Listen: Next in Tech | Episode 121: What is zero trust?

View Full Transcript

Eric Hanselman

Welcome to Next in Tech, an S&P Global Market Intelligence podcast where the world of emerging tech lives. I'm your host, Eric Hanselman, Chief Analyst for Technology, Media and Telecom at S&P Global Market Intelligence. And today, we're going to be digging into the wonderfully nebulous concept of Zero Trust. And joining me to explore what the heck at all is are Dan Kennedy and Garrett Bekker, our analysts on our security team and returning guests to the podcast. Welcome back to you both.

Garrett Bekker

Hi, Eric. Thanks for having us. Good to be back.

Dan Kennedy

Yes. Thank you for having us back.

Eric Hanselman

Well, we've taken on what I think is a pretty significant task today, which is talking about Zero Trust. And like a lot of things in technology, and I think maybe to an even greater degree, it is being applied to all sorts of different things. It's not well understood.

There are so many different aspects to it. I guess I wanted to start maybe just trying to define what Zero Trust is in a relatively broad perspective. Thoughts about where it fits. I mean it gets used so many different places.

Garrett Bekker

Yes. I guess I'll take a crack at it. For me, it seems like I need to preface any discussion of Zero Trust with the distinction between the products and the philosophy, right? And seems to me the product side has really come to be represented by what's become known as Zero Trust Network Access, which is essentially replaced what used to be called software-defined perimeter or SDP. I guess you could get pretty granular on what exactly ZTNA means. But in essence, it's a version or a way of doing remote access without relying on a VPN.

That's to be distinguished from Zero Trust, the philosophy, which to me is really a different way of thinking about security. And it's really a complete about-face from the old perimeter-based model that we used to have, which is largely based on location, to a new model where you trust but verify and basically access to resources is mainly predicated on identity, who you are rather than where you are. I could probably belabor that for another 30 minutes, but in the interest of time I'll stop and see if Dan had anything you want to add to that?

Dan Kennedy

Yes. I mean, to me, it's essentially no longer extending implicit trust to accessing things, applications, devices, users, as you say, Garrett based on their source. You're implementing kind of a default denial of this privileged approach, along with usually some concept of a continuous assessment of risk, what that identity is doing for that user entity.

And you're basing access on factors around that user and identity. So the original Forrester paper, I guess, was more of a philosophical statement by John Kindervag, I don't know if I'm announcing it right but I've been multiple times, so it's sad that I'm...

Eric Hanselman

Saying that. Well, I want to get back to the point that you made about implicit trust and the idea that once someone or something got authenticated, the idea was that, sure, you're reasonably well trusted. And the Zero Trust approach turns that around and says, look, we're going to limit the capabilities that any individual or thing happens to have and really minimize, the idea of least privileges.

We're going to give you the least amount of privilege necessary to get done, which you need to get done and get away from that idea of once you've authenticated, we know who you are, we trust you. And we'll let you roam about and do the things that you want to do as opposed to continually reassessing where that fits. Am I catching some of those pieces?

Garrett Bekker

I think that's part of it. And I think at the end of the day, it's really about trying to think of a way to contain lateral movement in privilege escalation, right, as we hear about with so many attacks, right, is a big part of it. So to the extent that you can compartmentalize access and make it more fine-grained, a good example, and this is where it's embodied a little bit in the ZTNA approach, right?

I don't know if you agree with me, but ZTNA conceptually reminds me a little bit of the old SSL VPNs, right, whereas the traditional IPsec VPN world was basically once you get access to the network, you get access to pretty much everything on that flat network. Whereas one of the nice things about SSL VPN, you could make it a little bit more granular.

So in that sense, ZTNA, to me, has got some parallels with the old SSL VPN in the sense that you're trying to limit that access. So if somebody is a bad actor, they can only do so much.

Eric Hanselman

It feeds on, I think, an idea that we've had in security for a really long time, which is the concept of deparameterization, which is, if you think about really sort of the castle model, once you're inside the walls of the castle, you get to roam around wherever.

Deparameterization is basically this idea that, in fact, you should be shrinking that domain of control as closely as possible to the individual, maybe potentially to the data they're accessing, really taking a rethink about how we approach this.

Now of course, right now, in the world at large, we've got a lot of complexity that's pushing Zero Trust in various directions. We have an executive order from the White House here in the States that has mandated that government agencies should go implement Zero Trust without a lot of specification of what it's really supposed to be or what the implementation looks like. But that's not holding back the market at large from diving in with, I guess, the full body approach to trying to figure out what it is and how you actually implement it.

Garrett Bekker

Yes. It's funny, you mentioned deparameterization. I go back to thinking if anyone remembers the Jericho Forum. And if I recall correctly, that was -- the main focus of the Jericho Forum was deparameterization. And what ultimately came out of the Jericho Forum really was basically the basis for what became software-defined perimeter and then ZTNA so...

Eric Hanselman

Well, that's the point at which like the perimeter walls were going to come tumbling down, right?

Garrett Bekker

Exactly. 100%. I've used this analogy with MFA, too, like I think there's a parallel but I've called it the bouncer in the nightclub kind of a situation where if you think about multifactor authentication or any form of authentication, it's essentially binary, right?

It's red light/green light. So once you get in, you present your driver's license at the door and then you're good. And once you get inside the building, they have no idea what you're doing while you're on the inside, a similar kind of concept.

Dan Kennedy

The original sort of philosophical statement was it doesn't even matter if you're in the bar already. You still need to do something to continue to see -- authenticate. So again, back to that deparameterization idea that it doesn't matter what your source is, you could be within the corporate campus and still not get full access.

Whether that pans out in sort of the technical limitations is kind of a question mark. But certainly from a philosophical standpoint, that was the idea. And you mentioned preventing traversal and privilege escalation, that's part of it. You mentioned MFA, that's part of it. Microsegmentation, software-defined perimeter. Device integrity, the thing that initially prevented me from joining this podcast.

Eric Hanselman

I was thinking that we should bring that up.

Dan Kennedy

We were being very secure. So it's really a combination of technologies. I think ZTNA, in particular, has really taken off with decreased scale of remote access. I think folks kind of looked at VPNs and then sort of their -- at least the sort of legacy VPN gives you full access and people kind of looked at that and said, well, okay, wait a second, that model may not work. It needs to be a little more finer-grained, least privilege than what that allowed.

Garrett Bekker

Well, I think you touched on an interesting point. I have to take this in a different direction, but I also think there's a potential. Like this Zero Trust sounds great in theory, but there's also potential to get it wrong. And if you do get it wrong, what potential consequences.

And I can think of a fairly easy one. There's a lot of talk about doing continuous authentication. But you've got to do it in a way where it's somewhat seamless because if you're harassing your users every minute or every time they have to access anything, it's going to get old pretty quickly. In an extreme case, if users can't access or get access to what they need to, particularly in a critical moment, that's going to cause a lot of friction and you're going to get a lot of pushback.

Eric Hanselman

Well, I mean, this is one of the things that we see in a lot of the Voice of the Enterprise data. On the customer experience side, there's a certain amount of concern about our security control is going to get in the way of me getting my job done.

And I don't know, Dan, you've got a lot of numbers on the Voice of the Enterprise security study side that's identifying how much further we still need to go in terms of deployment. I mean, there's a tremendous amount of interest in Zero Trust and Zero Trust strategies and architectures, but yet, the extent to which people are actually implementing, we're still pretty early days.

Dan Kennedy

I thought you were going to say I have experience within the last hour.

Eric Hanselman

You have had the bad user experience in figuring this stuff out, yes.

Dan Kennedy

Yes. I mean, you're absolutely right. Garrett and I often cite the statistic that MFA is only around 60% and that's a key part of this sort of Zero Trust strategic tech stack, and there are a number of instances where it's no longer easy to implement MFA.

And then the second piece is now we're discussing, well, what type of MFA? It's SMS push, is that susceptible to fatigue attacks? And do we need to move to authenticator apps? And so the question just becomes very complicated. And I can see why the sort of end customer surveys are starting to raise red flags with this and saying, where does this arms race end? And how much friction can we add to user access?

The other piece of Zero Trust I always find is that, frankly, it's an interesting coin to turn. So from a marketing perspective, it's sort of taken off. So I get a lot of people pitching, Zero Trust fill in the word here. It has no association with the original paper or really anything I can tie back. It's simply some tool that's suggesting you shouldn't trust something.

Eric Hanselman

So Zero Trust has become this label for higher levels of security without really carrying through the real Zero Trust principles.

Garrett Bekker

Yes. There's been certainly a lot of Zero Trust, I hate to say, washing over the last few years. It seems like, thanks to AI, AI sort of crowded out Zero Trust a little bit certainly at RSA. But yes, it's a fair point. I've talked a little bit in the past few years, too. If you think about it, it took Google, what, 3 years to actually roll out their Zero Trust deployment.

And I can't imagine BeyondCorp, what they call it, I can't imagine there are too many firms out there that have a similar level of financial and technical resources behind them. So that just illustrates the scope of the challenge. I hate to use a cliche, but yes, I think it's really got to be a journey and a process more than a one-stop shop sort of approach.

Eric Hanselman

Well, and I guess the question there, if it is a journey, what are those necessary steps? I think we've all identified getting better at the identity piece is probably that first order thing that you've got to be able to get towards. Multifactor authentication, in some form or fashion, is critical to being able to manage that.

But yet, we're still just sort of edging over half of organizations that have actually been able to put that together. There are all of the next-generation authentication technologies that are out there. I'm sure we're all hearing a lot about passwordless. And wouldn't that be great to be fully passwordless. But that's not yet a set of capabilities that exist everywhere for all things either, right?

Garrett Bekker

No. No. We were talking about that earlier, right? And I'm a big believer in passwordless. I think it's got a lot of potential. But as Dan said, if you look at enterprise adoption levels of MFA, it's only been hovering around 60%. And before COVID, it was in the 50s. So the whole work-from-home thing gave -- and remote access gave it a little bit of a bump.

But if you compare that to other things like network security, e-mail security, SIEM tools, et cetera, that are 75%, 80-plus percent deployment, it lags. To your point, one of the issues, too, is there's just a lot of IT resources out there that literally can't accept MFA, I think Dan mentioned this before.

It's not just applications, yes, applications or legacy applications that can't support MFA. There's also a lot of other IT resources out there that can only speak password, right? They can't accept anything else, whether it be a RADIUS VPN or some sort of database or network infrastructure. That's one issue.

The other issue, if you look at our data also, whether proprietary data or studies we've done, we just did a study with Yubico, for example, we find not only is MFA not universally deployed across the enterprise, but even within those that do use MFA, they're typically using it for only certain user groups.

For example, remote users tend to be the biggest one for work-from-home. Privileged access or privileged IT admins, et cetera, that's another big use case or user persona. But rank-and-file employees tend to be lower down. So they're not all getting it, MFA. And then if you look at the typical use cases, the most common use case again, is remote access work-from-home, remote IT support. But way down the list is things like desktop login.

So I think in terms of getting authentication is that being a central, I guess, hurdle jump through to get Zero Trust in place, I still think we have a long, long way to go. And we've really got some technical limitations currently to implementing Zero Trust more broadly if that makes sense.

Eric Hanselman

Well, Dan, I mean you've been a CISO. You've had implementation experience. Are there things that we can do around this? Is this just something that we need to wait until there's greater maturity? How do we overcome what is clearly a significant issue?

Dan Kennedy

I've been a CISO. I've been sitting at a desk at 10 p.m. issuing RSA hard tokens to users.

Eric Hanselman

Ah, so you had the fun part.

Dan Kennedy

Yes. It -- really, the hands-on fun stuff. There's a lot of compromise with this, around user experience, so Garrett is absolutely right. And where CISOs can kind of trip up the most is sort of messing up that almost like client experience, usually it's employees and stakeholder experience. So however you do rollouts, you have to be very careful.

The other piece is the industry isn't always behind this piece of it. So everyone sort of understands we need MFA, but there are a lot of, at the application level, products that charge more to use it. There's even a movement within the industry to say, really, it has to be a default option in security products or other products, which I can see both sides of that.

There's more work on the sort of vendor side in implementing it. But at the same time, it is sort of table stakes at this point in terms of needing to at least be offered in new apps. So a roundabout way of answering your question, I think there's a lot of things we can do today and that we have to do today, but is everything sort of there yet? No. And I don't know if it ever will be because over -- now Garrett can speak to it, over my 20 years I've seen this sort -- I mentioned RSA hard tokens.

This has gone through a lot of different evolutions over that time period, and it's going to keep doing it. I think if we looked at SMS push notifications as 2FA, a couple of years ago we would have said, oh, yes, using that, you're in good shape. And then fatigue attacks started to become an issue where you send somebody 1,000 alerts in the middle of the night. And eventually, what do they do?

They just said accept to make it go away. But those alerts are happening because an attacker is trying to authenticate. So the state-of-the-art and attacker behavior always change, and we're just going to kind of have to keep changing with it.

Eric Hanselman

Well, it's that hegemony between the controls that we've got at our disposal and the nature of attackers. I mean the kinds of -- the depth of traversal that we saw with things like ransomware attacks changed a lot of the expectations.

Credential stuffing, the ability -- the easy availability of credentials and credential-based attacks are what started to at least maybe move us up, a little further up, in terms of the levels of multifactor authentication that organizations are running.

But as you're both identifying, the problem is that we've then gotten to a point at which it's only being applied for certain select user groups or certain access scenarios when, in fact, probably the most damage gets done with regular employees with regular connections at a point at which we'd be all the better if we could actually use more sophisticated authentication techniques there. And yet, we're running into concerns around user experience.

Garrett Bekker

Yes. No, for sure. I was just thinking, too, what Dan was talking where I think our most recent Voice of the Enterprise survey data shows that, correct me if I'm wrong, Dan, but Zero Trust or ZTNA adoption is only around 32%, if I recall correctly?

Dan Kennedy

It's early days, but it's in a lot of enterprise's plans at this point.

Garrett Bekker

Right. I think pilot numbers and POCs are pretty high, like 26%. The actual end use was around 32%. So it just shows that we're still very early on.

Eric Hanselman

I mean, there's tremendous desire there, right? I mean people want to do this.

Garrett Bekker

Oh, for sure.

Eric Hanselman

And yet there are so many hurdles that they face in deployment and experience that they're just not able to get there.

Garrett Bekker

I think that's a fair assumption. I think we've gotten beyond the initial hype phase and the phase of disillusionment, so to speak, where people actually want to do this. To your point, I think there's seeing some of the challenges.

The other point I want to bring up, too, is we -- a lot of the focus and a lot of the attention tends to be on human access. And I think now that we're moving towards more of a cloud-native world, we also have to talk more and more about machine access and app-to-app access and things like that. So it's not just about humans, we have to figure out a way to do machine identity as well and that's part of the equation also.

Eric Hanselman

I want a firm grasp of the -- my generative AI self that's going to be connecting to all of my various odds and ends so...

Dan Kennedy

It's a good point, Garrett. And what do you do with entities as a developer when something isn't working? You just keep giving them more access rights until the thing works.

Garrett Bekker

Yes.

Dan Kennedy

And so system accounts end up with incredible privilege creep.

Garrett Bekker

This is why we wind up with new things like the cloud infrastructure entitlement management space or CIEM, trying to get their hands around that problem.

Eric Hanselman

Yes. We've got new wrappers to deal with that, all right. More things to do.

Garrett Bekker

And more acronyms, yay.

Dan Kennedy

You mentioned CIEM, Garrett, C-I-E-M, that's an interesting one. I think probably the most predictable outcome of increased cloud adoption was that we were going to have identity, scale creep and privilege creep in the cloud. And something was going to have to come along and sort of help to resolve that.

Eric Hanselman

So we've had privilege creep everywhere else, why not have it in the cloud. Well, so I guess the closing question I've got for you both is, are there things that we can do? And it sounds like the general feeling is that this is a long journey, but one that organizations need to dive in to, but they need to start putting one foot in front of the other, to extend that metaphor, and really keep moving forward.

Dan Kennedy

Yes. I guess if I were to summarize thoughts on it, it's don't confuse Zero Trust strategy with any one product or technical implementation. It's going to be a set of things you do. As you just said, Eric, it's going to be swapping things in and out, especially on the MFA side, as sort of approaches become ineffective in the face of new types of attack or attacks.

And then the second piece is roll the stuff out very carefully. Have beta groups, have test groups. Anything that touches a user's access in a meaningful way -- I'm not saying be tentative, but definitely fully test it before you roll it out and be aware of the friction you're adding to users' processes. And make intentional decisions on that rather than be surprised.

Garrett Bekker

I'd say for me that the obvious answer -- and somewhat I've been talking about for most of this podcast is more MFA, try to extend that for firms who haven't rolled it out. Roll out MFA, try to hit more user groups, try to hit more use cases and try to deploy it more broadly. I think that's a good step.

Try to limit attack surface through applying least privilege more. Whether that's through deploying ZTNA in lieu of a VPN, I think would be a good step for a lot of firms. But also, the other thing I want to bring up, too, is don't forget about device trust, too. That's become a big issue, particularly in MFA circles.

It's not good enough to just authenticate your user, but you really have to have some idea of what the status of the device they're using is. Is it secure -- first of all, can we identify it? Is it a managed or an unmanaged device? Have we seen this device before? And then there's a whole host of other checks you can do on top of that around integrity. Has it been rooted or jail-broken? Is it fully patched? And does it have basic security function running? I think that's another big area to look at as well.

Dan Kennedy

Back in the day, NAC, network access control, had a terrible reputation. But it turns out it was just a feature, not a stand-alone product, I suppose.

Garrett Bekker

Yes. I actually early on when I started covering Zero Trust, I don't know, 4 years ago or so, I actually referred to it Zero Trust is NAC on steroids.

Eric Hanselman

Well, it all gets back to that basic Zero Trust principle of managing trust at a much more granular level, which requires a lot of integration, requires a lot of individual controls working, hopefully, well together as seamlessly as possible, but a lot to go. While I was hoping for a great grand answer to this, I was not naive enough to think that there was a silver bullet in all this.

Thanks to both of you for helping to explore this. And hopefully, this motivates people and doesn't depress security professionals too much and gets teams moving forward. But thanks for all the perspective.

Garrett Bekker

Thanks, Eric. Appreciate it. It's great to be on and always a lot of fun.

Dan Kennedy

Yes. Thanks for having us back, Eric.

Eric Hanselman

Well, and thanks to both of you. And that is it for this episode of Next in Tech. Thanks to our audience for staying with us. And thanks to our production team, including Caroline Wright, Ethan Zimman and the Marketing and Events Team and our agency partner, the [ One Nine Nine ].

Join us for our next episode where we're going to be discussing cloud-delivered quantum. How do you get quantum computing by the [ drip ] kinds of options that you get with cloud? I hope you'll join us then because there is always something next in tech.