Speaker 1: Right, So today we're diving deep into zero trust networks.
Speaker 1: It's this model kind of flips the script on how
Speaker 1: we think about network security, you know, turns that whole
Speaker 1: castle walls idea on its head. And our guide for
Speaker 1: this whole thing is Evan Gilban and Doug Bart's book
Speaker 1: Zero Trust Networks Building Secure Systems in untrusted trusted networks.
Speaker 1: You know how companies they spend so much on floer
Speaker 1: walls and all that to keep like the bad.
Speaker 2: Guys out right, keep them out? Yeah, well, zero trust,
Speaker 2: zero trust's different. It starts with this whole other question
Speaker 2: what if what if they're already in Exactly, it's a
Speaker 2: fundamental shift, and it is instead of just focusing on
Speaker 2: this strong perimeter zero trust, it kind of assumes that
Speaker 2: the breach has already happened, and it builds security from
Speaker 2: the inside out.
Speaker 1: So it's less fortress more or like a super secure city.
Speaker 1: That's a great analogy, always on guard.
Speaker 3: Think of it like in a zero trust network, every
Speaker 3: single user, every device, every application has to prove that
Speaker 3: it's trustworthy all the time. No more free passes just
Speaker 3: because you're on the internal network.
Speaker 1: And that's that's what really got me with this book.
Speaker 1: From the get go, they start with this story about
Speaker 1: this e commerce company. Oh yeah, they've got like all
Speaker 1: the bells and whistles, right or firewalls, firewalls, all these
Speaker 1: security zoned. But guess what they.
Speaker 3: Still got hacked.
Speaker 1: Hacked.
Speaker 3: Yeah, the attackers they got in they moved laterally within
Speaker 3: the network. Oh wow, and all their defenses they just
Speaker 3: didn't see it coming. It just exposes this weakness in
Speaker 3: the whole perimeter.
Speaker 1: Model, right, yeah, that assumption.
Speaker 3: That everything inside a zone is safe, yeah, is trustworthy?
Speaker 1: Yeah? Okay, I'm starting to see the problem here. Yeah,
Speaker 1: but like how does this how does zero trust actually work?
Speaker 1: You know?
Speaker 3: Well, at its core, zero trust it boils down to
Speaker 3: three man things user and application authentication, device authentication, and trust.
Speaker 3: But before we like dive into the technical stuff, we
Speaker 3: do to understand the philosophy behind it.
Speaker 1: Okay, I know, I like where this is going a
Speaker 1: little philosophy, I'm in.
Speaker 3: So, where does trust actually begin in a zero trust system? Okay,
Speaker 3: Well it starts with us humans, We as the operators,
Speaker 3: were the like the first source of trust, you know,
Speaker 3: and from there that trust it kind of flows down
Speaker 3: to our systems our applications through a whole chain of things,
Speaker 3: like especially digital certificates. Think of it like a chain
Speaker 3: of command where every single link is really carefully vetted.
Speaker 1: Okay, so you're saying our human trust gets like translated
Speaker 1: translated into this technical chain of trust like certificates.
Speaker 3: Exactly. So these certificates they're issued by these really carefully
Speaker 3: vetted certificate authorities.
Speaker 1: Right.
Speaker 3: So they're like digital passports. They vouch for, you know,
Speaker 3: the identity of users, devices, application. But it's not like
Speaker 3: set it and forget it, right. You know, we're always
Speaker 3: checking these certificates making sure they're still valid, haven't been
Speaker 3: you know, messed with.
Speaker 1: Right, because things change exactly. That's where that that whole
Speaker 1: idea of a web of trust comes in, right, Like
Speaker 1: instead of just having one central authority.
Speaker 3: Right, we've got this whole interconnected network of trust relationships.
Speaker 3: It's it's kind of like this complex ecosystem where trust
Speaker 3: is constantly being evaluated and reevaluated based on like a
Speaker 3: bunch of different factors.
Speaker 1: That's like a living breathing.
Speaker 3: Yeah, yeah, exactly.
Speaker 1: Okay, this is this is making more sense now, good,
Speaker 1: But I got to ask, how do you know which
Speaker 1: threats prioritize. I mean, there's so many out there, so many.
Speaker 3: Yeah, So that's where threat modeling comes in. Okay, It's
Speaker 3: it's key for any zero trust implementation. It helps us
Speaker 3: figure out who's most likely to attack us, what their
Speaker 3: tactics are going to be, so we can, you know,
Speaker 3: focus our defenses.
Speaker 1: So instead of trying to defend against like every possible
Speaker 1: thing under the sun, everything, you focus on what's.
Speaker 3: What's most likely most likely exactly.
Speaker 1: But then wouldn't that leave you open to less common attacks?
Speaker 3: Not necessarily. Remember we're always watching, always adapting, right, So
Speaker 3: while we may prioritize certain threats, we still got stuff
Speaker 3: in place to catch those unexpected things. It's all about
Speaker 3: balancing risk and resources.
Speaker 1: You know, it makes sense. Okay, So let's say you've got,
Speaker 1: like you've figured out your top threats. How do you
Speaker 1: actually verify someone is who they say they are.
Speaker 3: That's a good question.
Speaker 1: That's where authentication comes.
Speaker 3: In exactly, and all those mechanisms, especially in a zero
Speaker 3: trust environment, we can't just rely on on like simple
Speaker 3: passwords anymore, right, right, We need we need strong stuff
Speaker 3: that can really stand up to sophisticated attacks.
Speaker 1: So are we talking about like layering those classic authentication factors.
Speaker 1: Oh yeah, like something you know, likeword, passwords, something you
Speaker 1: have token, yeah, like a token or something and something
Speaker 1: your are, biometric, biometrics, the whole shebang, the whole the
Speaker 1: whole thing, you got it.
Speaker 3: And combining them that's essential, right, multi factor authentication, multi
Speaker 3: factor that's that's key because it ensures that even if
Speaker 3: you know, one factor gets compromised, the attackers still can't
Speaker 3: get in.
Speaker 1: Can't get in. But I could see that being a
Speaker 1: real pain for users, like constantly having to enter passwords
Speaker 1: and scan your fingerprint or whatever.
Speaker 3: Right, Yeah, it's it's a challenge, you know, And that's
Speaker 3: where good design and user education comes in. We need
Speaker 3: to you know, implement authentication in a way that.
Speaker 1: That makes it easy, yeah, easy for users, but hard.
Speaker 3: The hard for the bad guys, for the bad guys. Okay,
Speaker 3: And remember it's not about like making it impossible for
Speaker 3: people to work, right, It's about making it really really
Speaker 3: hard for those.
Speaker 1: Attackers to take advantage.
Speaker 3: To exploit any weakness, right.
Speaker 1: Right, So it's like strong authentications kind of like that
Speaker 1: the front line line of defense. Yeah, and the zero
Speaker 1: trust network. But what about all the stuff.
Speaker 3: The stuff behind the scenes.
Speaker 1: The servers and applications all that. How do you secure
Speaker 1: all that?
Speaker 3: So that's where device identity becomes really important. Like, you know,
Speaker 3: just like users devices, they need to be authenticated too,
Speaker 3: so we know they're legitimate, legitimate.
Speaker 1: Haven't been messed with. And certificates are part of this too.
Speaker 3: Oh yeah, they're key here.
Speaker 1: So it's like each server gets its own.
Speaker 3: Little digital ID card, digital.
Speaker 1: ID card, I like that. But those certificates have those
Speaker 1: private keys, right right, Yeah, how do you keep those safe?
Speaker 3: That's where hardware security modules or HSMs come in.
Speaker 1: HSMs.
Speaker 3: Yeah, think of them like these tiny super secure vaults. Okay,
Speaker 3: designed to protect those keys.
Speaker 1: You know.
Speaker 3: One common type is a TPM Trusted Platform Module, which
Speaker 3: is often like built right into the computer.
Speaker 1: So it's like it's like giving each server a little
Speaker 1: bodyguards for its secrets.
Speaker 3: It's most valuable secrets.
Speaker 1: Yeah, okay, this is all starting to click. Good, But
Speaker 1: how does this play out in the real world, Like,
Speaker 1: are there companies actually doing this at scale?
Speaker 3: Absolutely? In fact, Google's beyond COREP initiative. It's a prime
Speaker 3: example of zero trust in action. Okay, they took this
Speaker 3: really radical approach. They basically treated their internal network like
Speaker 3: the public Internet.
Speaker 1: So they just decided to ditch.
Speaker 3: Basically, they said, it's inherently untrusted the whole perimeter the
Speaker 3: public Internet.
Speaker 1: That's bold.
Speaker 3: It was. It was a huge undertaking, but the recognized
Speaker 3: that the traditional approach just it wasn't working anymore. You know.
Speaker 3: They needed a new way to secure their their massive network,
Speaker 3: their applications.
Speaker 1: So how did they actually do it? I mean, I'm
Speaker 1: guessing it wasn't just like a flip a switch.
Speaker 3: They developed a system that verifies the user and the
Speaker 3: device before it grants access to any of the applications.
Speaker 3: So it's like every request goes through airport level security
Speaker 3: no matter where it's coming from.
Speaker 1: Wow. So like no more just scrolling through the employee entrance.
Speaker 1: Everyone gets the full everyone gets checked checked. But Google
Speaker 1: is Google.
Speaker 3: They have the resources.
Speaker 1: What about companies that don't have that.
Speaker 3: Don't have Google sized resources. It can still be done.
Speaker 3: A great example is Page your Duty. A smaller company,
Speaker 3: they took a more pragmatic approach, so instead of building
Speaker 3: everything from scratch, they used their existing configuration management system,
Speaker 3: which was CHEF, to implement those core zero trust principles.
Speaker 1: So they like use the tools they already had. Yes,
Speaker 1: they start building out that framework. Okay, that's that's encouraging
Speaker 1: for companies that are, you know, maybe a little intimidated
Speaker 1: by all of.
Speaker 3: This intimidating they do. So they focused on dynamically calculating
Speaker 3: and enforcing firewall rules on individual hosts. Okay, creating this
Speaker 3: like micro segmentation, you know, within their network. It's like
Speaker 3: building many fortresses, many fortresses around each of those.
Speaker 1: Assets, around each one. Yeah. I like that. I'm curious
Speaker 1: how did they, like, how did they deal with encryption?
Speaker 3: Yeah, so they were smart about it. They prioritized out
Speaker 3: of process encryption. Okay, so that means they separated the
Speaker 3: encryption from the application, from.
Speaker 1: The applications themselves instead each application.
Speaker 3: Yeah, they created this dedicated security. It's a much more
Speaker 3: centralized and standardized approach, which makes things more secure.
Speaker 1: More secure. This is all super fascinating. So we've seen
Speaker 1: how like zero trust can be done by by big
Speaker 1: companies and mall companies. Yeah, it seems like there's more
Speaker 1: to dig into here. Absolutely, What are some of the
Speaker 1: like the deeper implications of this whole approach.
Speaker 3: Yeah, you're right, we're just scratching the surface here. Zero
Speaker 3: trust it's not just tech. It's a way of thinking
Speaker 3: about security.
Speaker 1: You know. Okay, and that's where it gets interesting.
Speaker 3: It's interesting.
Speaker 1: Hold on to that thought. We'll be right back, be
Speaker 1: right back after a quick break, quick break to really
Speaker 1: dive into the world of zero trust networks.
Speaker 3: Zero trust networks.
Speaker 1: All right, So before the break for the break, we
Speaker 1: were talking about how zero trust it's more than just
Speaker 1: the tech.
Speaker 3: Yeah, it's it's a whole different way of thinking about security.
Speaker 1: Yeah, like a whole whole new mindset exactly.
Speaker 3: And that that mindset, it leads to some interesting questions
Speaker 3: like how do you measure trust in a in a
Speaker 3: digital world.
Speaker 1: It's not like you can I can look someone in
Speaker 1: the eye exactly, So how.
Speaker 3: Do you how do you even start building trust? Yeah,
Speaker 3: well you gotta look for clues, okay, what we call
Speaker 3: trust signals.
Speaker 1: Trust signals.
Speaker 3: Yeah, so these are like bits of information that help
Speaker 3: us kind of paint a picture of how trustworthy a
Speaker 3: user or a device actually is.
Speaker 1: Okay, you know. So it's it's like.
Speaker 3: Being a digital detective.
Speaker 1: A digital detective. Yeah, I like that.
Speaker 3: Yeah, we're looking for patterns, anomalies, you know, anything that
Speaker 3: looks kind of strange. Like let's say someone tries to
Speaker 3: log in from a country they've never been to before.
Speaker 1: That's a red flag.
Speaker 3: That would be a red yeah.
Speaker 1: Yeah. Yeah. Or if or if a user suddenly starts
Speaker 1: accessing all these files exactly that they've never touched before,
Speaker 1: match before. Yeah, that's that's a little fishy.
Speaker 3: That summs up.
Speaker 1: Yeah.
Speaker 3: We also look at things like you know, device.
Speaker 1: Posture, device posture, Yeah, like.
Speaker 3: Is the device like up to date, is it patched,
Speaker 3: you know, is it running non malware known malware? Yeah,
Speaker 3: the more of these trust signals, we can get better,
Speaker 3: we can assess assess the risk.
Speaker 1: But wouldn't all this create a ton of false alarms?
Speaker 1: You know?
Speaker 3: That's a good point, Like what if I'm.
Speaker 1: Just traveling for work, and right if you need to
Speaker 1: and I need to access these files from this new location, right.
Speaker 3: Yeah, that's why we need to find that balance, okay,
Speaker 3: between security and usability.
Speaker 1: Right.
Speaker 3: We don't want to lock people out for no reason,
Speaker 3: for legitimate reasons. Yeah, So that's where things like machine
Speaker 3: learning and AI come in. Okay, they can analyze huge
Speaker 3: amounts of data find those subtle patterns anomalies that we might.
Speaker 1: Miss right, So it's not just about blindly blocking, yeah,
Speaker 1: blindly blocking anything.
Speaker 3: Anything that looks a little off. It's about being smart,
Speaker 3: using technology to be smart exactly. And you know, at
Speaker 3: the end of the day, humans are still a big
Speaker 3: part of this.
Speaker 1: Okay.
Speaker 3: You know, the system can analyze all the data it
Speaker 3: wants flag those potential problems, but ultimately it's up to
Speaker 3: us security professional to make.
Speaker 1: The call, to make the decision. Yeah. Okay, So so
Speaker 1: we've got this system verifying identities, gathering all these trust signals, yeah, making.
Speaker 3: Decisions decisions about access, about access exactly, how do we
Speaker 3: actually like, how do we build it, build this, put
Speaker 3: it all together?
Speaker 1: Yeah.
Speaker 3: So the book recommends starting with a prioritize list, okay
Speaker 3: of key things to consider. Okay, you can't do everything
Speaker 3: all at once, right right, right, You focus on the
Speaker 3: most critical stuff first. You know, for most organizations, it's
Speaker 3: a journey. It's a journey, not a sprint, not a sprint.
Speaker 1: Okay. So, like like building a house, like building a house,
Speaker 1: start with the foundation and then you go from there.
Speaker 3: Yeah, okay, so what are some of those those foundation
Speaker 3: pieces for a zero trust network?
Speaker 1: Okay, So one of the like the most important things, Yeah,
Speaker 1: is that everything, every every network flow has to be
Speaker 1: authenticated before it's even processed. Okay. So that means like
Speaker 1: you're checking.
Speaker 3: We're verifying the center.
Speaker 1: And the receiver of every single.
Speaker 3: Every single packet of data. So you're not just some
Speaker 3: more trusting trust because it's inside yeah yeah, yeah, okay,
Speaker 3: zero trust. It gets rid of that assumption, okay, okay.
Speaker 3: So another key point is that you're authentication Okay, it
Speaker 3: shouldn't rely on public PKI providers public key. Yeah. Instead,
Speaker 3: we should use our own private PKI system. Man, it's
Speaker 3: all that, yeah, to manage all of our certificates and keys.
Speaker 1: So you're you're basically saying, like we control our arm
Speaker 1: we have to control our own desktomys cystany.
Speaker 3: Yeah, we can't rely on on someone else, right, someone
Speaker 3: that we don't totally control.
Speaker 1: Right, Right. And then and then of course there's encryption. Encryption, Yeah,
Speaker 1: gotta have.
Speaker 3: Gotta have encryption. Encryption, everything at rest in transit, it
Speaker 3: all needs to be encrypted.
Speaker 1: It's like that dead armor. It's the armor that protects the.
Speaker 3: Data even if it falls into the wrong hands.
Speaker 1: Right, but doesn't doesn't all that encryption slow things down? Yeah,
Speaker 1: slow things down, especially in in like large networks.
Speaker 3: Yeah, it's a concern. But the thing is modern encryption. Yeah,
Speaker 3: it's much more efficient than it used to be, and
Speaker 3: the cost of a data breach, oh yeah, way outweighs
Speaker 3: any performance hit that we might see from encryption. Plus
Speaker 3: there's there's techniques okay, like hardware accelerated encryption to help
Speaker 3: with that to kind of minimize that that overhead.
Speaker 1: Okay, so encryption is a must have. What else, like,
Speaker 1: so another thing companies prioritize is a.
Speaker 3: Really detailed system diagram.
Speaker 1: Okay.
Speaker 3: It helps you really see the network, identify any any
Speaker 3: gaps in security, and prioritize what you need to do.
Speaker 3: Give me a big.
Speaker 1: Task, like a huge undertaking.
Speaker 3: Especially organizations are large organizations, organization with networks, Like.
Speaker 1: Where do you even start?
Speaker 3: You start by by identifying every single device, every application, all.
Speaker 1: Those data flows within the network.
Speaker 3: Within the network. It can be overwhelming a lot. Yeah,
Speaker 3: but there are tools to help you know, automate that.
Speaker 1: Okay, So you're not saying like we got to like
Speaker 1: no pen and paper, pen and paper map the whole network.
Speaker 3: Out, No, no, no, there's there's network discovery tools and
Speaker 3: asset management solutions to help you create that inventory.
Speaker 1: So you've got your diagram.
Speaker 3: Diagram, then you need to figure out all those network flows,
Speaker 3: you know, document what they're supposed to be doing, who's
Speaker 3: supposed to be talking to who, and why. That information
Speaker 3: it's crucial for creating those granular policies that control access
Speaker 3: to your in a world that's that's constantly changing.
Speaker 1: Dynamic and always changing. Wouldn't that be like impossible to
Speaker 1: keep track of?
Speaker 3: Oh, it would be it would be impossible to do
Speaker 3: it manually. Right, That's that's where automation comes in. Automation
Speaker 3: comes in.
Speaker 1: You know, we.
Speaker 3: Need tools they help us that can automatically discover, monitor,
Speaker 3: and force all those policies.
Speaker 1: So it's like having like an army of an army
Speaker 1: of little digital security guards.
Speaker 3: Digital security guards patrolling making sure everything's in check in check.
Speaker 1: Yeah.
Speaker 4: Configuration management systems like the one page your duty used,
Speaker 4: they can they can really help here.
Speaker 3: They help ensure that all the devices configured directly, insistently,
Speaker 3: and then the.
Speaker 1: Security policies are across the board, across the entire network. Right. Okay,
Speaker 1: so we got a plan. We have plan for building.
Speaker 2: Infrastructure for structure right, what about the people, you know,
Speaker 2: the human element, the humans.
Speaker 3: How do we get them on board, on board with
Speaker 3: all of this? You're right, that's that's critical because change
Speaker 3: is hard.
Speaker 1: Change is hard. User education and training.
Speaker 3: Okay, so important any of this, Yes.
Speaker 1: Especially for something like zero trust. You know, we need
Speaker 1: to explain to people why this matters, how it helps them,
Speaker 1: how it's going to like affect their day to day work.
Speaker 3: So instead of just like throwing a bunch of rules
Speaker 3: at them and saying, like, do.
Speaker 1: It to it, we got to bring them along. You've
Speaker 1: got to bring.
Speaker 3: Them along, bring them along, and it's not it's not
Speaker 3: a one time thing. You've got to constantly reinforce the
Speaker 3: importance of security, provide updates on new threats, best practices,
Speaker 3: and make sure the systems are actually designed with the
Speaker 3: user in mind, because.
Speaker 1: If it's too hard to use, they're going to find
Speaker 1: ways around it.
Speaker 3: Exactly. We've got to find that.
Speaker 1: Sweet spot, sweet spot.
Speaker 3: Yeah, Okay, between security and usability. People need to understand
Speaker 3: that this isn't about spying on them making their lives hard.
Speaker 1: It's about protecting everyone, protecting everyone all these new threats, right. Yeah, Okay,
Speaker 1: so we've covered like a lot of ground here we have.
Speaker 3: From the very basics of zero trust, like how do
Speaker 3: you actually do what?
Speaker 1: How do you implement it? Right? But no security is
Speaker 1: like perfect, It's.
Speaker 3: True, nothing's fool proof. In fact, the book actually spends
Speaker 3: a whole chapter looking at zero trust from the attacker's perspective.
Speaker 1: Okay, so let's let's put on our black hats.
Speaker 3: Let's do it.
Speaker 1: If if we were going to try to attack a
Speaker 1: zero trust network, what would we look for.
Speaker 3: Well, one thing that could be a weakness is complexity.
Speaker 3: The more moving parts you have, the more chances there
Speaker 3: are for something to go wrong.
Speaker 1: So like a firewall rule.
Speaker 3: Yeah, a misconfigured firewall rule, or a certificate that's been
Speaker 3: you know, compromise, compromise that could create.
Speaker 1: A vulnerability that someone could sneak through.
Speaker 3: That an attacker could exploit r exactly. So that's why
Speaker 3: testing and constant monitoring are so important.
Speaker 1: Always got to be.
Speaker 3: You've got to be vigilant, always on the lookout for
Speaker 3: any signs of.
Speaker 1: Weakness or compromise or compromise. Yeah. Another challenge I could
Speaker 1: see is like how it impacts the users.
Speaker 3: Yeah, that's a good point.
Speaker 1: You know, if you're always check in every little thing.
Speaker 3: If we're verifying every action, requiring.
Speaker 1: All this multi factor multi factoration authentication.
Speaker 3: Yeah, I could definitely slow people down, create some friction
Speaker 3: in their workflow.
Speaker 1: So it's it's that balance again, It's that balance security,
Speaker 1: security and usability, usability. We got to find that sweet spot,
Speaker 1: that sweet spot. And let's not forget about cost. The cost.
Speaker 3: It's expensive, all this hardware of self works, all of that.
Speaker 3: You need, you need resources, you need people. Right, it
Speaker 3: can be a significant investment. But remember they don't have
Speaker 3: to do everything at once. Okay, you know, start small,
Speaker 3: focus on your your most important stuff, you know, your
Speaker 3: your crown jewels, your crown jewels, and expand from there.
Speaker 1: So it's it's not like all or nothing exactly.
Speaker 3: It's about taking a strategic approach, you know, prioritizing based
Speaker 3: on what you need.
Speaker 1: You need resource resources.
Speaker 3: And there are ways to leverage what you already have
Speaker 3: right to help with the cost.
Speaker 1: Okay, so we've talked about like the potential downsides downside,
Speaker 1: but there's there's a lot of benefits.
Speaker 3: Oh yeah, tons of benefits to zero trust. It's a
Speaker 3: much stronger, more resilient security model. Just then the traditional
Speaker 3: like perimeter based approach. It helped reduce the attack surface.
Speaker 1: Limit like the damage if if there is a breach
Speaker 1: exactly improves data protection.
Speaker 3: It enhances data protection overall. Yeah, and especially as we
Speaker 3: move towards more cloud computing, more mobile devices, remote work,
Speaker 3: remote zero trust is it's becoming essential.
Speaker 1: Yeah, it's it's how we secure sure all our digital.
Speaker 3: Stuff, all our digital assets are operations, are operators a
Speaker 3: world where the network is is it's all blurring together, blurring.
Speaker 1: Okay. So as we wrap up here our deep dive,
Speaker 1: it's it's important to really hit home that zero trust.
Speaker 3: It's more than just the technology. It's all the mindset.
Speaker 1: It's about moving away from that idea.
Speaker 3: Of a trusted perimeter. Yeah, you know, it's about embracing
Speaker 3: the fact that threats can come from anywhere, anywhere inside
Speaker 3: the company.
Speaker 1: Your organization. You've got to verify everything. Don't trust anything,
Speaker 1: blindly trust nothing.
Speaker 3: Build security, Build security from the inside out, from.
Speaker 1: The inside out. Yeah, and it's it's understanding that securities.
Speaker 3: It's not a one time fix.
Speaker 1: It's ongoing.
Speaker 3: It's a process.
Speaker 1: You got adapt, adapt, you got to improve all the
Speaker 1: time always. Okay, So for the listener out there who
Speaker 1: might be feeling a little little overwhelmed by all that's
Speaker 1: what's like the one thing they should take away.
Speaker 3: You know, just start somewhere, Start somewhere. You don't have
Speaker 3: to do everything all at once. Okay, start with your
Speaker 3: most critical assets, secure those first, and then go from there.
Speaker 1: Iterate, iterate, and build it up.
Speaker 3: Build up your zero trust posture over time, over time.
Speaker 3: And remember it's a journey, not a race. There's going
Speaker 3: to be bumps along the way, but the benefits they're
Speaker 3: worth it, zero truck. It's all about creating a more secure,
Speaker 3: a more resilient digital future, digital future for your organization,
Speaker 3: for your organization.
Speaker 1: Very well said, thank you. So before we wrap up completely,
Speaker 1: I have one final, like thought provoking question for our listeners. So,
Speaker 1: if you could like redesign your whole network security setup
Speaker 1: from scratch, from scratch, knowing, you know, knowing all this
Speaker 1: all this about zero trust, what what would you do differently?
Speaker 4: That's that's something for you to think about. Yeah, you
Speaker 4: think about your own organizators, think about your own like challenge,
Speaker 4: your own unique security challenges. You know, how could how
Speaker 4: could you apply these zero trust principles to make things better, stronger, stronger.
Speaker 3: Yeah, what what system.
Speaker 1: The data is? What data most important?
Speaker 3: What are the most likely threats you're going to face?
Speaker 1: Right?
Speaker 3: And how can you how can you build a security
Speaker 3: posture that that kind of assumes that.
Speaker 1: Those threats that they're already there.
Speaker 3: They might already be there lurking, lurking inside your network.
Speaker 1: This whole, this whole deep dive has really opened my
Speaker 1: eyes to how, you.
Speaker 3: Know, security is not just about security, is not just
Speaker 3: about building higher walls, higher walls.
Speaker 1: It's about it's about changing, changing how we think about trust,
Speaker 1: how we think about trust. Yeah, zero trust, it's it's
Speaker 1: a journey, a journey, not a.
Speaker 3: Not a destination.
Speaker 1: It's it's constantly vigilance, adaptation, a willingness to like challenge
Speaker 1: what you think you know. But if you do it,
Speaker 1: you'll create a more secure.
Speaker 3: And resilient and resilient digital future.
Speaker 1: Digital future.
Speaker 3: I think I think we've really, we've really gone deep
Speaker 3: into this whole wars zero Trust, the world of zero Trust. Yeah,
Speaker 3: and you know, thanks to Gilman and Barth, Gilman and
Speaker 3: Barth for writing that.
Speaker 1: For that awesome book.
Speaker 3: It's a great book.
Speaker 1: And to you listener, thanks for coming along with us.
Speaker 1: Thanks for joining us this deep dive.
Speaker 3: On this deep dive, we hope you got some some
Speaker 3: good stuff out of it.
Speaker 1: Yeah, some good stuff out of it.
Speaker 3: Maybe maybe some.
Speaker 1: Uhha moments, aha moments.
Speaker 3: Remember the best way to learn is to keep exploring,
Speaker 3: keep asking those questions.
Speaker 1: Keep asking questions, push those boundaries, push the boundaries.
Speaker 3: So until next time, stay curious, stay curious, and stay secure.