Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Zero Trust Is Rewriting Network Security
Transcript
- Lucas: So we're a hundred and fifty episodes in, and I think it's fitting we mark this one by going back to basics — but in a way that's actually shaking up the industry right now. Zero trust. The phrase gets thrown around a lot, but the model behind it is quietly rewriting how enterprises secure their networks. And the driver is not theory — it's a string of very real, very public breaches. Luna: When you say zero trust, most people think 'never trust, always verify,' but what does that actually look like in practice? Lucas: Right, and that's exactly what we're going to dig into. But before we do, a quick honest thing. A handful of listeners chip in monthly through buy me a coffee dot com slash fexingo, and that's literally what funds making a hundred and fifty of these episodes. No ads, no sponsors — just that. So if these conversations are useful for what you're building or running, that's the thing that keeps it going. Luna: Yeah, we're really grateful for that. It's a small group, but it makes a huge difference. Lucas: Okay, so zero trust. At its core, it's a reaction to the idea that the old castle and moat model is dead. For decades, enterprises built a strong perimeter — firewalls, VPNs, all that — and then trusted everything inside. But that assumed the inside was safe. And once attackers started compromising credentials and moving laterally, that assumption fell apart. Luna: And the perimeter basically dissolved with cloud and remote work. There's no 'inside' anymore. Lucas: Exactly. So zero trust flips it: no user, device, or request is trusted by default, regardless of where it originates. You verify everything, everywhere, all the time. And the model has three core pillars — identity, devices, and network segmentation. But the part that's getting the most attention right now is identity, because that's where the breaches keep happening. Luna: Give us a concrete example. What's the breach that really sold CISOs on this? Lucas: The Okta breach in 2023 is the case study. Okta is the identity provider that thousands of companies rely on to manage access to their own systems. And a contractor at one of their vendors used their personal Google account to sign in on a company laptop. That compromised username and password got stolen, and the attacker used it to access Okta's systems with valid credentials. No malware, no exploit — just a legitimate login. Luna: And that's the nightmare scenario. Your identity provider — the thing you trust to verify everyone else — gets compromised through a simple credential issue. Lucas: Right. And Okta's own CISO admitted they had not fully implemented zero trust on their own network at the time. They've since overhauled their architecture. But the lesson stuck: even the company at the center of identity security can't rely on implicit trust. That's why zero trust is now a board-level conversation, not just a technical one. Luna: So when a CISO says they're 'doing zero trust,' what does that actually mean in terms of tools and policies? Lucas: It varies a lot. Some start with multifactor authentication everywhere — that's the easy one. Then they move to device posture checks, so a laptop that hasn't been patched or doesn't have the right encryption doesn't get access even if the credentials are valid. Then they add continuous verification — not just a check at login, but ongoing signals that you're still who you say you are. Luna: So it's not a single product. It's a set of principles applied across the stack. Lucas: Exactly. And that's why it's hard. You're not buying a zero trust box. You're rearchitecting how your network, your applications, and your identity systems talk to each other. For a large enterprise, that's a multi-year project. And the cultural pushback is real — employees hate being asked for two-factor codes every ten minutes. Luna: There's definitely a tension between security and user experience. That's probably the number one complaint I hear from IT teams. Lucas: Yeah, and the good CISOs I talk to say the secret is to make verification seamless. Use biometrics, device-based signals, location — so the user isn't constantly interrupted. The goal is to verify continuously without the user even noticing. That's where AI is starting to come in, analyzing risk signals in real time. Luna: Let's talk about network segmentation. That's the other pillar that gets overshadowed by identity. How does that fit in? Lucas: Segmentation is about limiting blast radius. Even if an attacker gets in, you want to stop them from moving sideways across your network. Old-school networks were flat — once you're in, you can reach anything. Zero trust breaks that into microsegments. A compromised laptop in finance can't suddenly talk to servers in HR. That requires network architecture changes, and it's often the hardest part technically. Luna: And it's not just about preventing the initial breach — it's about containing the damage while you're trying to respond. Lucas: Right. The average time to contain a breach is still measured in days, sometimes weeks. Segmentation buys you that time. And it's a key reason why zero trust is showing up in cyber insurance requirements now. Insurers are starting to ask about zero trust maturity before they'll write a policy. Luna: That's a game-changer. When the insurance companies start forcing the issue, that's when you know it's mainstream. Lucas: Absolutely. And it's not just a US thing. We're seeing European regulators increasingly favor zero trust principles in their guidance. There's also a whole ecosystem of vendors now — identity providers, zero trust network access solutions, secure access service edge — the acronym soup is real. But the underlying idea is consistent: verify everything, trust nothing. Luna: So if I'm a CISO listening and I haven't started on zero trust yet, what's the first step you'd recommend? Lucas: Start with your crown jewels. Identify the two or three applications that would cause the most damage if compromised — maybe your ERP system, your customer database, your code repository. And wrap zero trust controls around those first. That's a much more manageable project than trying to do everything at once. And it delivers measurable value quickly. Luna: That's the pragmatic approach. And it also helps you build a business case for the broader rollout. Lucas: Exactly. And that's what I think is the real story here. Zero trust isn't a buzzword anymore — it's becoming the standard for how we think about enterprise security. It's a mindset shift, not a product. And for any business that's serious about protecting its data, it's the conversation you need to be having. Luna: And we've been having that conversation for a hundred and fifty episodes. Thanks for sticking with us. Lucas: Here's to a hundred and fifty more. And if you want to be part of keeping this going, you know where to find us — buy me a coffee dot com slash fexingo. Now, let's talk about what zero trust means for the future of network security.