Defense in Depth
Understanding the Zero-Trust Landscape

Lots of vendors claim to offer zero-trust solutions. But is that framework even applicable to some product categories? 

Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark, the producer of CISO Series, and Geoff Belknap, CISO, LinkedIn. Joining us is our guest, Richard Stiennon, chief research analyst, IT-Harvest.

Frameworks over buzzwords

Part of the issue with zero-trust is a lack of agreement on terms. As Nathanael Coffing of Servant points out, this can lead to confusion, saying, "Start by defining both what you mean by zero-trust and what the security vendors define it as. Perimeter based solutions don't even register as ZT if we're using a strict definition." Understanding zero-trust as a framework is key to get through all the vendor bluster. "The product industry still tries to work off of buzzwords and checkboxes. Having a framework with discipline to implement around people, processes, and technology is the only way to sustain a true security posture," said David S. Jones of DeepSeas.

Zero-trust isn’t just an identity play

Identity and access are pillars of zero-trust, but not the totality of it. Organizations need to implement layers that can support such a trusted service. "The IAM guys think this whole strategy was written for them. The industry needs to apply a strategy and methodology to ZT for workload, identity, access, and transaction. The cloud won't solve the workload issue, it needs to incorporate integrity and trust just as if it were on-prem," said Mark Allers of Cimcor. This bears out in the vendor landscape, where we still see key categories not leaning as hard into zero-trust, as Simon Moffatt of the Cyber Hut noted, saying, "The majority of IAM vendors leverage the ‘identity at the centric’ narrative. Certainly authorization and policy based controls are booming too. But we don’t see network providers pivoting as much."

Not everything fits into the zero-trust mold

When anything becomes as buzzy as zero-trust, everyone rushes to fit into the category. But there are some categories that are mutually exclusive. "Either you do VPN/ Firewall or you do Zero Trust. ZT architecture is the opposite of network security. You don’t build a routable network with firewalls. You connect the right entity to another based on identity and context," said Amit Chaudhry of Cloudflare. Being a framework, it means it’s part of an ecosystem of solutions, as Elliot Volkman of Drata said, "If someone says they have a full ZT solution they are selling vaporware. It’s absolutely about architecture and strategy, but not all tools align."

Are partnerships the solution?

If any kind of comprehensive zero-trust vendor solution can ever exist, it won’t be an off-the-shelf solution. Rather this would require a deep commitment from both sides to realize. "Can any of us trust any one vendor to provide a complete zero trust solution that uses their own products? Some vendors are headed in that direction and I’m wondering if that warrants a long-term partnership," said Saul Garcia of Mass Data Trust.

Please listen to the full episode on your favorite podcast app, or over on our blog where you can read the full transcript. If you’re not already subscribed to the Defense in Depth podcast, please go ahead and subscribe now.

Thanks to our other unwitting contributor, Stephen Martin Rajan, Deloitte

Listen to the episode.

Thanks to our podcast sponsor, SquareX

LIVE!
Cyber Security Headlines - Week in Review

Make sure you register on YouTube to join the LIVE "Week In Review" this Friday for Cyber Security Headlines with CISO Series reporter Richard Stroffolino. We do it this and every Friday at 3:30 PM ET/12:30 PM PT for a short 20-minute discussion of the week's cyber news. Our guest will be Sasha Pereira, CISO, WASH.

Thanks to our Cyber Security Headlines sponsor, Vanta

Super Cyber Fridays!
Capture the CISO, Season 2 Finals

Season 2 of Capture the CISO is not over. We still have the finals!

And it's going to be LIVE on Friday, May 17th, 2024 at 1 PM ET/10 AM PT! This is the normal time we do Super Cyber Friday.

See our finalists Omer Singer, vp of strategy for Anvilogic, Russell Spitler, CEO of Nudge Security, and Attila Szász, founder and CEO of BugProve go head to head to see which company captures our CISO judges attention.

Our judges will be Edward Contreras, CISO for Frost Bank and Alexandra Landegger, CISO for Collins Aerospace. The show will be hosted by Rich Stroffolino.

Register

Cyber chatter from around the web...
Jump in on these conversations

"I’m beyond burnt out" (More here)

"What DLP did you choose and why?" (More here)

"Veterans that work in Tech" (More here)

Coming Up On Super Cyber Friday...
Coming up in the weeks ahead on Super Cyber Friday we have:

• [05-10-24] NO SHOW

• [05-17-24] "Capture the CISO Finale"

• [05-24-24] NO SHOW

• [05-31-24] Hacking Microsoft Copilot

• [06-07-24] Hacking SOC 2 vs. ISO 27001

 Save your spot and register for them all now!

Thank you!
Thank you for supporting CISO Series and all our programming

We love all kinds of support: listening, watching, contributions, What's Worse?! scenarios, telling your friends, sharing in social media, and most of all we love our sponsors!

Everything is available at cisoseries.com.

Interested in sponsorship, contact me, David Spark.