Episode 03 – Zero Trust

Podcast Guest Introductions

Charlotte
Hi, and welcome to the latest podcast episode. I’m Charlotte. I’m your host for today. I’m here today with Ben and Peter. Would you guys like to do a quick introduction for the audience?

Peter Jones
Yeah. Certainly. So my name is Peter Jones. I’m a cybersecurity specialist.

Been in the industry for many years, but primarily focused on public sector.

Charlotte
Excellent.

Ben Simpson
Hi, everyone. I’m Ben Simpson. I’m a Microsoft security specialist.

Worked in the Microsoft space for about the past five years. And in the past two years, I’ve had a real focus on the on the security side of things.

Charlotte
Excellent. Well, welcome both of you. And today, obviously, we’re gonna be talking about zero trust.

So I think one of the one of the most modern approaches to cybersecurity Mhmm. At the moment.

But before we get started, why don’t we just explain maybe you could explain simply in simple terms for those of us who aren’t as involved in it as you are, what it is and also how it’s different to more traditional approaches.

Peter Jones
Okay. To do this simply. That’s that’s a challenge because zero trust is a is a big old subject.

Charlotte
It’s a big old subject.

Peter Jones
So, yeah. It it’s an interesting subject because, when you look at traditional, networking and perimeter security for organisations, that was good to a point, but that point was probably two or three years before the pandemic, when sort of everything changed. And, traditionally with perimeter security, everything that’s outside of the network is not trusted. Everything that’s inside of the network is trusted.

Mhmm. And that was fine if you had all of your security controls in the network and so on. Now of course, more and more people are working from home. Mhmm.

Hybrid work is the absolute norm. So they’re outside of that perimeter, And of course, applications have moved from inside the data centre off into the cloud. So again, they’re outside the perimeter as well. That whole perimeter now has almost disappeared.

And that becomes a real challenge because, you know, obviously trying to pull or backhaul all of this traffic into a central node where you can then apply security controls, it’s just not very effective right now. Mhmm. So traditional security was good in its time, but it’s almost had its day. And we really now need to be thinking about how we can do this thing better.

Mhmm. And that’s where Zero Trust comes in. Because Zero Trust takes a completely different approach. It assumes that the network is breached.

And if that’s the case, then it almost changes everything because all of a sudden you can’t trust your internal network, your internal LAN.

So almost you can trust it as much as you can trust a Starbucks cafe or your home network.

So all of the focus now moves towards thinking about the endpoints, authenticating the user thoroughly, ensuring that the endpoint meets full compliance And that you’re using strong infant, authentic, encryption in order to connect that endpoint through to the application.

And if you can do that, then you can pretty much work from anywhere and connect to applications that reside anywhere. So it’s a far more flexible, agile way of working, and it gives a better user experience as well.

Ben Simpson
Absolutely. I think, Peter’s hit the nail on the head with that one. A lot of the a lot of the shift to zero trust is a cultural one as well, is in ensuring that everyone is taking on board the controls and understanding the reasoning behind it.

So it’s really a shift in culture as well as a shift in technical control as well.

Charlotte
Yeah. Yeah. So you talked about user experience. How does that relate to VPNs? Because I’m sure we’ve all experienced the pain of a VPN.

I know I have.

Peter Jones
Well, yeah. That’s true. And, again, you know, this was the knee jerk reaction at the, yeah, the point of the pandemic. Everyone started working from home, and we fired up those VPNs.

Mhmm. And everyone sort of expanded their concentrators and enabled everything. And that was great at the time. It certainly, solved a problem.

Mhmm. But now we recognise hybrid work is providing that encrypted connection between the endpoint and the concentrator.

After that you’re on the network and again everything is fair game in terms of lateral movement.

So VPNs are fine, but they’re not as good as they should be especially when you’re looking to make connections out to the outside world.

Ben Simpson
Yeah. Yeah. Absolutely. I mean, the other thing to think about as well is the application side. Not all of the applications need to be on the network. There’s in today’s age, we see a lot of software providers move into a SaaS based solution, where we can put sort of strong controls in front of in front of those applications.

And much of what we’ll talk about later on in the in the video is, what we can do to secure those, SaaS based solutions. Although they’re managed and the background of that and the infrastructure of that is managed by potentially a third party, there’s also things that you can do to limit your attack surface, and really reduce the risk of using those applications.

Charlotte
Interesting. Interesting.

So, what are the key pillars of zero trust? What are the key things that it that it encompasses?

Ben Simpson
Yeah. Yeah. Absolutely. I mean, Peter touched on this before, but the sort of three main, key pillars from a Microsoft point of view.

So the first one is assume breach.

Every single, application or user that is accessing your network or your environment should be, untrusted until you can verify that they are who they say they are and that the device is safe and there’s no vulnerabilities on that device.

We’ll get into this a little bit later of how we can check that and how we can ensure that those controls are enforced.

The second is to always verify. So ensure that you’ve got those strong authentication methods in place. Authenticator apps are a good example of this to ensure that there’s another layer of that login. It’s not just saying, okay, I’ve got my credentials, but are you actually who you say you are? Are those credentials leaked?

And can you back that up with a third party authenticator or a service based authenticator?

And then the last the methodology of least privilege as well. So ensuring that these users that are accessing these applications, if you get past the first two pillars, make sure that in a worst case scenario, someone’s breached that account, someone’s breached that authenticator. They don’t have a lot of privilege to get to all of the data or all of the critical infrastructure. It’s purely just what they need to use.

And that’s arguably one of the most important ones is to ensure that each different department has the required permissions, and not giving too much away.

Peter Jones
Yeah. Yeah. That’s that’s it. So so I think those three elements were, never trust, always verify.

Ben Simpson
Yeah.

Peter Jones
Use rules of least privilege and, assume breach across the state. I could probably add a little bit to that, and that’s from, a data point of view. Also think about, using strong encryption within your data estate, and using that data classification and data loss prevention.

It’s again really quite important. Yeah. And then also thinking about maybe automation and orchestration. Because as we move more into that sort of zero trust world, it’s about having a single unified shared security policy, that goes across the entire estate.

So, if you’re able to do that and automatically apply that security policy to the enforcement points throughout your network Mhmm. Then generally you’re in pretty good shape.

Charlotte
Excellent. That’s interesting. So so, obviously, here, we’re focusing mainly on the public sector. So in how I guess, what’s the biggest way this can really help the public sector?

Because, obviously, they have a lot of, privacy and protection obligations anyway, as well as business as usual. Yeah. They’ve got a lot of compliance regulations. How is it how is it helping them?

Peter Jones
Well, I think people refer to zero trust as a journey, which is really frustrating because no one knows what that means.

It’s a journey. It’s a journey. Everything’s a journey.

Okay. What does that mean then?

Which so but it’s a good way of looking at it actually because a zero trust project really does encourage good practice for an organisation.

So when you start that project it really is first of all, just thinking about the assets that you have in place today.

Where are your critical assets? What data feeds are actually feeding those sort of applications? Mhmm. Who are your critical users? And what workflows are in place in order to connect those users to those applications?

Charlotte
And limit them, I suppose, to your point.

Peter Jones
Absolutely. Mhmm. Yeah. That’s right. So if just as the first step within a zero trust journey, you think about that.

You understand where your critical data is. Who’s the owner of that critical data? And how to who basically has access to it? It.

Charlotte
Mhmm.

Peter Jones
That’s a fantastic first start. And then you can start to think about the policies that you apply, those granular policies to ensure that every single connection Mhmm. Between both the client and the server, and also between servers is verified explicitly.

Ben Simpson
Yeah. Yeah. Hundred percent. And, on the other side of that as well is having these policies in place and having all of these controls in place also provides a best case scenario of the worst case scenario almost.

So if someone was to breach the network and get into the network, we’re really sort of limiting on what they can they can see. Going back to the to the, value of least privilege, it really reduces the sort of blast radius of a of a of an attack if they can’t access or they can’t laterally move across the network because we’ve implemented some sort of segmentation across these applications in this and the network. So I think it’ll really help, especially with health care customers using or having access to, privileged information. Mhmm.

But that’s really where zero trust can help in limiting that exposure and obviously limiting any sort of fines that they might be liable to as well.

Charlotte
And and that’s interesting, isn’t it? Because to your point, Peter, about assuming that inside the network is as awful as it is outside the network Yeah.

Third party suppliers pose a massive risk to the public sector or to any organisation, not just the public sector, and endpoint devices, you know, to your point about hybrid working.

So I think it’s probably obvious given what you’ve just talked about, but it would be good to sort of think about how public sector organisations can use zero trust with third party suppliers to sort of mitigate the risks in that area?

Ben Simpson
Yeah. Exactly. So these third parties, a lot of them offer sort of, security controls such as single sign on. So you can you can instantly bring that third party application under your controls.

They also have multifactor authentication or some way of enforcing that.

And another thing is you can implement things like passwordless solutions as well. So, you know, face ID scanning, for example, accessing it with a PIN. So and what that really does is a lot of people have a stigma around passwordless saying that it could be less secure almost, you know, when you put in, say, Windows Hello, for example, you set up a PIN.

And and a lot of people see that as an attack vector, an easy way to gain access to the device. But for me, it really shifts passwords into being an anomaly.

So when someone’s accessing an application and it may be through a link that someone sends, so it’s a, for example, a phishing link. Mhmm.

When someone goes to access that and it asks for your password, when for the past three months it’s been scanning your face and automatically allowing you into that application

Peter Jones
Mhmm.

Ben Simpson
It it raises that secondary flag to say, hold on. I’m not used to this. Yeah. Should I report that? Is this is this normal? So there’s a lot of different ways that you can pull third party applications into in into your control and actually have much more control over it, rather than just relying on their security and the other controls that you’ve put in place. It’s really focusing on a zero trust.

Charlotte
No. It’s good. And to your point, Peter, earlier about user experience Yeah. You know? And I know we were talking about VPN there, but I think that’s a good point too about user experience. I signed into PayPal earlier this week, and it, asked for my fingerprint because I was on my laptop. And I was like, oh my gosh.

That’s so much easier than having to remember all these blessed passwords.

Peter Jones
Passwordless is fantastic. Yeah. Because it really it’s just a gift that keeps on giving.

Charlotte
It is.

Peter Jones
It’s, it improves the user experience.

Charlotte
Mhmm.

Peter Jones
And effectively, it makes your organisation more secure at the same time. So who doesn’t want that?

Charlotte
Possibly the first time that those two things have married together history of IT.

Ben Simpson
Exactly. And I think that’s a lot of the stigma around zero trust is it’s complicated.

It’s convoluted. Mhmm. But it it’s really not the case with some of the technologies that we’ve got around at the moment that can really help streamline processes, streamline your work day, really.

Charlotte
Interesting. And, so in an earlier episode, we were talking about managed detection response, and Zero Trust to me seems a perfect bedfellow for that solution because it really is two things working towards the same objective. Would you agree?

Peter Jones
Yeah. Absolutely. Absolutely.

Zero trust is a lot about visibility.

It’s about understanding what’s in your estate and who has access to those resources and ensuring that’s absolutely locked down with as granular of security policy as you can achieve. But if you have that visibility and you understand exactly who’s connecting to the network, how they’re connecting, when, why and so on. Mhmm.

Then you really are empowered to be able to do an awful lot. And it sets you up beautifully for being able to respond in the event of a breach.

Charlotte
Yeah.

Peter Jones
If you can see your valuable assets, if you can see the users that are connecting to them, and if you’ve got that visibility that shows that the heuristics, the behavioural analytics Mhmm.

So you can see exactly how that endpoint is maybe doing something that would indicate a compromise of some sort.

Then you can pick up on that very quickly and be able to respond to it effectively, which is really quite difficult.

Because in order to have that level of visibility and eyes on these tools Mhmm. Ideally, what you’re looking to have is a SOC, a security operation centre. Yeah. And that’s typically out of reach for most organisations right now. Yeah. So if you don’t have the people in place to be able to do a twenty four by seven coverage with all of the right skills in threat intelligence and all the other And not taking anything else that you need. Exactly.

Yep. Then that’s the time really to think about third parties. Mhmm. And to consider bringing in a trusted third party that can provide that coverage for you. Mhmm. And not just a third party that sort of looks at your estate, sees an indication of compromise, sends you an email to say something’s dodgy is going on and go fix.

It’s building a trusted relationship with a partner where they work with you pre breach, understand you, understand your teams, understand where your valuable assets reside.

And in the event of a breach, they’re forewarned about what is required in order to close down that breaches effectively as possible. So you really need to, if you can, empower them to take action on your behalf. Maybe at three o’clock in the morning just to reduce the impact of that blast.

Charlotte
Mhmm.

Peter Jones
And then of course, you can address, you know, how to manage it effectively Yeah. At eight o’clock when everyone comes in and is available to deal with it.

Charlotte
Yeah. And that’s to your point earlier, Ben, about, limiting the blast radius because I know with MDR, the sooner you spot an attack, the better, obviously, because sometimes it can take them days and weeks, months to get to the data.

So I’m guessing zero trust combined with that managed detection response is belt and braces to stopping them from getting to the data.

Ben Simpson
Absolutely. And I think for the most part with zero trust, it provides a good foundation of so you’re implementing all of these, solutions such as an MDM solution. You’re you’re keeping a close eye on your identity provider, and all of these, solutions provide you with signals, and all of those signals have to go somewhere. So sending those to an MDR environment is the best way to manage that.

So someone’s constantly looking at all of these signals because you can enforce as much as you want. But if you’re not doing anything with that information, if there’s no one sort of, looking at the alerts that are popping up, spot and trends, threat analysis, then it is good in itself to just have these foundations in place. But the next level up for that is implementing an MDR and having someone action those alerts and ensure that anything any patterns that are arising are getting dealt with. Is is there any sort of malicious activity on the network going on?

That’s that’s ultimately yeah.

Charlotte
That’s the dream.

Ben Simpson
That is the dream.

Charlotte
So, so big topic, lots of things to do. What’s a practical action plan that people watching this podcast could take away with them?

Peter Jones
I would say if you’re thinking about implementing zero trust, the first question you need to ask yourself is why? What’s the reason for doing it? You know, when you go down this path, it’s a it’s a I’m gonna use it. I’m gonna use it journey.

Charlotte
It’s on record now. You use it.

Ben Simpson
Everyone knows. Everyone knows.

Peter Jones
I couldn’t avoid it.

I tried. But, yeah, it is. And and therefore, you’d need to be absolutely sure of the reasons for doing it and have buy in from, you know, senior leadership team and ownership of senior leadership team for the project.

So, you know, is it, to become more agile as you see your applications moving into the cloud? Is it for maybe user experiences we’ve talked about?

You know, there’s a number of reasons why it might benefit your business, but you need to be absolutely clear as to what those reasons are first. Have the buy in from the CDL leadership team and ensure that they’re prepared to promote that into the business.

Once you’ve got that buy in, then it’s a case of building the team.

And Zero Trust is not just about technology. It really is about the whole business.

Charlotte
Mhmm.

Peter Jones
And therefore you need to include the whole business. It’s it’s obviously your infrastructure managers and your security operations team.

But then also think about those line of business managers. Mhmm. The people who actually do own the data and own the responsibility of access to that data, they need to be involved and, you know, make sure that they know exactly where their valuable assets are. Mhmm.

Think about the users and how they’re gonna be impacted. This will be a change for them. They’re used to VPN. Mhmm. And now, potentially, this is gonna be a little bit easier. Yeah. But you’ve got to bring them along on that journey.

And Not once, but twice. I’ll find another word for it. I assure you that.

Yeah. But you’ve got to bring them along and ensure that they are, you know, very much aware of why you’re making the changes. Yeah. And then it’s also the HR team and the legal team.

Again, they need to be involved.

Ben Simpson
Yeah. Absolutely. And I think Peter touched on it a little bit with the users.

It’s important to have a solid, user acceptance testing plan

Peter Jones
Mhmm.

Ben Simpson
To ensure that all of these changes that you’re putting in are well received. There there’s no change in functionality.

There’s no change in day to day sort of productivity as well.

And and the other side of the coin is you need to have a good scope and plan, understand what your landscape looks like, understand all of your critical data, your critical infrastructure.

And I think the one takeaway from this should be to even if you’re not ready to do this on a massive scale is just start small, highlight your most critical application.

That is maybe a bit too insecure for your liking and implement a zero trust architecture around that application. See how it’s see how it’s, how it’s taken from your users, and then move on to your next one. And then eventually, you’ll be in a situation where it’s not a drastic change. It’s more of a guided approach, and we’ve been through this ten other times with other applications.

Mhmm. Now we’re incorporating the whole network. We’re taking everything under a zero trust control. So it’s not so much of a shock to the system for users.

I think that’s really important to keep in mind. Yeah.

Charlotte
Yeah. So and that sort of brings us on to our final point, you know, in terms of what do employees and suppliers think about zero trust. Because as we touched on earlier, I guess if it is a nicer experience, you haven’t got to remember six hundred passwords, and you haven’t got to go through the pain of a VPN dial up dial up. How old do I say?

I can tell where I started.

But so that must help with adoption if people enjoy the experience more.

Ben Simpson
Yeah. Absolutely. And I mean, going back to sort of the passwordless solution as well, that is that is a really well adopted, sort of system. But also you can you can users aren’t stupid. Right? So we can we can back up these changes and justify it with solid statistics.

So, LastPass and Cisco Talos did a research study that eighty percent of all breaches come from some sort of lead credentials. Yeah. So that is straight away. If you if you say that to your users and say, look, this is a real problem.

We need to tackle it. This is how we’re going to do it. And just make sure everyone’s in the loop, and you’re always going to get some of the users that maybe don’t wanna have an authenticator on the phone or their personal mobile, which is which is completely fine. But there’s an answer to all of these challenges.

There’s five or two keys, for example, for those particular users that don’t want authenticators on their phones.

And I think the main message for a zero trust model is it’s not one size fits all. There’s a solution to fit everyone’s need.

Peter Jones
Mhmm.

Ben Simpson
You just have to do the research behind it and see what is the best solution for this specific use case.

Peter Jones
Yeah. Yeah. Yeah. I think the only thing I’d add to that is the actual yeah. It’s good for the security team as well and the infrastructure team.

Sometimes it can be a real challenge because, you know, they’re very much used to IP addresses and geographic location for access to various services and so on. And moving into a zero trust architecture can be a real challenge. But once you do so, then you have that unified security policy across the entire estate.

It becomes intuitive as changes happen and as other people sort of join the organisation to apply them to that zero trust architecture and give them those policies that are well defined and well understood across the organisation. Mhmm. And so everything becomes a lot more structured. So it can be quite painful to move into that zero trust architecture. Yeah. But once you’re there, it really does ease up the process a little bit.

Charlotte
It sounds like it affects lots of other things in a in a positive way.

Ben Simpson
Yeah. Absolutely. And it’s also to take on board is if you’re striving for any sort of governance framework controls, if you want to be NIST compliant, CIS compliant Mhmm. The, CAF compliant, for example.

If if you want to achieve these goals, you can integrate that with your zero trust architecture plan Mhmm. And ensure that when you’re implementing these solutions, that they conform to those frameworks. So Yeah. It can it can be a killing two birds with one stone situation where you can you can really get a lot of value out of this exercise.

Although it might take a while, you’re getting a lot out of it as well.

Charlotte
Yeah. Yeah. So investing for the future as well as solving a current issue.

Ben Simpson
Yeah. Absolutely.

Charlotte
Great. Well, thanks, guys. That was really helpful. I did find that interesting. I do find it interesting. Probably like you, I could chat about this for quite some time. But thank you both, and, I’ll see you again soon.

Ben Simpson
Thank you very much. Thank you. Cheers.