Netskope nombrado Líder en el Cuadrante Mágico de Gartner® 2024™ para Security Service Edge. Obtenga el informe

cerrar
cerrar
  • Por qué Netskope chevron

    Cambiar la forma en que las redes y la seguridad trabajan juntas.

  • Nuestros clientes chevron

    Netskope atiende a más de 3.000 clientes en todo el mundo, entre ellos más de 25 de las 100 empresas de Fortune

  • Nuestros Partners chevron

    Nos asociamos con líderes en seguridad para ayudarlo a asegurar su viaje a la nube.

Aún más alto en ejecución.
Aún más lejos en visión.

Sepa por qué 2024 Gartner® Cuadrante Mágico™ nombró a Netskope Líder para Security Service Edge por tercer año consecutivo.

Obtenga el informe
Netskope Named a Leader in the 2024 Gartner® Magic Quadrant™ for Security Service Edge graphic for menu
Ayudamos a nuestros clientes a estar preparados para cualquier situación

Ver nuestros clientes
Woman smiling with glasses looking out window
La estrategia de venta centrada en el partner de Netskope permite a nuestros canales maximizar su expansión y rentabilidad y, al mismo tiempo, transformar la seguridad de su empresa.

Más información sobre los socios de Netskope
Group of diverse young professionals smiling
Tu red del mañana

Planifique su camino hacia una red más rápida, más segura y más resistente diseñada para las aplicaciones y los usuarios a los que da soporte.

Obtenga el whitepaper
Tu red del mañana
Presentamos la Netskope One Plataforma

Netskope One es una Plataforma nativa en la nube que ofrece servicios convergentes de seguridad y redes para hacer posible su transformación SASE y de confianza cero.

Learn about Netskope One
Abstracto con iluminación azul
Adopte una arquitectura de borde de servicio de acceso seguro (SASE)

Netskope NewEdge es la nube privada de seguridad más grande y de mayor rendimiento del mundo y ofrece a los clientes una cobertura de servicio, un rendimiento y una resiliencia incomparables.

Más información sobre NewEdge
NewEdge
Netskope Cloud Exchange

Cloud Exchange (CE) de Netskope ofrece a sus clientes herramientas de integración eficaces para que saquen partido a su inversión en estrategias de seguridad.

Más información sobre Cloud Exchange
Vídeo de Netskope
  • Servicio de seguridad Productos Edge chevron

    Protéjase contra las amenazas avanzadas y en la nube y salvaguarde los datos en todos los vectores.

  • Borderless SD-WAN chevron

    Proporcione con confianza un acceso seguro y de alto rendimiento a cada usuario remoto, dispositivo, sitio y nube.

  • Secure Access Service Edge chevron

    Netskope One SASE proporciona una solución SASE nativa en la nube, totalmente convergente y de un único proveedor.

La plataforma del futuro es Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG) y Private Access for ZTNA integrados de forma nativa en una única solución para ayudar a todas las empresas en su camino hacia el Servicio de acceso seguro Arquitectura perimetral (SASE).

Todos los productos
Vídeo de Netskope
Next Gen SASE Branch es híbrida: conectada, segura y automatizada

Netskope Next Gen SASE Branch converge Context-Aware SASE Fabric, Zero-Trust Hybrid Security y SkopeAI-Powered Cloud Orchestrator en una oferta de nube unificada, marcando el comienzo de una experiencia de sucursal completamente modernizada para la empresa sin fronteras.

Obtenga más información sobre Next Gen SASE Branch
Personas en la oficina de espacios abiertos.
Diseño de una arquitectura SASE para Dummies

Obtenga un ejemplar gratuito del único manual que necesitará sobre diseño de una arquitectura SASE.

Obtenga el eBook
Cambie a los servicios de seguridad en la nube líderes del mercado con una latencia mínima y una alta fiabilidad.

Más información sobre NewEdge
Lighted highway through mountainside switchbacks
Habilite de forma segura el uso de aplicaciones de IA generativa con control de acceso a aplicaciones, capacitación de usuarios en tiempo real y la mejor protección de datos de su clase.

Descubra cómo aseguramos el uso generativo de IA
Habilite de forma segura ChatGPT y IA generativa
Soluciones de confianza cero para implementaciones de SSE y SASE

Más información sobre Confianza Cero
Boat driving through open sea
Netskope logra la alta autorización FedRAMP

Elija Netskope GovCloud para acelerar la transformación de su agencia.

Más información sobre Netskope GovCloud
Netskope GovCloud
  • Recursos chevron

    Obtenga más información sobre cómo Netskope puede ayudarle a proteger su viaje hacia la nube.

  • Blog chevron

    Descubra cómo Netskope permite la transformación de la seguridad y las redes a través del borde de servicio de seguridad (SSE)

  • Eventos y Talleres chevron

    Manténgase a la vanguardia de las últimas tendencias de seguridad y conéctese con sus pares.

  • Seguridad definida chevron

    Todo lo que necesitas saber en nuestra enciclopedia de ciberseguridad.

Podcast Security Visionaries

How to Use a Magic Quadrant and Other Industry Research
En este episodio, Max Havey, Steve Riley y Mona Faulkner diseccionan el intrincado proceso de creación de un Cuadrante Mágico y por qué es mucho más que un gráfico.

Reproducir el pódcast
Cómo utilizar un podcast de Cuadrante Mágico y otras investigaciones sectoriales
Últimos blogs

Lea cómo Netskope puede hacer posible el viaje hacia la Confianza Cero y SASE a través de las capacidades del borde de servicio de seguridad (SSE).

Lea el blog
Sunrise and cloudy sky
SASE Week 2023: ¡Su viaje SASE comienza ahora!

Sesiones de repetición de la cuarta SASE Week.

Explorar sesiones
SASE Week 2023
¿Qué es Security Service Edge (SSE)?

Explore el lado de la seguridad de SASE, el futuro de la red y la protección en la nube.

Más información sobre el servicio de seguridad perimetral
Four-way roundabout
  • Empresa chevron

    Le ayudamos a mantenerse a la vanguardia de los desafíos de seguridad de la nube, los datos y la red.

  • Liderazgo chevron

    Nuestro equipo de liderazgo está firmemente comprometido a hacer todo lo necesario para que nuestros clientes tengan éxito.

  • Soluciones para clientes chevron

    Le apoyamos en cada paso del camino, garantizando su éxito con Netskope.

  • Formación y certificación chevron

    La formación de Netskope le ayudará a convertirse en un experto en seguridad en la nube.

Apoyar la sostenibilidad a través de la seguridad de los datos

Netskope se enorgullece de participar en Vision 2045: una iniciativa destinada a crear conciencia sobre el papel de la industria privada en la sostenibilidad.

Descubra más
Apoyando la sustentabilidad a través de la seguridad de los datos
Pensadores, constructores, soñadores, innovadores. Juntos, ofrecemos soluciones de seguridad en la nube de vanguardia para ayudar a nuestros clientes a proteger sus datos y usuarios.

Conozca a nuestro equipo
Group of hikers scaling a snowy mountain
El talentoso y experimentado equipo de servicios profesionales de Netskope proporciona un enfoque prescriptivo para su exitosa implementación.

Más información sobre servicios profesionales
Servicios profesionales de Netskope
Asegure su viaje de transformación digital y aproveche al máximo sus aplicaciones en la nube, web y privadas con la capacitación de Netskope.

Infórmese sobre Capacitaciones y Certificaciones
Group of young professionals working
Publicar miniatura

Esta es la segunda mitad de una discusión en dos partes sobre los principios de la transformación de la seguridad. En esta mitad, Jason y Erick se unen a sus colegas, James Christiansen, vicepresidente de transformación de seguridad en la nube en Netskope, James Robinson, director adjunto de seguridad de la información en Netskope, y Lamont Orange, director de seguridad de la información en Netskope. La siguiente discusión y el podcast Security Visionaries son parte del Security Transformation Playbook, un conjunto de nuevos recursos de Netskope y algunos de los líderes más progresistas de la industria que examinan los problemas más importantes de la seguridad en la actualidad.

Para ser un innovador, para ser un líder, debe seguir desafiando el statu quo. Tienes que seguir desafiando los pensamientos de ayer.

—James Christiansen, Vicepresidente de Transformación de Seguridad en la Nube en Netskope
James Christiansen

 

Marcas de tiempo

*(2:05) - Fijando el tema para el 2do
la mitad de la discusión y las presentaciones
*(5:00) - Principio Uno
*(7:29) - Principio Dos
*(10:54) - Principio Tres
*(15:05) - Principio Cuatro
*(18:50) - Principio Cinco
*(21:55) - Principio Seis
*(27:50) - Principio Siete
*(29:34) - Principio Ocho
*(37:16) - Principio Nueve
*(41:09) - Principio Diez

 

Otras formas de escuchar:

verde más

en este episodio

erick rudiak
Vicepresidente sénior y director de tecnología de Northwestern Mutual

chevron

Erick Rudiak

Erick Rudiak es el actual vicepresidente sénior y director de tecnología de Northwestern Mutual. Anteriormente, fue CISO de Express Scripts y Hewitt Associates. Además, Erick es un asesor de confianza para directores ejecutivos, juntas directivas, comités ejecutivos, CIO, CTO, CPO y GC. Con más de veinte años de experiencia liderando equipos técnicos y no técnicos de alto rendimiento, tiene un historial increíblemente sólido de atracción y desarrollo de los mejores talentos para tener éxito en roles ejecutivos.

james cristiansen
Vicepresidente de Transformación de Seguridad en la Nube en Netskope

chevron

James Christiansen

Vicepresidente de Transformación de Seguridad en la Nube de Netskope y líder de la Oficina Principal de Estrategia Global. Se centra en mejorar la comprensión de los clientes globales de Netskope sobre los desafíos y las soluciones de las implementaciones en la nube ayudando a impulsar el liderazgo intelectual en la transformación de la seguridad en la nube.

Naranja Lamont
Director de seguridad de la información

chevron

Lamont Orange

Lamont tiene más de 20 años de experiencia en la industria de la seguridad de la información, habiendo trabajado anteriormente como vicepresidente de seguridad empresarial para Charter Communications (ahora Spectrum) y como director sénior de la división de seguridad y servicios tecnológicos en Ernst & Young. Antes de unirse a Netskope, Lamont fue CISO para Vista Equity Partners/Vista Consulting Group. Fue responsable de la gestión de los programas de ciberseguridad y del desarrollo de talento en ciberseguridad dentro del portafolio de Vista, que incluía a más de 50 empresas. Antes de Vista, Lamont fue Oficial de Seguridad de la Información en Websense. En ese rol, fue responsable de desarrollar, mantener y divulgar el programa de seguridad interna de la empresa. También se encargó de trabajar con clientes existentes y potenciales demostrando la seguridad de las soluciones y la conexión con el ecosistema de seguridad general.

james robinson
CISO adjunto en Netskope

chevron

James Robinson

James es un profesional experimentado con casi 20 años de experiencia en ingeniería, arquitectura y estrategia de seguridad. Desarrolla y ofrece un conjunto completo de servicios y soluciones estratégicas que ayudan a los ejecutivos a cambiar sus estrategias de seguridad a través de la innovación.

jason clark
Director de Estrategia y Marketing de Netskope

chevron

Jason Clark

Jason aporta a Netskope décadas de experiencia en la creación y ejecución de programas de seguridad estratégica de éxito.

Anteriormente fue el director de seguridad y estrategia de Optiv, desarrollando un conjunto completo de soluciones para ayudar a ejecutivos CXO a mejorar sus estrategias de seguridad y acelerar la alineación de esas estrategias con el negocio. Antes de Optiv, Clark desempeñó un papel de liderazgo en Websense, donde fue el impulsor de la transformación de la compañía en un proveedor de tecnología crítica para los responsables principales de seguridad de la información (CISOs). En un puesto anterior como CISO y vicepresidente de infraestructura de Emerson Electric, Clark redujo significativamente el riesgo de la compañía al desarrollar y ejecutar un exitoso programa de seguridad para 140.000 empleados en 1.500 localidades. Anteriormente fue CISO para The New York Times, y ha ocupado cargos técnicos y de liderazgo en seguridad en EverBank, BB&T y el Ejército de los Estados Unidos.

Erick Rudiak

Erick Rudiak es el actual vicepresidente sénior y director de tecnología de Northwestern Mutual. Anteriormente, fue CISO de Express Scripts y Hewitt Associates. Además, Erick es un asesor de confianza para directores ejecutivos, juntas directivas, comités ejecutivos, CIO, CTO, CPO y GC. Con más de veinte años de experiencia liderando equipos técnicos y no técnicos de alto rendimiento, tiene un historial increíblemente sólido de atracción y desarrollo de los mejores talentos para tener éxito en roles ejecutivos.

James Christiansen

Vicepresidente de Transformación de Seguridad en la Nube de Netskope y líder de la Oficina Principal de Estrategia Global. Se centra en mejorar la comprensión de los clientes globales de Netskope sobre los desafíos y las soluciones de las implementaciones en la nube ayudando a impulsar el liderazgo intelectual en la transformación de la seguridad en la nube.

Lamont Orange

Lamont tiene más de 20 años de experiencia en la industria de la seguridad de la información, habiendo trabajado anteriormente como vicepresidente de seguridad empresarial para Charter Communications (ahora Spectrum) y como director sénior de la división de seguridad y servicios tecnológicos en Ernst & Young. Antes de unirse a Netskope, Lamont fue CISO para Vista Equity Partners/Vista Consulting Group. Fue responsable de la gestión de los programas de ciberseguridad y del desarrollo de talento en ciberseguridad dentro del portafolio de Vista, que incluía a más de 50 empresas. Antes de Vista, Lamont fue Oficial de Seguridad de la Información en Websense. En ese rol, fue responsable de desarrollar, mantener y divulgar el programa de seguridad interna de la empresa. También se encargó de trabajar con clientes existentes y potenciales demostrando la seguridad de las soluciones y la conexión con el ecosistema de seguridad general.

James Robinson

James es un profesional experimentado con casi 20 años de experiencia en ingeniería, arquitectura y estrategia de seguridad. Desarrolla y ofrece un conjunto completo de servicios y soluciones estratégicas que ayudan a los ejecutivos a cambiar sus estrategias de seguridad a través de la innovación.

Jason Clark

Jason aporta a Netskope décadas de experiencia en la creación y ejecución de programas de seguridad estratégica de éxito.

Anteriormente fue el director de seguridad y estrategia de Optiv, desarrollando un conjunto completo de soluciones para ayudar a ejecutivos CXO a mejorar sus estrategias de seguridad y acelerar la alineación de esas estrategias con el negocio. Antes de Optiv, Clark desempeñó un papel de liderazgo en Websense, donde fue el impulsor de la transformación de la compañía en un proveedor de tecnología crítica para los responsables principales de seguridad de la información (CISOs). En un puesto anterior como CISO y vicepresidente de infraestructura de Emerson Electric, Clark redujo significativamente el riesgo de la compañía al desarrollar y ejecutar un exitoso programa de seguridad para 140.000 empleados en 1.500 localidades. Anteriormente fue CISO para The New York Times, y ha ocupado cargos técnicos y de liderazgo en seguridad en EverBank, BB&T y el Ejército de los Estados Unidos.

Transcripción del episodio

Abierto para transcripción

[00:00:00] James Christiansen: I mean, I think you have to be an innovator to be a leader. You have to keep challenging the status quo. You have to keep challenging yesterday's thoughts. That's what we really did when we sat down as a team started listening to our colleagues and taking that input along with their own cost to really develop out these principles, challenging the way we've been doing things and really thinking about, how does this digitalization is changing us and our organization.

[00:00:34] Producer:Hello, and welcome to security visionaries hosted by Jason Clark, chief security officer and chief strategy officer at Netskope. You just heard from James Christianson, the vice president, chief information security officer at Netskope on this show. You'll hear from world-class practitioners and thought leaders like James on how they stay on top of the game in networking and cloud security. You're about to listen to the second half of a two-part discussion on the principles of security transformation. In this half, Jason and Erick are joined by colleagues, James Christianson, the Vice President, Chief Information Security Officer at Netskope. James Robinson, deputy chief information security officer at Netskope and Lamont Orange, Chief Information Security Officer at Netskope. The following discussion and the security visionaries podcast are part of the security transformation playbook, a set of new resources from Netskope and some of the industry's most forward thinking leaders examining the most important issues in security today, before we dive in, here's a brief word from our sponsors.

[00:01:38] Sponsor: The Security Visionaries podcast is powered by the team at Netskope. Netskope is the SASE leader. Offering everything you need to provide a fast data centric and cloud smart user experience at the speed of business today. Learn more at netskope.com

[00:01:57] Producer: without further ado, please enjoy episode two of security visionaries with your host, Jason Clark.

[00:02:05] Jason Clark: In the last episode, Erick and I talked about the genesis for the security transformation project and explained that there are several principles for the future that we should work on, right. 10 principles that we're going to do a deep dive on specifically today. And so I'm joined first by Erick, Rudiak, Erick, how are you?

[00:02:24] Erickk Rudiak: Hi Jason. Glad to be back. Thank you so much for having me on.

[00:02:29] Jason Clark: Happy to have you. And Lamont Orange.

[00:02:31] Lamont Orange: Hey Jason, thanks for having me on the show. I look forward to the conversation.

[00:02:36] Jason Clark: And James Robinson.

James Robinson: Hey, happy to be here. Thanks.

Jason Clark: And James Christiansen.

James Christiansen: Let’s rock and roll!

Jason Clark: So guys, welcome. Welcome to the conversation. How you guys doing? Are you ready?

James Robinson: I'm ready. Let's do it.

Jason Clark: Awesome. Lamont, I know that you, uh, this morning had to, uh, you already were on stage on a panel conversation. You had to race to this conversation. So thank you for that, but it's gonna, it's probably easy and nice to do back to back.

[00:03:06] Lamont Orange: Definitely. So my pleasure.

[00:03:09] Jason Clark: So we altogether, you know, over the last couple of years had worked on. Really with the industry, right. Spending time on, you know, hundreds of, of round table dinners and, and workshops and, you know, surveys and one-on-one conversations, right. Trying to collect. What is the future of security look like? And in this new world, Kind of digital transformation is just happening period. Right. For every organization. And security is kind of in this upside down world where we're trying to, you know, security teams are being stretched beyond belief. Right. And, and trying to keep up. So how are they going to be able to perform and gain leverage. In this new model, right? Cause they're obviously stressed and, um, they're looking at the legacy technology architectures and, and in the end, kind of these, these past ways that we've done stuff for the last 25 years, that we've all been working in this industry or more, we spent time together on 10 principles for the future. Right. And then obviously the rest of the security transformation playbook as part of, what does, if I need to get to by 20, 25 and beyond. So, you know, all of you have helped tremendous amount in this, right? And so just look for each of you to, to give, you know, your context to each principle, as we talk to them and experiences that you've had in these conversations, when these, you know, I'd say over, gosh, probably well over a thousand CISOs and CIO conversations that we. On this. Right. But also in your experiences as CISOs in any, you know, past lives as, as operating other organizations, as CISOs write about the past, moving to the future. So with that, you know, I'm going to start off with the principle one, right? Principle one is challenge all your existing principals, right? So what, what principles do you believe needs to be challenged from the past?

[00:05:04] James Christiansen: Yeah, you know, I really am. I always challenge everything. I think every day. I mean, I think you have to be an innovator to be a leader. You have to keep challenging status quo. You have to keep challenging yesterday's thoughts. And I think that's what we really did when we sat down. And as a team started listening to our colleagues and taking that input along with our own thoughts to really develop out these principles, it was really about challenging status quo. It's about challenging the way we've been doing things and really thinking about how business digitalization is changing us and our organizations, and certainly the, the quick movement to work from anywhere and what that's doing to the things we have to do as we look for.

[00:05:51] Jason Clark: What about the principle of, if it's not broke, don't fix it.

[00:05:54] James Christiansen: Yeah. I don't know. I've always been really good at breaking things, so I'm not the right guy to ask.

[00:06:00] Lamont Orange: And when you look at digital transformation, honestly, you're probably sanded. It's already broken. From how you want to move the organization forward so that, that you have to say that it is broken already, and it does need fixing because we're still having an escalated amount of attacks from attackers. They’re still being successful and are being successful at a high velocity rate. So we must come back to, it's already broken. Now it's how do we plant a seed and move forward?

[00:06:32] Jason Clark: So James, you’re a product security and application, you know, expert. And in my view, right, you've been doing it for a very long time for very large organizations. Well, how are the principals changed? From an app sec or product security or software pipeline standpoint.

[00:06:50] James Robinson: Yeah, one, the one that came to mind that, uh, I think it also got looped into a different principle was that trust, but verify that was one that for a long, long, long time we relied on the all through out the product security AppSec domain. And I think that now that really gets challenged a lot. That's one that was actually a very comfortable principle. Um, and one that, that I've relied on for many, many years that now it just totally gets broken, totally gets challenged and know that there's a lot of conversations about zero trust principles and it having its own. But it's really the zero trust architectures

[00:07:24] Jason Clark: That’s a good point. Trust, but verify has changed into zero trust. Right? That's that's a very good point. So principle two. Stop buying black box solutions and buy open and integrated. So I'd like to kind of say that in general vendors have bought a lot or technology companies, right, they’ve bought a lot of companies and integrated them, or they claim to integrate them. But generally the integration is a price list and the sales person selling to you. So overall, what's your guys' view on how the, how the industry needs to change in the way that we procure technologies?

[00:07:59] James Robinson: I'm jumping on this one first, because this, this was actually one that I saw that I've been talking internally a lot with Lamont about. Um, and it's that idea. I love the idea of open, you know, open NDR, open XDR, open cloud. Yeah, those, those types of things, we have to be able to, you know, make that almost requirement number one. In many ways, you know, we know the sum of many things is better than the sum of One, if you buy the black box, that's what you're getting is that sum of one, or maybe a sum of a few, um, and you have to, you know, build that intelligence by being open. That's really where it comes into. I'm a huge believer you'll out of, uh, out of some of them, you know, I know we've only talked about two, but right now this one is a probably ranked higher for me then principle one that we, that we talked about with challenge, everything, right? This one is, you know, this one is, is core. I think for us to be able to succeed with the future,

[00:08:54] James Christiansen: You know, I'm Jason I've bought best of breed products a lot through my career. You know, we, we very much went after with, uh, very aggressive companies like these, uh, that I was working for, you know, but today's world, you know, I have to look at best of breed platforms. I just can't afford the manpower it takes to manage all these different solutions. And the complexity it's brought to the organization, you know, just leads to human errors, leads to patches, not getting applied versions, not getting updated. So I've really had to move away and my thought process away from best of breed and started looking at best of breed platforms. Now, what can give me the best tightest integration, like you said, in your opening conversation, it can't be somebody with a lot of skew numbers, it has to be a truly integrated platform to solve the real problems.

[00:09:50] Jason Clark: So Erick, any thoughts from you on open and integrated? Why every solution we buy from this point forward, it should be more part of the ecosystem versus being the black boxes of kind of that we procured in the past.

[00:10:03] Erick Rudiak: Yeah. Great question, Jason. So like when I think about open and integrated and why it's so important, our systems are so interconnected. If there's no API to create visibility, like the complexity and interconnectedness of our systems kind of demands that signal from one defensive system, uh, be available to others so that they can orchestrate a response nearest to where the attacker is, and also so that a coherent user experience results. Um, and it becomes very, you know, both, uh, difficult for defenders to manage that. And candidly creates a drain and demands a level of complexity to weave those systems together that open an integrated, uh, is just a superior pattern for them.

[00:10:51] Jason Clark: Brilliant answer. Love it. So principle three is focused on foundational technologies that integrate with your entire security ecosystem. So I'll start with Lamont, you know, you've had the opportunity to build a Greenfield security program. What does that, you know, when, when you look at that right. What was the first stack that you built? What were the five core kind of foundational technologies that were part of this Greenfield infrastructure?

[00:11:16] Lamont Orange: So I think that's a very important question because when you talk about the transformation that security must go through you, you have to look at it. Not only from what tools are in my stack, but it's what capabilities we want and make that more aligned to the outcome. So I'd say the first capability That I wanted. It is around visibility. I had to see what was happening and order to affect the risk level of the organization and be able to put controls around that and tools that help you to understand what is happening would, would be a tool that looks at your usage of even legacy applications, as well as SaaS, IaaS, and PaaS technologies, you also have to take into consideration your identities. Many companies are struggling with identity as they have several IDPs. They have several managers of those identities, whether they are production systems or, uh, corporate systems. And what you want to do is have some sort of governance around it. So identity was one of the other areas that I focused on. And then you look at data protection. Well, we're all in it to protect our data. That is the crown jewel for the bad actor. We have to understand what valuable data we have and what data we like to protect. And then you look at where is that going? So you want to understand the data protection from the user to app to end point. So you have to have back to a comment that James Robinson made about being open with XDR NDR and whatever we put in front of. That DR capability, you have to have that understanding around the configuration of that device and even the organizations that may be using that data. And then there's one other capability that I think is very important to help organizations scale. Uh, when they're looking at a Greenfield, you need something that's going to manage your configuration automation and orchestration. And I think those are solutions that can be kept in one, one area, but they need to have the following those three capabilities in order to be effective.

[00:13:29] Jason Clark: Erick, on, on this, uh, principle around kind of foundational technologies. You know, landed in the other organizations. And now as a CTO, what would any thoughts on this one from an ecosystem standpoint around security,

[00:13:43] Erick Rudiak: There's a couple of things. So identity is one. Um, and you know, I think about that in terms of kind of the various levels of assertions that people in systems can make about who the human is at the other end of the line or who the system is that another system is working with. So that it kind of encompasses everything from multi-factor to kind of directory services, like that's absolutely vital to get right. I agree with Lamont, uh, that having data protection, having visibility into kind of data at rest and data in motion. Is another, and then, uh, it nowadays it's not particularly exciting, but the, kind of the very basics of encryption and configuration management and, you know, in thinking about configuration management, kind of incorporating both, uh, kind of config drift golden builds, you know, system hardening as well as, uh, vulnerability management, which I consider an instance of that class. Kind of pulling that all together. Those are among the first places that I have looked myself for, the kind of assurance that the basic blocking and tackling that the outrage factor of, uh, getting those wrong is managed and minimized for any organization that I’m part of.

[00:15:04] Jason Clark: Okay. So principle four only buy cloud powered new technologies. Right? So essentially everything you buy should be cloud power to cloud enabled or cloud born. You know, there's a Gartner paper. That's. The future of security is in the cloud, as we were doing this tour, there was a, a sentence said that, you know, cloud is the perfect reset for security programs, right? Because you get to kind of start fresh and do things, right. What do you, when you, so overall for all of you, what curious what you all think about this, this principle and, and why we wrote it.

[00:15:34] James Robinson: I think the principle is good. I think for us to take advantage of and, and to meet, you know, one of the things that we say internally is meet your customer, where they're at, you know, if the customer is, is in the cloud or they're moving to the cloud, right, which is even better to be where they're going to be, you have to adopt this principle. It has to be a foundational component for anything that you're looking at. ou know? And, and if it's, you know, cloud assisted, you may look at it. For instance, cloud assisted EDR. Okay, get it right. It's got to have something on the end point. It can't just all be cloud, but you know, for, for anything that's on the network stack for anything that's in the application stack server stack, um, you know, anywhere in between, you know, it definitely has to, has to carry with this principle.

[00:16:17] James Christiansen: You know, uh, Jason, this is the third major transformation I've been through it in my career and, and, um, technology and security versus movement from mainframes to client server. Then from client server to cloud enabled system. And now with business Digitas, digitalization, you know, we see these transformations and I think, you know, the further you resist them and don't recognize them the further you drop behind. So as you start thinking about cloud and cloud enablement, I talked to many CISOs every year, I mean, three or four hundred. And when we talk about what their plans are, where they see as SASE came out or are now secure service edge, And you start looking at definitions. When I start working with an organization and start looking where they're at, they're already somewhere down the path. They may be further in the maybe far, uh, ladder down, but they're, they're already on that path, which just, it just says we're the most common security folks recognize this is the pattern to go to. This is the direction. The only new investments I see are really just renewables. Cause they, they can't get moved off quick enough to the new cloud enabled, uh, technologies. But I think, you know, from a people process and technology perspective, all three it's about training our people on how to work in these cloud technologies. It's building out the processes that support those and the things, and finally implementing the technology, to enable those people and enable those process to provide the level of controls we need nowadays. But certainly the business is going there. We've seen the acceleration of that movement in the business and us as security professionals.

[00:17:59] Jason Clark: I mean in the end, isn't it, every bit as businesses going there and therefore your security needs to be where the data is and where the businesses. And also whenever you have a mobile workforce, you need to leverage the cloud to be able to secure that workforce because you can't just do it from your data center, right? Like in its simplest form, you just changing a leverage point in your scale.

[00:18:18] James Robinson: I love what James said, because when you talked about, you know, moving from, you know, from mainframe to client server, you know, we saw that major shift. If anyone's part of it, I definitely saw it and was part of it as well. And watching that happen, I could not imagine if you didn't make that shift, or if you did make that shift and you still tried to maintain, remember how hard it was to maintain in client server, those controls that you had and, and deliver those via the mainframe. It was almost impossible to do. In fact, it was impossible, which is why everyone's shifted and you saw the market change.

[00:18:49] Jason Clark: So the next one is principle five and. It potentially has more weight than many of the others. It is protect business data with security controls that follow the data everywhere. Right. So, which essentially to me is, you know, this is, this is the grand strategy of security it's for many companies or organizations why security exists. Right. It's just protecting the information. So, you know, maybe let's talk a little bit about, we named this a principle for a reason, right. Because I think we felt that people were historically not mature enough in data protection. So, Erick, what's your thoughts around kind of why we established this as a principle and in how people need to transform from a, how they look at data security or data protection?

[00:19:34] Erick Rudiak: Yeah, I think there's two elements to this one, Jason, like one way to look at it is the security industry has had a history of negotiating against itself. On controls like this of saying, oh, well, this data used to be in our, you know, in our data center, um, you know, protected by perimeter controls, but we want to move it into the cloud and, you know, the cloud just doesn't have quite the same thing, but boy, the cloud is so compelling, so we accept less. Um, and so, uh, one way to look at this principle and they're not mutually exclude. Is never accept less like don't compromise on, you know, uh, on this kind of very basic idea that no matter where your data goes, Your controls matter, um, because they certainly, uh, the, you know, the attacker doesn't look at the world that way. And so that is part of the cost of doing business. That's part of the economics of, uh, you know, of handling sensitive data. And so the obligation to the person whose data you're, uh, you're trafficking in doesn't change. If you've allowed the data to move from one environment to another. I think another way to look at this one is that it's immensely aspirational. So I think any of us who have done threat modeling, we'll look at that guiding principle and say, oh, Jason, uh, Surely, uh, surely you can't protect the data when I do this to it when I use steganography or when I use covert channels or when I, you know, when I take advantage of, you know, pick your favorite row and column out of the MITRE attack framework. Um, and I think aspirationally, it's a challenge to us to say no to say. Uh, we are going to put controls in place that kind of reaffirm our obligations as custodians, that wherever the data goes, we are going to know about it. We're going to assert our controls, that you know, that the attacker doesn't get to win by using these common patterns.

[00:21:42] Jason Clark: Yeah. It's um, it's, uh, you know, fair. If we can get the controls to follow the user and the data that is Nirvana, especially whenever we don't have to invest heavily to do it, but love. Principle six, prioritize your business and risk reward when making security strategy right. Or decisions. Right. And building your tactics, et cetera. Right. So essentially as the business constantly changed, right. So it's always a constant trade off and we need to be in tuned to the business to be able to make that decision. Right. But enable them. And I love, you know, the saying. This isn't about eliminating friction, right? It's the right amount of friction to the business. So curious, what, what, uh, each of you, James, maybe we'll start with you, uh, Christiansen on, you know, your thoughts on, on that principle.

[00:22:29] James Christiansen: Yeah. This, this one for me is an important one because more successful CISOs. They're not focused on stopping data protected. They're focused on enabling the business and they understand the role of enabling the business to find that right balance between risk and reward. Right. And can't get too far skewed on either side or you're not, you're not doing the company and the stockholder value. You've got to live up to your role, but it's about enabling the business. And when I think about this in, in terms of change and how fast things change. I really think about, you know, the seven forces that are on a security strategy and these forces are really something you should be looking at because they're constantly changing. And as they change, you should be in tune with that change and think about how has that affect my stress. Has that really make a difference in what I was planning to do versus what I should do now. And the seven forces, we put out a white paper on it recently that I would encourage you to go read, but it seems like the culture of the company, a merger and acquisition might change. The culture might change in many ways. So how does that change the way you're looking at the economy and economic forces, government forces, conflicts, things that aren't directly related, but have these impacts on your overall security strategy. And as they change, you need to be agile as an organization. You need to be able to shift quickly and shift effectively to stay up with the business, because remember where we start