Perimeter security is dead. The network boundary that once defined our security strategy has dissolved into cloud services, remote work, and distributed infrastructure. [Zero Trust](/pillars/zero-trust/) Architecture represents a fundamental shift in how we think about access control and threat prevention—one where no user, device, or application is trusted by default, regardless of whether they're inside or outside the traditional network edge. In this episode, Mike and Andres explore real-world examples and practical implementation strategies that show what Zero Trust actually looks like when deployed at scale. If you're still relying on the assumption that "inside the firewall = safe," this conversation is essential.

What This Episode Covers

  • Zero Trust fundamentals: Moving from perimeter-based security to a “never trust, always verify” model
  • Architectural components: Practical elements like micro-segmentation, identity verification, and continuous authentication
  • Real-world deployment examples: How organizations like Google implement Zero Trust at enterprise scale
  • Key architectural principles: Understanding trust boundaries, protected surfaces, and shifting security controls
  • Government & regulatory perspective: CISA guidance and public sector Zero Trust adoption strategies
  • Implementation pathways: Actionable steps for teams beginning their Zero Trust journey
  • Common misconceptions: Why Zero Trust isn’t just a technology, but a mindset shift

Deep Dive

Understanding Zero Trust Architecture: Beyond the Perimeter

For decades, network security operated on a castle-and-moat model. You built a strong perimeter, and everything inside was assumed safe. Zero Trust completely inverts this assumption. Rather than creating a fortress around your network, Zero Trust assumes breach is inevitable and designs security controls accordingly.

The core principle is simple: never trust, always verify. Every access request—whether from a user on a corporate laptop, a cloud service, or a third-party vendor—must be authenticated, authorized, and encrypted, regardless of origin. This applies equally to traffic crossing the network boundary and traffic moving within your internal infrastructure.

Practically speaking, Zero Trust means shifting from network-centric security to identity-centric and data-centric security. Instead of asking “Is this device on our network?”, Zero Trust asks “Who is this user?”, “What device are they using?”, “What is their security posture?”, “Are they accessing what they should be accessing?”, and “Is their behavior normal?” These questions are evaluated continuously, not just at initial login.

The shift matters because traditional perimeter-based security leaves you vulnerable to insider threats, compromised credentials, lateral movement after breach, and the explosion of shadow IT. Zero Trust addresses these gaps by making trust granular and revocable.

Micro-Segmentation: Limiting the Blast Radius

Micro-segmentation is perhaps the most visible architectural component of Zero Trust. At its core, it means dividing your network into small zones and controlling access between them with the same rigor you’d apply to external traffic.

In traditional networks, once an attacker breaches the perimeter, they often have relatively free movement. A compromised workstation on the finance VLAN might be able to communicate freely with the database server. Micro-segmentation eliminates this lateral movement by creating security boundaries at a much more granular level—often down to individual workloads, applications, or even functions.

Consider a practical example: An e-commerce organization might segment its network so that web servers can only communicate with specific API servers, API servers can only reach specific database instances, and no segment can communicate “sideways” with peers in the same tier. If a web server is compromised, the attacker cannot freely explore the network—they hit a wall at every attempted lateral movement.

Implementation typically involves:

  • Identifying communication flows: Understanding which services need to talk to which other services
  • Defining policies: Creating allow/deny rules based on application requirements, not broad network ranges
  • Enforcing at multiple layers: Using firewalls, virtual segmentation, containerization, and software-defined networking
  • Continuous validation: Regularly auditing and updating policies as applications and infrastructure evolve

A common misconception is that micro-segmentation requires ripping out your entire network infrastructure. In reality, many organizations implement micro-segmentation gradually, starting with their highest-risk or highest-value assets, then expanding over time.

Identity Verification and Continuous Authentication

In a Zero Trust model, identity becomes the primary security perimeter. This goes far beyond traditional usernames and passwords.

Effective identity verification in Zero Trust involves several layers:

Multi-factor authentication (MFA) is the baseline, but Zero Trust expects more sophisticated approaches. Risk-based authentication dynamically adjusts requirements based on context. A user logging in from their usual location with their regular device might need only MFA, while an unusual login from a new geography or device might trigger additional verification steps.

Continuous authentication is where Zero Trust really differentiates itself from legacy approaches. Rather than a single authentication check at login, continuous authentication monitors ongoing user behavior and session activity. If anomalies are detected—unusual commands, access patterns, or data movements—re-authentication or access revocation can be triggered in real time.

In practice, this might look like:

  • A user authenticates with MFA when opening their laptop
  • They connect to a SaaS application; their identity provider verifies device compliance
  • They attempt to access a sensitive data repository; additional factors are required
  • While accessing the data, behavioral analytics detect unusual query patterns and trigger additional verification
  • Their session is continuously evaluated for risk, and access can be revoked if threats are detected

Organizations implementing this often use identity and access management (IAM) platforms, conditional access policies, and behavioral analytics tools to create this layered verification posture.

Real-World Example: Google’s BeyondCorp Model

Google’s BeyondCorp is one of the most well-documented Zero Trust implementations in industry, and it provides valuable lessons for enterprise deployment.

Google started BeyondCorp because the traditional VPN-and-firewall approach wasn’t working for their distributed, global workforce. Rather than assuming devices on the corporate network were safe, BeyondCorp treats all networks as untrusted and shifted access control to identity and device security.

Key aspects of BeyondCorp:

  • No network-based trust: Users don’t get special access just by being on a corporate network
  • Device security as a prerequisite: Before accessing resources, devices must meet security standards (encryption, OS patches, antivirus status)
  • Identity-driven access: Access decisions are based on who you are and the security posture of your device, not network location
  • Continuous verification: Security posture is continuously validated

The practical impact: Google eliminated their VPN infrastructure (which was becoming a security bottleneck) and instead implemented access controls at the application and service level. A user’s access to a specific tool depends on their identity, device health, and the sensitivity of the resource—not on whether they’re connected to a Google network.

This model has become influential because it demonstrates that Zero Trust is achievable at scale. Google processes millions of access requests daily through BeyondCorp, proving the approach is operationally viable.

Government and Regulatory Guidance: CISA’s Zero Trust Framework

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has emerged as a leading voice in Zero Trust adoption, particularly for government and critical infrastructure.

CISA’s Zero Trust guidance is built on several core principles that apply across all sectors:

  • Assume breach: Design systems assuming attackers will eventually compromise some systems
  • Verify explicitly: Use all available data points for authentication and authorization
  • Secure by default: Use least-privilege access and maintain explicit allow lists
  • Protect surfaces and data: Focus on protecting users, devices, applications, and data—the actual attack surfaces—rather than network boundaries

For federal agencies, this isn’t optional guidance anymore. CISA has issued binding directives requiring federal agencies to move toward Zero Trust Architecture. This regulatory push is trickling down to private sector contractors and regulated industries, making Zero Trust increasingly mandatory rather than optional.

The government’s emphasis on Zero Trust reflects a recognition that traditional network-centric security has failed to prevent sophisticated breaches. By codifying Zero Trust principles in guidance and requirements, agencies are driving a sector-wide transition.

Common Misconceptions About Zero Trust

“Zero Trust means zero convenience.” Some believe Zero Trust will create friction that makes systems unusable. When implemented well, Zero Trust should be transparent to users. A properly designed system uses contextual signals to minimize friction while maintaining security.

“Zero Trust is just a firewall upgrade.” Zero Trust is fundamentally a design philosophy, not a specific technology. You can have a sophisticated firewall without Zero Trust architecture, and you can implement Zero Trust without replacing your firewall.

“We need to implement Zero Trust all at once.” Most organizations implement Zero Trust incrementally, starting with high-risk assets or specific use cases, then expanding. This allows for learning and refinement without disrupting the entire organization.

“Zero Trust means we don’t need perimeter security.” Zero Trust doesn’t eliminate perimeter defenses; it just doesn’t rely on them as your primary security control. You still maintain protective controls at network boundaries.

Implementation Considerations

For teams ready to adopt or improve Zero Trust, consider this phased approach:

Phase 1: Assess and Plan

  • Document your current network architecture, applications, and data flows
  • Identify high-value assets or high-risk areas to prioritize
  • Evaluate your current identity infrastructure and device management capabilities
  • Establish governance and policy frameworks

Phase 2: Build Foundation

  • Ensure you have a robust identity and access management platform
  • Implement device management and mobile device management (MDM) solutions
  • Deploy multi-factor authentication universally
  • Establish baseline security policies and monitoring

Phase 3: Implement Segmentation

  • Begin with micro-segmentation in your highest-value or highest-risk areas
  • Document application communication requirements
  • Deploy segmentation controls at appropriate layers (network, virtualization, cloud, container)
  • Test and refine policies continuously

Phase 4: Mature and Scale

  • Expand segmentation to additional applications and infrastructure
  • Implement continuous authentication and behavioral analytics
  • Automate policy enforcement and response
  • Continuously audit and update policies as threats and business needs evolve

Key prerequisites across all phases:

  • Executive sponsorship and organizational commitment to the culture shift
  • Investment in identity and device management technologies
  • Security and network team collaboration
  • Clear communication with business stakeholders about timelines and trade-offs
  • Continuous monitoring and analytics capabilities

Key Takeaways

  • Zero Trust is a philosophical shift: It’s not just technology—it’s a fundamental change in how you approach trust and security
  • Micro-segmentation limits lateral movement: By dividing your network into controlled zones, you dramatically reduce an attacker’s ability to move freely after initial compromise
  • Identity becomes your perimeter: In a distributed world, controlling access based on identity and device security is more effective than controlling network access
  • Continuous verification is essential: One-time authentication isn’t sufficient; Zero Trust requires ongoing validation of user identity, device health, and behavioral normality
  • Real-world examples demonstrate feasibility: Google’s BeyondCorp and similar implementations prove Zero Trust works at scale
  • Regulatory momentum is building: Government guidance and regulatory requirements are making Zero Trust increasingly mandatory in regulated industries
  • Implementation is incremental: You don’t need to transform your entire infrastructure overnight; phased implementation allows for learning and maturation

Why This Matters

The IT and security landscape has fundamentally changed. Remote work, cloud services, mobile devices, and API-driven architecture have eliminated the meaningful network perimeter that once existed. Yet many organizations continue operating as if the 1990s firewall-and-VPN model still protects them. It doesn’t. This gap between infrastructure reality and security assumptions is creating massive risk.

Zero Trust Architecture addresses this gap directly. By shifting from “trust by location” to “trust by verification,” organizations can maintain security posture in the modern infrastructure reality. For IT professionals and security practitioners, this means your work is becoming more granular and more sophisticated. Instead of managing broad network zones, you’re managing detailed access policies based on identity, device, and behavior. Instead of assuming internal traffic is safe, you’re applying the same scrutiny to all traffic. This requires investment and discipline, but it measurably reduces breach risk.

The transition to Zero Trust is no longer optional for organizations in regulated industries, and it’s rapidly becoming table stakes for any organization serious about modern security. Whether you’re just starting your Zero Trust journey or looking to mature an existing program, understanding the architectural components, real-world examples, and implementation considerations discussed in this episode is essential.

    ---

    Listen to the full episode on [YouTube](https://youtube.com/@SecurityIn45) or subscribe via [RSS](https://media.rss.com/security-in-45/feed.xml).

Full Transcript

Click to expand the full episode transcript

Unknown Rain. Unknown Mike, how you doing? It’s nice to see you again. I’m very.

It’s always. Every week. Always a pleasure. Good afternoon.

Unknown How’s it going, man? Unknown Well, nothing. Nothing, Unknown special. I think this is like we were.

We were just talking about. We’re Unknown again retaking security in 45. This is, I guess, what it’s going to be our season three. Unknown Episode one.

Unknown And, Unknown can’t believe we’re on season three already. Yeah. Yes. And it’s been a while since we do this.

Or, you know, this this this is going to be fine. Unknown Very fun to to do, as always. Unknown I know, Unknown we have probably, you know, talk about what are the things that we’ve been doing for the past few months. Unknown It’s been busy, I don’t know.

Unknown I know you been busy, too, with engagements. I think the last one, the last one we did was, Unknown first half of the year. Yeah. In, you know, in the episodes.

Unknown We ended up going to Cisco Live. We ended up going to, you know, getting a lot of information on a bunch of other things and, and also and also ctfs. Unknown So it was a really good experience. How about you and, Unknown I got to sit in on your ice session speaking.

That was called Cisco Live speaker. Well done. Unknown Yes. And you’re still met with a firewall?

Unknown On the firewall? Yeah. Firewall and removing complexity from the network. But you know, I’m passionate about.

Yeah. Yeah. Unknown That was that was awesome. Unknown And, Unknown I don’t know, like, just making it super relaxed.

Super like, Unknown impromptu on on on the episode today. Unknown I guess the main idea and one of the things that we decided to talk about today was zero trust in, you know, what would be hearing? What are the few things that, you know, we can recommend our listeners to do, Unknown to look into how do we do it, get started, and hopefully, you know, this is a fun episode. Unknown It’s not necessarily a 45 minute episode in.

Maybe we can get to talk about things that we’ve seen for the last eight months or so, I think. Unknown It Unknown hey, a lot has happened in the world of zero trust in the last eight months. Even the definition of zero trust is a little different. Yeah.

Yeah. What do you think? Unknown Like, Unknown if. Unknown Because we get this a lot, like, for example, customers are like, all right, Unknown what are you guys doing for Zero Trust?

Do you get that question a lot? So all the time. Yeah. Yeah.

The you know what the you know the first thing I’d say, Andreas. All right. Unknown What are you thinking? Zero trust is like you know, that’s the first thing is because it’s going to be so broad.

Unknown Yeah. Yeah. It’s crazy. And that’s that’s one of the questions that like tickers a lot, all the time.

Just because it can mean many different things for many different people. Unknown We like so everybody knows we do work for Cisco and Unknown for us is like a framework, right. Unknown I don’t know if we have it handy or anything, but, but there’s there’s, like, a framework where we start with a few things, identity, you know, and we don’t necessarily want to talk about products today, but, Unknown but, yeah, there’s a few things that we probably can get into today and just talk about zero trust. Unknown Any any other things that you’ve seen like, Unknown let’s say, for example, customers asking you for zero trust and what do I get started?

What are they? What are the main things they get to see, you know, daily with customers? I think a lot of customers are Unknown where do I start? And you know what?

It’s a different answer for everybody because of the you know what I’ll say right away as well. Unknown What’s the three W’s? You know, the workforce, the people, the workplace, the devices and the work or the work? Let me restart that.

The workforce and the people and devices, the workplace, you know, the physical buildings, physical infrastructure and then the workloads, all the applications. So, Unknown and how are they all connected? That that’s one of my first questions, because the answer of where to get started is going to be, well, what is what is your unique topology look like and workflow. Unknown And where are you kind of the most vulnerable currently.

And what’s also like the low hanging fruit. And a lot of times, you know, maybe you get this one too, but if you don’t have MFA in place, that’s almost like an immediate no brainer, like the MFA that the MFA is like can be an easy starting point to lock in that identity. Unknown At least at that point. We know that Unknown you’re at least who you say you are.

You’re at least a trusted user on the network. Unknown Exactly. And that, that is that is one of the things that, Unknown and we do have a list. So if you guys seriously reading out of something here in the screen, it’s just because we came prepared with, Unknown with a little list of what are the things I’ve probably Unknown made, Unknown make zero trust.

Unknown And that’s one of them. That’s I think one of the easy, easy wins in it just to Unknown to go over. How do we start with zero trust and. Yeah.

Unknown Identity. Right. Unknown Just and the face part of that, the other thing that, Unknown that we also have the opportunity to ask our customers is, Unknown what type of, Unknown identity they have. Unknown And in this case, I’m thinking about IDP.

Single sign on. Unknown Who’s authorized to, Unknown get in the network, getting the applications and things like that. So. So, yeah, MFA is one of the biggest ones.

Unknown I also see like, Unknown you know, step one, what we’re seeing here and what we you know, created for this episode is start with the identity. Unknown That’s the only thing that’s, you know, that’s the biggest threat right now was email. Unknown Identity has overtaken the biggest threat. You know, the people are facing is stolen credentials hack someone’s identity.

Unknown So, Unknown I like that you brought that up first as a, as a, as a as a real starting point. If we have to pick one. Unknown Probably identity. Yeah.

Yeah. I also see another one. Unknown So, so on this list, we have one cleanup privileges. I don’t know what that then means in, you know, for many people out there, Unknown we probably I wouldn’t start with that one.

How? We just start with the MFA, I guess. Unknown The other thing that I see there is separate admins. Unknown Yeah.

What does that mean in that case where, like, just creating multiple like a segmentation for administrators. What have you seen on that one? It totally. I mean, Unknown getting away from a flat network where everyone’s got the same access fundamental zero trust principle right there.

My admins get access to the admin things. They can’t go in and start, Unknown making changes to our, Unknown maybe our our marketing servers. Unknown No, that’s the marketing. People do that by admins.

Unknown They need access to the networking devices, the security devices, the the control plane, if you will. Unknown And, Unknown yeah. So once we know it’s in the admin, Unknown I mean, you’re, you’re Unknown the main person I go to for segmentation, like things like I so you know what I’m about to say. Unknown But authorization, the admins should be in an admin group and have access to the admin things, and they should not have access to the things they should not have access to.

So that’s what I think of when I hear about separation of user groups and admins. Unknown Exactly. One other thing that I don’t see on this first step. And excuse me, it’s Unknown and it’s just, Unknown a phrase that everybody just says, you know, whenever they’re getting into this is that you Unknown cannot protect whatever you don’t see or something along those lines.

Unknown So having like a, like a good understanding and, and there are some documents that we’ve been reviewing the that we’ll put in the on the episode notes and some guidance from Unknown from agencies, security agencies or cybersecurity agencies. And in this case is identify all the devices that are connecting to the network. I think that’s huge. Unknown And we get to see that a lot.

Unknown I don’t know, you know, like, Unknown we, we get to talk about one product in particular, and, Unknown and that is Cisco is not that we want to get into the actual product, but, Unknown but it’s one way and there, of course, a lot of other products that do, Unknown similar, if not the same, just to identify things that are connected into the network you get to see are a lot to like. Unknown Totally. Unknown The visibility is key. And for me also like Unknown there are more devices on networks nowadays than there are humans.

So I don’t know, maybe for I’m just making this up Unknown this. But maybe for every one worker there’s ten devices on a, on a today’s modern network. So if you think about printers, thermostats, the anything plugged into a wall or connected to Wi-Fi, things that we aren’t even aware aware in the network. Unknown So yeah, the visibility like what’s on the network, not just the device that the worker is on and this authenticated with, but like, what are all these devices are human classified.

And can we identify I’ll use a printer as an example. Unknown We need tools that can identify a printer as a printer. And then just like a, just like the administration. Unknown Well, the printer should be doing printer things and communicating like a printer.

It should have access again to, to, Unknown the, the marketing or finance or, or whatever it may be like it’s a printer. Unknown So I think to your point that, Unknown yeah, authorizing not just the user to be able to do what their role is, but like the device, like a printer needs to be involved with printing services, printing protocols. Unknown It is not a web server. It is not it should not be communicating with our email system like Unknown that’s that’s how a printer behaves when it gets hacked.

So that’s a nice way to like shrink, shrink what a printer does and kind of limit the, Unknown blast radius, if you will. Something does happen. Yeah. And that is good that you mentioned that because, Unknown we get to see that a lot.

Unknown We get to talk about that a lot with customers and, and there’s some guidance. You’ll see it in some of the, the links that we had to to the episode notes. But, Unknown there’s some guidance and then we’ll just go into very, Unknown detail Unknown detail explanations of how to implement those and things like that. And that is a nice segue into, Unknown what we’re seeing here is that number two and that is title says reduce, Unknown the blast radius.

Unknown And I saw the radius and I was like, Unknown but it’s not that radius. It is just making sure that that things are control that from those. Mike. Unknown I’m, I’m curious to see Unknown what are the things that, like your thoughts on it?

Unknown What what do you recommend? Unknown First off, I think that’s hilarious that I’ve never noticed that you just point out you’re at the blast radius and never thought about the radius protocol itself. Unknown That’s hilarious. Unknown That’s a that’s a good, like, kind of like, geek joke that, you know, someone who’s, like, so familiar at the radius per code notice.

Unknown All right, so reducing the blast radius for one. I like that Unknown it’s not about preventing the blast, but reducing when the blast happens because it’s inevitable something is going to happen in the network. Unknown What Unknown how are how well are you prepared to handle that blast. And when we reduce the blast radius, that’s pretty good preparation there.

So if, Unknown maybe it’s I mean, ideally just isolating the one computer device that it happens on. Unknown But yeah, segmentations the name of the game. I’ll go back to what you brought up earlier that, that Unknown in the separate access for the admins. Unknown So if I’ve got an admin computer that gets hacked, Unknown we’ll Unknown that really shouldn’t affect people.

But. Or in different levels of access than that particular user. Or maybe the printer would be a good example. Unknown If a printer gets hacked, it’s it has it’s trying.

It has Unknown ransomware on it and it’s, it’s creeping around trying to and spread as much as it can be for the ransomware campaign like gets noticed. Unknown But if we can if that printer can only communicate, maybe just with like, Unknown the printing services, that’s going to be a much better situation for us then that printer having access to, Unknown our internal servers and our, our sensitive data. Like it, it never at a separation of duty there. And when the, when the blast occurred.

Well, it was limited in scope. Unknown What about you on that. Yeah. Yeah.

And I’ll actually see those like, Unknown like reducing the blast radius. Unknown Very similar in a sense that Unknown that is Unknown it’s not Unknown it’s not enough just to segment your, let’s say, for example, it says here crown jewels. I don’t, I don’t, I don’t like that term a lot, but Unknown but it is, you know, what we use in the industry in most of the cases and that those are, you know, our web server database, this is, Unknown things that users just use to their, their job and things like that. Unknown But it is not only sufficient just to create VLANs Unknown and leave it like that.

It is not sufficient just to do a segmentation like that instead. Unknown There are a lot of products to a, a lot of things software that, Unknown companies can use and admins can use just to, to make sure that not only they do segment those critical devices, they also have the option of applying controls to it. Unknown Like let’s say you brought up a good point, like, Unknown in the case of, I don’t know, one of those printers got infected. We have controls.

We can use controls that just Unknown killed the network connectivity from that printer. Maybe it’s not a printer, maybe it’s a computer. Unknown They user that, Unknown that got compromised in. And the attacker is just trying to move laterally in the environment.

Unknown There are also, Unknown alarms that can be raised. There are also actions that admins we can take, like isolating that device. And then I’m not talking about any, any particular product. But you know, there’s some controls that we can implement in that case.

And and making sure that Unknown we know exactly what are the critical assets and making sure that we know exactly what we want to do. Unknown I think Unknown it’s the name of the game on this particular, Unknown step that we see. Unknown Yeah. I mean, it’s really it’s so true.

And you got to be prepared. So many people are focused on preventing the attack, but, like, you gotta be prepared to recover from Unknown the attack itself. It’s going to happen. Unknown What is the scope and like, Unknown the, the Talos team about, you know, there’s a lot of education and training on that.

Unknown Like, what do you do when an attack occurs? Well, I’ll tell you the the first thing is Unknown how well has your, Unknown your network self healed itself to begin with? Like, before you’re even aware that something is happening. How well have the tools and processes held up to limit the scope of what has happened and try and contain it?

Unknown It’s I mean, these threats are very advanced. It was it was nice in the old school days under it’s under you remember like, oh, just lock it, lock down these ports and we’re good to go. But now that these threats are sophisticated, the people delivering these threats, they just don’t necessarily know how they work. Maybe they’re just paying like a ransom.

Unknown More as a service where someone who doesn’t even know anything about networking pays a couple hundred bucks. And now they’ve got a they’ve got a ransomware attack ready to go, and they’re dropping it in a USB drive in the back of a printer, you know, Unknown so the big thing for me is Unknown by the time you’re alerted to this, Unknown have you proactively put systems in place that have contained that have isolated it and, Unknown made life a lot easier, as opposed to, Unknown are you I mean, worst case scenario is you’re not even aware this attack has happened. Unknown The blast radius is your entire company, and your company is about to fold. Yeah, Unknown yeah, yeah, we’ve seen that.

We’ve seen that a lot. I’m actually, Unknown I’ll tell you the truth. Unknown I’ve heard the term ransomware as a service, and and I’ve been curious about it. Like to learn more?

Probably. We’ll do an episode on that at some point. Unknown So we’ll we’ll test it on, Unknown someone else’s network. Unknown Let’s do it.

Unknown Let’s do it. Awesome. Unknown I think step three, it just says enforce context, not location. And it has a few pointers that, Unknown are really good.

Unknown I would just, you know, start with the first one is device posture. Unknown There of course, again, there are so many tools that do this. Unknown And this is what I always like to call another layer of security for maybe allowing, Unknown a user, a remote user through a VPN session or remote access VPN. Unknown It’s not only the username and password that we’re, Unknown looking to authenticate, it is also the state of that computer.

Unknown Three critical things that I see a lot customers use in their environments is making sure that the firewall is enabled, making sure that they have an antivirus or whatever EDR solution they have. Unknown The other one is what, disk encryption. That’s what we see most mostly from our customers. Unknown What do you see?

What do you see on that one, Mike? Unknown You know what I see is when I go a lot of times and, you know, Unknown anyone out here listening this call knows that if you’re a computer person, people are going to come to you asking, why is my computer running slow? Unknown I think I got some virus. You know what?

I notice a lot of times the things are disabled, like the personal firewall. The antivirus is way out of date. This version of windows is, like, way old and vulnerable. Or you’re you’re you’re you’re Chrome or Firefox or, you know, whatever it may be.

Safari. This is like really out of date and vulnerable. Unknown So although we have identified Unknown knowing that phase is going to stop that, like you’re allowed to be on this computer, this is you connect to this. But everybody forgets about the posture.

I swear, like I talked to a lot of people and they’ll say we’ve got like we have alter ID in place. We, we we pushed down authorization. Unknown We’ve got great segmentation in place. Our blast radius is small.

I, we have, Unknown just, just the top Unknown red top Unknown money span and processes in place for identity. But then it’s like, what about that device itself? And that just breaks everything. Because if you think about you’re if you’re totally just allowing, you’re doing a great job verifying that user.

Unknown But you it’s almost like a worst case scenario because you’re so confident that that user’s allowed on the network that you’re just willingly assuming and inviting the bring in whatever malware they want. Unknown So it’s just, yeah, you got to have that posture check in place. Unknown I know you is it bad like you get on? Yeah, sure, sure.

Unknown Grandma, let me take a look at your your computer. What, what? This is run on windows 98 on air. There’s no antivirus on here.

Like posture checks to happen in the modern world. Exactly. Yeah. And and I want to see that, Unknown the posture checking for many, many companies out there probably seems like, you know, a hunting task Unknown or something that maybe they find super difficult to do.

Unknown And the reality is that Unknown even if it is difficult, Unknown and if you want to be secure, definitely is worth spending time on building that. You can do it with many tools. You mentioned, try the, Unknown Intune. Unknown Many, many companies right now are using Intune policies.

You can, Unknown you can create within to if you want, Unknown beefed that up and maybe use it for your, Unknown next solution in your environment. Unknown There are options. It’s not only I, I know, you know, we do ice almost every day. You know, here in our job, but, Unknown but there’s so many, many tools that you can, you can use for that for, for posture.

And, and it makes a lot of sense like, Unknown I don’t see why not like why a company would not spend time doing it. Unknown You know what else? A lot of the tools the customers already are paying for have these capable ones to do a posture checking they’re not turned on. And I’ll give you one example of this.

Unknown I know we’re not going to mention the products on the call, but the secure access product by Cisco, so included in particular tiers of that product or the ability to do posture scan and that, you know what, a lot there’s Unknown a misconception that a lot of people. Unknown Wow. And that’s that. Oh, I need to have a client, Unknown on every system that I want to do posture scan with.

I mean, even if you don’t have a client on there, let’s say you’re a customer of secure access. In this example, you can still verify, you know, the operating system, the browser version that’s with like a true client list connection. Unknown Those are big things like I mean, if your windows computer is at least up to date, you’re really decreasing your chances of, Unknown you know, your vulnerability there and and certainly with your browser as well. So Unknown yeah.

Yeah, that’s that’s a huge one. Unknown I’ll just reiterate, like, there is no reason why a company wouldn’t spend some time building this. Unknown I don’t think it, you know, probably some of the products that they already run in their environment, they already have some sort of capability for doing this. If not, I’d recommend going into Unknown into a direction where you see what you can do to, to apply in your environment.

What are you is what do you see for the posture scanning? Unknown Like if you were just going to turn on Unknown a basic posture and Unknown because a lot, Unknown no, understandably a lot of people are hey, I don’t want to like, disconnect, prevent people from getting to the network. I don’t want thousands of helpdesk tickets getting open to. But what’s, like some safe stuff you can turn on for a posture scan?

Unknown The. So those those three things that I mentioned at the beginning, the antivirus, the disk encryption and Unknown the firewall, usually, Unknown we see a lot of companies doing like a golden image of the computers that they give to the users. Unknown They already come with all those three, Unknown and good controls that, hey, I’m not going to allow you into the network unless you have the firewall turned on. Unknown And if the if the user turned it off, maybe we’re doing something on their computer or whatever the case is.

Unknown And I say, because I’ve done it, it is also a really good thing to say, hey, Unknown just go ahead and turn it on, make sure you’re complying so you can get in the network. Those are those three. Unknown And the disk encryption is huge. Unknown Just because a lot of audit a lot of you know, Unknown what do you call there is Unknown guidance from, from Unknown cybersecurity agencies recommend.

And that’s been like Unknown like the go to for maybe a computer gets lost or stolen. Unknown If the disk is encrypted then, you know, it’s very, very, very difficult for an attacker or somebody that is just, you know, Unknown taking a look at your, your hard drive, probably. Unknown I cannot see it just because it’s encrypted. So that’s another.

Unknown Do you find, first of all, agree with all of those? Unknown I think a lot of people forget about the disk encryption. Unknown Do you find that a lot of Unknown people, Unknown the in the requirement to have cybersecurity insurance is really in a good way driving initiatives for customers, like maybe posture assessment was not on the on a particular company’s mind, but they need cybersecurity surance. Unknown And now it is is it a lower their premium.

Yeah. Yeah. And that MFA other Unknown security things that that we get to see. We I think that that that was a good thing.

Unknown As a previous business owner, I know that is expensive and and that is a lot of, Unknown a lot of work for, for people out there, but definitely just helps keep things secure. Unknown I was actually reading today, and I’m glad that you mentioned this one is, Unknown something that says that, Unknown cybersecurity, Unknown attacks involving median and and severe, according to the Small Business Administration or the SBA, 50% of SMEs faced with at least one cyber attack with over 60% of those businesses shutting their doors afterwards. So I was pretty, Unknown shocking number that, Unknown that I was reading just before the call. Unknown It’s a it’s a shame we gotta like that.

That is the reality that there’s people and organizations just Unknown trying to hack. But it is the reality. And the money and time that we put in before that happens is worth gold compared to the cost of having to shut down your business from that statistic. You just said, Unknown yeah, yeah, it’s it’s insane.

Unknown I’ll, I’ll, I’ll hold on to that. It’s also, Unknown that there are tools out there, but Unknown but you know, with, with that cybersecurity, Unknown insurance thing, it’s, it’s made a lot of companies realize how critical things are. Unknown You know, if it’s just following guidance, if it’s just following or making sure that you reduce your, Unknown the money you spent on that cybersecurity insurance, it is, you know, also a good thing that they’re doing that I know they added MFA into it at some point. Unknown I don’t know if they’re adding also, Unknown posture, but if and I haven’t seen it, but if they haven’t they that is probably 1 or 2 things that the, Unknown the, the they should do.

Well, Unknown that’s pretty cool. Unknown Awesome that Unknown moving into I guess Unknown step four it is. Let’s see what it says. It says measured the right things.

Unknown What do you, Unknown like I see like three bullet points right there. Unknown Just to understand that title. Yeah, yeah. So, Unknown I’ll tell you a big thing in terms of measuring, first off, measuring support it, Unknown for a big thing for me, the person paying me to do my job needs to know that I’m effectively doing my job.

Unknown And if I, if I just over time, show, hey, look, I’ll look how great I’ve made the network. It’s like, that’s great, but you almost could forget about how bad and vulnerable it used to be. So, Unknown and it’s also a way for me to show that I’m on the right path in my zero trust journey. If I have measurable, quantitative results that I’m checking off, I hit this, I got my posture, I got my MFA, this user group.

Unknown Secure that user groups here. And I’ll tell you another big one on very I think for a lot of customers is if you can measure Unknown and compare the Unknown deep Unknown the the Unknown decrease in downtime and how that’s being replaced with uptime. That’s a big one. And, Unknown you know, another help desk tickets, if you’re doing zero really well and you’re doing it in a way that is frictionless to the end user, then you’re you’re Unknown support tickets should decrease.

Unknown Like as an example, if you are Unknown dealing with helpdesk tickets because Unknown people are getting, Unknown there’s threats in the environment and they’re shutting down services and you’re constantly spending your time chasing this and you’re having to shut down servers here and there while you try and figure it out. You’re you’re that is the definition of being reactive. And it doesn’t scale like that does not scale. Unknown And you’re never going to get out of that hole until you put something like zero trust in place.

And you can measure and compare before and after. Wow. Those those situations of me are going to Unknown go shut down servers because I didn’t know what was happening in my environment. And I had the scope of an attack was so wide open that I was it’s going to sound crazy like that.

Unknown You used to do that when you’re in a proactive environment, but measurable thanks to Mia Uptime. But my network is up. Unknown There’s a decrease in helpdesk tickets, and I, Unknown Just being able to compare and contrast that it’s it’s incredible decrease in threats. Unknown And again, if you do it right, Unknown just just just a knee I mean something not measurable, but you can feel it’s just the user experience.

Unknown Like people just expect to log in and do their job and there’s nothing get in the way. There’s no like security hoops they got to go to or like oh, I to I got to turn off the VPN in this circuit. So go restart the VPN. And this will just open your browser and get to work.

Like, you know that might not be something as measurable there, but you can feel it. Unknown What about you? Frictionless frictionless. That’s the word.

It’s the word Unknown that is that is. Well, we get to hear a lot from our customers. Hey, I want a VPN solution that is frictionless. Unknown And that means a lot to everybody.

But in this case, yeah, it is. It is a huge improvement for user experience and for administrators. Whenever they’re managing a solution that, you know, it’s involved in security. Unknown Nobody like security.

Unknown Probably the users hate it when they have to, you know, go through hoops, maybe login through, Unknown multiple applications, 100 different times during the day just because, you know, they don’t have, like, there’s no trust on their computer. There’s nothing on the back end that is, you know, authenticating the actual user. But, Unknown and what you said, like documenting those things, meshing those things, it also makes me think about connecting, Unknown that infrastructure, that environment, whatever you’re doing. Unknown Make sure that you’re also looking into what is going on.

Like, Unknown do you see Authentications coming in from, Unknown the same user failing, failing, failing all over the time? Make sure that you have a tool that tells you, Unknown make sure that you have something in place that will raise an alarm and say, hey, Unknown I see something that is out of the ordinary happening. Unknown Maybe everybody in the company works 9 to 5, and you start seeing those authentication attempts, and, Unknown 1:00 in the morning, it is, you know, those those are things, Unknown that that really help as your trust implementation. I think Unknown there there’s a lot of, Unknown products that do, Unknown products that automate isolation and things like that.

There’s a lot of that in the, in the industry today. Unknown You know what my favorite thing to measure would be? And I’m serious about something. Sounds like a joke, but Unknown how a decrease just for your own, your own self is the person responsible for chasing these things down and in a reactive state.

Unknown If you can measure. Unknown How much? Unknown Personal time you got back in your life after employees go home? Unknown Like are you?

Are you currently in a state? How many times are you coming in after 5:00 Unknown in some unexpected reactive situation, or on the weekends because something’s not working right and it’s related to excessive trust in the network or there’s, you know, whatever it may be, if you can measure that just for your own self, like, well, I’m actually getting to watch football on the weekends and not have to be like stuck to my pager about because I have excessive trust in the network. Unknown You know, things like that are important. Unknown Yeah.

You just data yourself, Mike, with the pager. Unknown Oh, man. Yeah, that’s so true. You know, it’s funny, I remember I remember the pager thinking it was so cool to have, like, I could just scroll through and see my sports on it.

Like, you’d have scores. And really, it was just it was just so basic. Unknown But like, that was smart, state of the art back then. Unknown As like, that’s nice.

Unknown Awesome. Unknown I guess those are the things that we get to see. Unknown We with zero trust. I know we we we want to keep this under 45 minutes.

We started this thinking, hey, this probably won’t be 45 minutes for me, but we’ve been going through a lot of the things that we see. Unknown But at the end, Unknown there’s there’s one last list that I’m seeing here on the notes is, Unknown for, for users, for the listeners that are, Unknown watching or listening to this episode is where do we get started? Unknown I do have I’m going to read a five bullet point, Unknown for bullet points that we have here that are, you know, easy things to grab in and take it like, you know, probably go do something like this. Unknown One of them is just making sure that you fix identity before adding any tools.

So understanding what you have, what do you want to protect Unknown the other one? Unknown Segmenting before doing any type of automation now probably be interpreted in many different ways. But yeah, understanding what do you need to segment is huge and critical. Unknown Critical parts indentify the critical parts is probably, you know, who’s connecting to what, Unknown what’s connecting to who in and so on.

Unknown It says, I know we talked about Unknown frictionless, but it’s I said probably users will see some friction whenever they start seeing new systems and how, Unknown they’re supposed to be accessing them now. Unknown And I love the last one. It says progress beats perfection. So make sure that you keep going.

It doesn’t have to be perfect. Be consistent in just you know, start implementing things just to make sure that you’re secure. Unknown Yeah, I think about that one. I agree with all of those.

I will say that, Unknown in terms of. Unknown Planning for this, one of my favorite things is Unknown an honest and measurable assessment of the current state. And, Unknown that can be hey, here’s how many. I mean, we did this within Cisco, and we have a public document about how big before and after we add a dual MFA for our employees worldwide.

And we compare. Unknown The before and after state of user friction. Unknown Help desk tickets. Unknown Do what?

Do. Oh, by the way, does a lot more than just MFA. So some of the things we were able to show are. Unknown The decrease and even VPN authentications as we move to like client list access and just measuring that experience and that for someone who is going to approve an implementation, Unknown and maybe they’re looking at like the books and they’re like, how much is going to cost?

Unknown That’s a nice thing to have in your pocket is being able to show, Unknown how your organization will spend less time once this is done. Unknown Troubleshooting, Unknown basic performance stuff or like excessive access or, you know what, the one point you mentioned, Andre was the the starting with the critical paths like show Unknown what would happen if that critical path is down or if it has been down, how much money did that cost? Unknown And compare that to when this is done and that critical path when it’s even threatened, you would be alerted well beyond, Unknown that that critical path dropping or having something severe. Unknown Yeah.

That, that, that absolutely true. Unknown I know we have like four more minutes. Like, actually, I have to jump to another call. Unknown Is it about what?

Unknown I know it’s about certificate. So, Unknown hopefully as my last call for Friday. So let’s see. Let’s see how it goes.

But, Unknown But. Nope. Just wanted to to thank you all for for listening. Thank you, Mike, for being here.

Also, Unknown on this new format that we’re doing, Unknown I, I want to say that, Unknown we plan on doing this and this is still in the planning stages, probably every two weeks. Unknown Something like that, to let you know we can keep talking about things that we see and work, and hopefully the next episode is going to be, Unknown you know, we have to choose on what it is going to be, but, Unknown but yeah, just getting to talk, getting to understand everything. And then I guess, yeah, that’s my take for, for today and what, what we’re looking for for the next one. Unknown It’s always a pleasure doing these with you, Andre.

Unknown I’m a little bummed that I didn’t get to see, Unknown your little friend Hope on the screen. And as much today, for anyone who’s just listening and only understands one of the cutest thoughts I’ve ever seen named Hope. And Hope loves to, Unknown fall asleep on Andre’s shoulder during our calls. Unknown I have a question for you.

Unknown Whose? And this episode might get released after the Super Bowl occurs. Unknown I don’t know, but we’re down to the Patriots and Seahawks and the Super Bowl. What do you think is going to win.

Unknown And and I want to say the Patriots because everybody’s going to hate me. But those are the ones that historically can’t be winning for the last few years not the last few years. Unknown But they I think they they won a few. Yeah.

They’re they’re they’re Unknown who you’re rooting for. So this is tough for me because the same similar like I’m a Steelers fan okay. And everybody knows this I’m diehard that the Patriots and the Steelers I don’t want them to overtake us in terms of Tom in Super Bowl. And so they have.

Unknown So I my wife Jackie her whole family is diehard patriots. So I’m gonna kind of fall for the Seahawks you know. But selfishly Unknown that’s awesome. That’s awesome.

Well let’s see we’ll we’ll get to see it on Sunday. I’ll be Unknown I’ll be watching it too. All right. Unknown It’s a pleasure.

Unknown It’s always a pleasure. Thank you. Thank you.