective on where the industry is?
32:09
Heading? All bets are off with Microsoft,
32:12
right? They used to have like that that
32:14
VPN platform. I forget what it was called,
32:16
it's soon to be retired, right? But if they see a need right,
32:19
they tend to bake that into their X, I would say that when
32:24
you look at zero, trust one of the biggest Achilles heel,
32:27
right? Especially if you move very,
32:29
very fast because I always tell customers, users 1 to 100, are
32:34
going to be far more difficult on board than users 100 to
32:37
60,000. Right, once you work out the
32:39
Kinks there, it's pretty much streamlined, but you need to
32:42
have at some point in time, you go back and take the information
32:47
that's coming through, right? You might have a wild-card
32:49
policy that either ends in allow or deny But as that you traffic
32:53
is flowing through, like you might know about 70, internal
32:57
applications, but you'll be, you'll be shocked to find out
32:59
that your end users actually access like 700, right?
33:03
How do you actually get the true zero trust on that per
33:06
application Level? Now I know on our platform we're
33:09
going to basically show it as a bubble like this.
33:11
These are the bit the top talkers that have been learned
33:15
more or less, but I wanted to see an evolution a little bit
33:18
more granular. I not only don't want to see it
33:20
to be like these are the top That are being accessed to have
33:23
not been defined yet, but I also want a recommendation of what
33:27
active directory groups or group membership in general, should be
33:30
assigned to those. I love to see some machine
33:32
learning on that to be transparent.
33:35
You got me thinking there that there's could be some machine
33:37
learning, another cool feature might even be some self service
33:42
for the users where they kind of are able to go in.
33:46
And, and make the system, make ztn a We're of applications that
33:54
they need access to that kind of happens today, right?
33:57
If you have a user that is requesting access to something
34:00
whether they have it or not, it would populate the dashboard is
34:04
a defined or recently discovered application.
34:07
The self-service part would be nice because then the, you can
34:09
say one part of HR and I need this to do my job, right?
34:13
That helps narrowing the focus a little bit there, so you've been
34:16
really generous with your time. And I want to make sure that we
34:18
kind of stay on on with that one.
34:22
Things that we have started to do more recently is to get into
34:26
a little bit of non. I am trivia or questions.
34:28
And you know I think one of the questions that we were talking
34:31
about earlier might come up with this is kind of like our prep
34:35
session Jim. You want to ask the the question
34:37
that we came up with. Yeah, sure.
34:39
Because we're all either fathers of human or fur, baby children
34:43
and I probably most of our listeners have one or the other
34:46
as well. The question for this week is,
34:49
if you were able to go back and give yourself, Some fatherly
34:53
advice. What would it be?
34:55
We'll start with you Bryan. Yeah, so this one is near and
34:59
dear to my heart, my oldest is leaving for college, she's 18.
35:03
She's graduating this year, she's done a phenomenal job and
35:06
has full ride offers in state and it definitely brings me to
35:12
tears. Sometimes it's to think about
35:13
her not waking up in my house, right?
35:15
Is this weird end? I've gone back and I thought
35:19
what are some of my biggest regrets?
35:21
My biggest regret So they're kind of threefold in, hopefully
35:24
they're easier. But number one, when they were
35:27
younger, my recommendation to any new father is to just hold
35:31
them as much as you can because before, you know, it they're
35:33
just they're too big and that's just not, that's not going to
35:35
happen. I miss that so much and then the
35:38
second one would be to really get into their world.
35:42
I was always a basketball guy, track guy, and my daughter, she
35:46
loves soccer. I didn't know anything about it
35:48
and I did my best to kind of Ruin from the stands, but I
35:52
regret not taking the time to really learn the sport becoming
35:57
great at being a forward myself, right?
35:59
That way, I can help teach her coach.
36:01
I think I missed the ball on that in the last one is, you
36:05
know, celebrating the smaller Victory.
36:07
So in the DH household. Like if you want to cell phone,
36:11
then you need to have straight A's.
36:12
And if you don't have straight A's, then you don't have a cell
36:15
phone, right? I'm not going to work harder if
36:16
you're not going to work hard now.
36:19
She did great in high school, obviously, she's getting full
36:22
ride scholarships right to be able to do stuff.
36:25
And what I didn't know about that statement was that I was
36:30
slowly crushing her self-esteem every single time she brought
36:34
home anything lower than a, right?
36:36
So, when it came time for college, she was like, I don't
36:38
know if I want to do this, I don't really want to apply.
36:42
And then it took this this, this leap of my wife saying, we're
36:45
going to apply today and we see what happens and she gets
36:47
accepted and since the full ride She's blown away and then it
36:50
went from, I don't really want to do this too.
36:53
I can't get her to stop applying to colleges like it's insane.
36:56
So those are my big three hold him.
36:57
As much as you can get. In the world, celebrate the
37:00
small victories and I'll leave it at that.
37:02
That's that's well, thought out Jeff, how about you?
37:07
Yeah, it's another good question.
37:08
So I have dogs, those are my children.
37:12
My two dogs Layla and Duncan and you know the first thing
37:16
obviously is stay active and take those pups her away.
37:19
Walk every day, it's like the greatest thing in the world for
37:21
them, but from the human perspective, you know, I think
37:24
about it. If I'm looking back when I was,
37:26
you know, younger, you know, really think about what you want
37:29
to be when you grow up, if you don't know, take the Time,
37:33
explore figure it out, right? I think sometimes there's a lot
37:36
of pressure, especially, maybe in, you know, the high school or
37:39
early kind of college, folks that they're being pressured
37:43
into careers that they don't really want to be in, and they
37:47
may be doing it for any number of reasons, they don't know.
37:49
They're just kind of going through the motion or whatever,
37:51
I think they should take the time and, you know, this is what
37:53
I would have done is, you know, take the time to figure out what
37:56
way what I want to do when I grow up, I spent 10 years in the
37:59
food service industry, before I even got into it.
38:02
So, you know, I've taken a certainly, a different approach
38:06
than that. Maybe some others.
38:07
I think, you know, Brian, you brought up initial part about,
38:10
you know, we're learning the fundamentals, right?
38:13
Basketball learning how to box out, right, simple.
38:16
Things like that. And I think that applies really
38:18
to anything is, you know, learn the fundamentals of things that
38:20
interest you don't try to skip ahead and read the last chapter
38:23
before you get to it. You know and and that'll help
38:26
you truly understand things. And I think my last one is to
38:30
travel learn from other cultures, their cultures other
38:34
people don't stay in your bubble and get that, you know, recchia
38:38
reinforcement of all the things that you think are true that may
38:41
or may not apply to other people out there in the world.
38:43
So I think everyone should, you know, take the opportunity to
38:47
get out into the world. Do some international travel.
38:51
See how other countries are approaching, you know, their
38:53
lives and their issues and take that as a data point to inform
38:59
your world view rather than you know maybe being focused on just
39:02
your little corner of it. Good question Jim.
39:05
What about you? So I also have three the first
39:10
to the reason I have three is kind of went through the first
39:13
two. I'm like, yeah I kind of got
39:15
that advice and I did that but I think there were keys, right?
39:18
The first One was save your money so you can't just like
39:23
spend all your money and especially live in debt, right?
39:26
I think that's probably one of the most important things you
39:29
can do in your life is live below.
39:32
Your means and save some money for the future.
39:36
The second thing was try to find balance between kind of the
39:42
things you enjoy doing and working.
39:45
And I was that way where, you know, I I went out.
39:50
I enjoyed my life, but at the same time, I carved out the time
39:54
to make sure that I was, you know, getting educated learning
39:58
new things. And I'm working the third thing,
40:02
which, you know, I never really got this advice, but I realized
40:06
it today I was having a call with Asha motto.
40:08
Allah, who is the co-founder of ident rupee like company that
40:12
Jeff and I were with prior to now being over approachability
40:17
and You know, we got into the conversation about accounting
40:21
and I really I said, you know, both of my grandfather's were
40:24
accountants and what I realized is that they are very
40:28
risk-averse, right? And I'm I learned a lot from
40:31
them was very close to my grandfather's and I am a very
40:35
risk-averse person but I look at Oshkosh and there and the reason
40:39
is Click was Josh went out and you know, start got became like
40:45
a business entrepreneur and took risks and there were times She
40:48
told me stories, where, you know, you don't know if you're
40:52
going to get that next contract and make that next paycheck in
40:55
order to be able to pay your employees, but taking those
40:58
risks, obviously, it kind of goes back to bounce.
41:02
You have to balance taking risks with, not taking risks, but I
41:05
was always very risk-averse. So, I think especially while
41:08
you're young while you have kind of less to lose than where you
41:11
can take some more risks, don't live in fear of risk you have to
41:15
be willing to take some some risks and I think you're
41:19
starting a business while you're young yet, so it's a great way
41:22
to do it. Dude, we are like, 100% on the
41:25
same page about being risk-adverse in in pushing the
41:28
kids that to do that, right? And I didn't know the
41:32
expectations of like, hey, Azor Azor, expected, bees are.
41:37
Okay, if you ask for help and Seed like don't come home right?
41:39
Like that was like the Mantra that I had and what the way that
41:43
that kind of bit me in the butt was my son's sophomore year in
41:47
high school. He's a junior.
41:48
Now where I openly saw, like him becoming risk-averse, like I can
41:52
either go out with my friends for an hour or I can study,
41:55
right. And he just kept doing the whole
41:56
like I'm going to study all the time.
41:58
So there's definitely a lot of fruit in, you know, doing well,
42:01
but also taking some risk and having it.
42:03
And once he found that out, like, hey, there are things that
42:05
I can do and I can still achieve good grades right now.
42:09
I don't have to study 12 hours a night to be able to get it done.
42:13
And then Jeff to your point on travel, we took the all the
42:18
kids, my wife included, we went to Belize and on, you know, the
42:23
first like 100 yards, right? It's a resort in his beautiful
42:27
beyond that, right? This the extreme poverty.
42:30
And what's interesting about that is the perspective is like
42:34
you, see those kids, you know, seeing, you know, in a full
42:37
dress, the girls and boys that in long, you know, long sleeve
42:40
T-shirts Longstreet paint and long long pants, sitting in the
42:45
sun, in 98% humidity, they paid The school right?
42:50
Like that was that was kind of shocking to see that in the
42:53
kids. Looked at that and said, all
42:55
right this is you know never would have believed it until you
42:57
saw it. Yeah.
42:58
I'm a big fan of the phrase, first world problems and really
43:01
kind of understanding is this really a big deal or not?
43:06
You know, and maybe this little bit goes back to my restaurant
43:08
business, where, you know, maybe maybe he was just say, you're
43:11
working at Chili's and it's a 5 table section on a Friday night.
43:14
And someone's ranch dressing is not the most important thing in
43:17
the world at that moment. I'm just saying, right?
43:19
That could be something that's out there so yeah, I think yeah,
43:24
travel is a good one. So, all right.
43:26
Well, I think you know, we covered a lot of ground today.
43:29
I think, you know what I like to do is just pass it around the
43:32
horn real quick to see if there's any kind of final
43:34
thoughts. That the group here has Brian
43:36
wants to go to why don't you go first any final words of wisdom
43:40
that you want to drop on us and our listeners man you know
43:44
there's this whole idea in zero trust of the the concept of
43:48
browser. Solution as well.
43:50
That's something we can talk about today.
43:51
That's something I definitely see coming full line in line,
43:55
especially since so many applications are web-based.
43:57
So look that up. And, you know, I am very
44:00
grateful to be on this podcast today.
44:02
I definitely appreciate you guys time, you know letting me bark
44:06
at you for about 30 minutes. So thank you guys so much and as
44:09
always if there's anything that I can do for you, you know, feel
44:13
free and that goes for the listeners.
44:14
Well, call text email, find me on LinkedIn.
44:17
I'll be happy to Assist you guys to the best to my ability.
44:21
Yeah, it's very much appreciated and I'll have links to Brian on
44:24
LinkedIn as well as his podcast and Z scalar there.
44:29
He, you know, Brian you did a really great video on LinkedIn
44:32
explaining what Z scalar does and it really kind of applies to
44:36
that ztn a model. You know.
44:38
I definitely recommend people check that out and you know
44:41
those links will be in the show notes so people can check it
44:43
out. Jim.
44:44
What about yourself? Any final words of wisdom?
44:46
I mean you know meeting with Brian to hearing you know let's
44:51
see. TNA is all about, it's been
44:52
tremendously educational to me. I hope it was to our listeners
44:56
as well. And I really encourage people
44:59
that if this is the kind of content, you want to keep
45:02
hearing more about, or you have some other ideas for things,
45:05
you'd like us to talk about on the show, let us know.
45:09
And I think LinkedIn is probably the best way to do that.
45:12
Yeah, it's very, very great way to get a hold of us.
45:15
You know, real quick thing. I just, I just remembered there
45:18
was an Vigil who reached out to me on LinkedIn and I'm going to
45:22
look up his name real quick cuz I'm going to probably butcher it
45:25
but he tapped a article that I had written for ident Rafi way,
45:30
way way back in the day around Star Wars and identity and
45:36
access management. His name is ekrem.
45:37
I hope it pronounced correctly algrim Alcock and he did a spin
45:42
on that that was for voice Biometrics.
45:45
So he tagged me on LinkedIn. I was very nice as I go.
45:48
Okay, cool. Alright, this is something I
45:49
wrote like five years ago or something like that, you know,
45:51
just kind of getting into the space and he has a pretty
45:54
interesting take on voice Biometrics.
45:57
And maybe that's something that we could maybe bring to the
45:59
show. At some point around Androids
46:01
and computers talk to each other and you know what does voice
46:04
Biometrics mean? If it's too if it's C-3PO and
46:07
R2-D2 talking to each other, how do they Afeni Kate through voice
46:10
Biometrics? How does that even work?
46:11
Right so I thought was a very interesting spin so that you
46:14
know, that's a, that's a great example of kind of the LinkedIn
46:16
Community. I think that, you know, they've
46:17
been reaching out To folks like us but I think you know this is
46:22
a good spot that will go ahead and leave it.
46:23
I think my last words of wisdom is it's okay to get smarter you
46:27
know mistakes made or in hindsight's 20/20 and it's okay
46:31
to move on from those and figure out what worked and what didn't
46:33
they move forward from there. So with that, we'll go ahead and
46:36
close it out for this week. I would highly suggest checking
46:39
out Brian and his podcast. It's the pep kak PEB KAC
46:44
podcast, you can find out an apple podcast.
46:49
They're actually, did I get that right brain?
46:50
Or is it the other way around? It's yeah.
46:52
Unfortunately, that one was already taken.
46:53
So the pbca Casey AKA PEB cak my bad and want to make sure we get
46:58
the right plug on there as a fellow, you know, identity
47:03
information security podcaster. So it's very much
47:06
conversational, just like ours. So definitely recommend checking
47:09
it out and showing some support over there.
47:10
And like I said, I'll have a link to their apple podcast
47:13
page, so you can check it out in the show notes.
47:16
So with that, you can also check our Site at identity of the
47:20
center.com and we're on Twitter at idea.
47:22
See podcast and I think that's a pretty good spot to leave it.
47:27
Thanks everybody for listening. Thanks Brian.
47:29
Thanks Jim for being part of the conversation today and we'll
47:32
talk with everyone in the next one.
47:34
Thanks. Thanks for listening to the
47:39
identity at the center podcast. If you like what you heard,
47:42
don't forget to subscribe and visit us on the web and identity
47:45
at the center.com.