Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Use Zero Trust to Stop Supply Chain Attacks
Transcript
- Lucas: So let's talk about something that keeps CISOs up at night: software supply chain attacks. You know the classic story — a vendor you trust gets compromised, and suddenly their bad code is running inside your network. The SolarWinds breach in 2020 was the wake-up call, but the problem hasn't gone away. Luna: And the response from security teams has been a big push toward zero-trust architectures. But what does that actually look like in practice? Lucas: Right. Zero trust is one of those terms that gets thrown around a lot, but the core idea is simple: never trust, always verify. Every request — whether it's from inside the network or outside — gets authenticated, authorized, and continuously validated. No implicit trust just because you're on the corporate LAN. Luna: So it's about moving away from the old castle and moat model, where once you're inside the perimeter, you're trusted. Lucas: Exactly. And supply chain attacks exploit that implicit trust. If a software vendor has legitimate access to your environment — say, to push updates — an attacker who compromises that vendor can piggyback in. SolarWinds is the textbook case: attackers inserted malicious code into Orion updates, and thousands of customers installed it, trusting the vendor's digital signature. Luna: And that trust was the weak link. Zero trust tries to close that gap by verifying every connection, even from known vendors. Lucas: Yes. But implementing zero trust is a massive undertaking. Google's BeyondCorp is probably the most famous example. They essentially eliminated the corporate VPN and moved to a model where access is based on device and user identity, not network location. Every request goes through a proxy that enforces policy. Luna: I remember reading that Google reduced their attack surface by something like 80 percent after deploying BeyondCorp. Lucas: That's right. And it took them years. Most enterprises can't just flip a switch. But the principles are being codified into commercial products and frameworks. NIST published its Zero Trust Architecture guidelines in 2020, and vendors like Zscaler, Cloudflare, and Palo Alto Networks have built zero-trust network access offerings — often called ZTNA. Luna: So how does zero trust specifically address the supply chain risk? Is it mostly about vendor access? Lucas: It's a big part of it. You apply zero-trust principles to vendor connections too. Instead of giving a vendor a standing VPN tunnel into your network, you give them just-in-time access to specific resources, for a specific duration, with continuous monitoring. If a vendor's account gets compromised, the blast radius is limited. Luna: That's microsegmentation in action — isolating workloads so that even if an attacker gets in, they can't move laterally. Lucas: Exactly. And identity becomes the new perimeter. Every user, every device, every service account needs to be verified. That's why identity and access management — IAM — is central to zero trust. Companies like Okta and Microsoft are pushing hard on this with features like conditional access policies and continuous authentication. Luna: But doesn't that create friction? If every request needs re-authentication, users get frustrated. Lucas: It can. That's why the user experience side is critical. Modern zero-trust implementations use adaptive policies — they check risk signals like device health, location, and behavior patterns. If nothing looks suspicious, the user doesn't even notice. Only risky requests trigger step-up authentication. Luna: So it's more about smart enforcement than constant prompts. Lucas: Right. And the same logic applies to supply chain risk. You can automate vendor risk assessments — pulling data from security ratings services like BitSight or SecurityScorecard — and dynamically adjust access policies. If a vendor's security posture drops, their access gets restricted in real time. Luna: That's a huge shift from the old annual spreadsheet-based vendor reviews. Lucas: Huge. And it's being driven by regulatory pressure too. The SEC's new rules on cybersecurity disclosures, which took effect last year, require companies to report material cybersecurity incidents and describe their risk management processes. That's making boards ask hard questions about supply chain risk. Luna: And zero trust is part of the answer they're looking for. Lucas: It is. A Gartner survey from late 2025 found that 45 percent of organizations have a zero-trust initiative underway, up from 25 percent just two years prior. And the top driver cited was reducing risk from third-party access. Luna: But there are challenges. Legacy systems that don't support modern authentication, for example. Or the cost of ripping and replacing network infrastructure. Lucas: Absolutely. That's why many organizations take a phased approach. Start with the highest-risk assets — like critical servers or customer databases — and apply microsegmentation around them. Then expand outward. And for legacy systems, you can put them behind a zero-trust proxy that enforces policy without modifying the app itself. Luna: So it's not all-or-nothing. You can incrementally reduce risk. Lucas: Exactly. And that's the pragmatic path most CISOs are taking. The goal is to make supply chain attacks much harder to pull off. If an attacker compromises a vendor, they still have to bypass per-request verification, device checks, and behavioral analytics. The bar gets raised significantly. Luna: And for listeners who are building or running security teams, zero trust is becoming a core competency. If these conversations are useful for what you're building or running, we want to keep them coming. Lucas: Yeah, listener support is what keeps this show ad-free and focused on the real decisions security leaders face. If you find value in these deep dives, you can support the show at buy me a coffee dot com slash fexingo. It's a simple way to keep the episodes independent. Luna: And we really appreciate it. Now, let's look ahead: where is zero trust headed next? Lucas: I think we're going to see more integration with ai driven threat detection. Instead of just static policies, zero-trust systems will use machine learning to detect anomalous behavior in real time — like a vendor's service account suddenly trying to access an unusual database. That's already happening at companies like CrowdStrike and SentinelOne. Luna: So the 'always verify' piece becomes even more dynamic. Lucas: Yes. And I expect more standardization around zero-trust frameworks. The Cybersecurity and Infrastructure Security Agency — CISA — released its Zero Trust Maturity Model in 2023, and we're seeing more federal agencies adopt it. That will trickle down to contractors and eventually to the private sector as best practice. Luna: It feels like zero trust is moving from a niche concept to table stakes for enterprise security. Lucas: It is. And given the supply chain attacks we've seen — not just SolarWinds, but also Kaseya in 2021, and the 3CX compromise last year — it's clear that the old model isn't working. Zero trust is the most coherent alternative we have. Luna: And it's not just about technology — it's about changing the mindset. Trust is a vulnerability. Lucas: Exactly. So for security teams listening: start with one high-value asset, map the data flows, apply the principle of least privilege, and monitor continuously. That's the path. Luna: Great practical takeaway. Thanks, Lucas. Lucas: Thanks, Luna. See you next time.