Netskope est nommé un leader du Gartner® Magic Quadrant™ 2024 pour le Security Service Edge. Recevoir le rapport

fermer
fermer
  • Pourquoi Netskope signe chevron

    Changer la façon dont le réseau et la sécurité fonctionnent ensemble.

  • Nos clients signe chevron

    Netskope sert plus de 3 000 clients dans le monde entier, dont plus de 25 entreprises du classement Fortune 100

  • Nos partenaires signe chevron

    Nous collaborons avec des leaders de la sécurité pour vous aider à sécuriser votre transition vers le cloud.

La Capacité d'Exécution la plus élevée, une fois de plus.
La Vision la plus complète, une fois de plus.

Découvrez pourquoi le Magic Quadrant™ 2024 de Gartner® a désigné Netskope comme leader pour la sécurité en périphérie des services pour la troisième année consécutive.

Recevoir le rapport
Netskope nommé leader dans le Magic Quadrant™ 2024 de Gartner® pour le graphique de la périphérie des services de sécurité
Nous parons nos clients à l'avenir, quel qu'il soit

Voir nos clients
Woman smiling with glasses looking out window
La stratégie de commercialisation de Netskope privilégie ses partenaires, ce qui leur permet de maximiser leur croissance et leur rentabilité, tout en transformant la sécurité des entreprises.

En savoir plus sur les partenaires de Netskope
Group of diverse young professionals smiling
Votre réseau de demain

Planifiez votre chemin vers un réseau plus rapide, plus sûr et plus résilient, conçu pour les applications et les utilisateurs que vous prenez en charge.

Obtenir le livre blanc
Votre réseau de demain
Présentation de la plate-forme Netskope One

Netskope One est une plate-forme cloud native qui offre des services de sécurité et de mise en réseau convergents pour faciliter votre transformation SASE et Zero Trust.

En savoir plus sur Netskope One
Abstrait avec éclairage bleu
Adopter une architecture SASE (Secure Access Service Edge)

Netskope NewEdge est le nuage privé de sécurité le plus grand et le plus performant au monde. Il offre aux clients une couverture de service, des performances et une résilience inégalées.

Découvrez NewEdge
NewEdge
Netskope Cloud Exchange

Le Netskope Cloud Exchange (CE) fournit aux clients des outils d'intégration puissants pour optimiser les investissements dans l'ensemble de leur infrastructure de sécurité.

En savoir plus sur Cloud Exchange
Vidéo Netskope
La plateforme du futur est Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG), et Private Access for ZTNA intégrés nativement dans une solution unique pour aider chaque entreprise dans son cheminement vers l'architecture Secure Access Service Edge (SASE).

Présentation des produits
Vidéo Netskope
Next Gen SASE Branch est hybride - connectée, sécurisée et automatisée

Netskope Next Gen SASE Branch fait converger Context-Aware SASE Fabric, Zero-Trust Hybrid Security et SkopeAI-Powered Cloud Orchestrator dans une offre cloud unifiée, ouvrant la voie à une expérience de succursale entièrement modernisée pour l'entreprise sans frontières.

En savoir plus Next Gen SASE Branch
Personnes au bureau de l'espace ouvert
La conception d'une architecture SASE pour les nuls

Obtenez votre exemplaire gratuit du seul guide consacré à la conception d'une architecture SASE dont vous aurez jamais besoin.

Obtenir l'EBook
Optez pour les meilleurs services de sécurité cloud du marché, avec un temps de latence minimum et une fiabilité élevée.

Découvrez NewEdge
Lighted highway through mountainside switchbacks
Permettez en toute sécurité l'utilisation d'applications d'IA générative grâce au contrôle d'accès aux applications, à l'accompagnement des utilisateurs en temps réel et à une protection des données de premier ordre.

Découvrez comment nous sécurisons l'utilisation de l'IA générative
Autorisez ChatGPT et l’IA générative en toute sécurité
Solutions Zero Trust pour les déploiements du SSE et du SASE

En savoir plus sur la confiance zéro
Boat driving through open sea
Netskope obtient l'autorisation FedRAMP High Authorization

Choisissez Netskope GovCloud pour accélérer la transformation de votre agence.

En savoir plus sur Netskope GovCloud
Netskope GovCloud
  • Ressources signe chevron

    Découvrez comment Netskope peut vous aider à sécuriser votre migration vers le Cloud.

  • Blog signe chevron

    Découvrez comment Netskope permet la transformation de la sécurité et de la mise en réseau grâce à la périphérie des services de sécurité (SSE)

  • Événements et ateliers signe chevron

    Restez à l'affût des dernières tendances en matière de sécurité et créez des liens avec vos pairs.

  • Définition de la sécurité signe chevron

    Tout ce que vous devez savoir dans notre encyclopédie de la cybersécurité.

Podcast Security Visionaries

Becoming a Non-executive Director
In this episode host Emily Wearmouth welcomes guests Richard Starnes, CISO of Six Degrees, and Homaira Akbari, President and CEO of AKnowledge Partners, for a conversation about the role of a non-executive director (NED).

Écouter le podcast
Podcast Devenir un administrateur non exécutif
Derniers blogs

Découvrez comment Netskope peut faciliter la transition vers le Zero Trust et le SASE grâce aux fonctionnalités de sécurité en périphérie des services (SSE).

Lire le blog
Sunrise and cloudy sky
SASE Week 2023 : Votre voyage SASE commence maintenant !

Retrouvez les sessions de la quatrième édition annuelle de SASE Week.

Explorer les sessions
SASE Week 2023
Qu'est-ce que le Security Service Edge ?

Découvrez le côté sécurité de SASE, l'avenir du réseau et de la protection dans le cloud.

En savoir plus sur Security Service Edge
Four-way roundabout
  • Entreprise signe chevron

    Nous vous aidons à conserver une longueur d'avance sur les défis posés par le cloud, les données et les réseaux en matière de sécurité.

  • Équipe de direction signe chevron

    Nos dirigeants sont déterminés à faciliter la réussite de nos clients.

  • Solutions pour les clients signe chevron

    Nous sommes là pour vous et avec vous à chaque étape, pour assurer votre succès avec Netskope.

  • Formation et certification signe chevron

    Avec Netskope, devenez un expert de la sécurité du cloud.

Soutenir le développement durable par la sécurité des données

Netskope est fière de participer à Vision 2045 : une initiative visant à sensibiliser au rôle de l'industrie privée dans le développement durable.

En savoir plus
Soutenir le développement durable grâce à la sécurité des données
Penseurs, concepteurs, rêveurs, innovateurs. Ensemble, nous fournissons le nec plus ultra des solutions de sécurité cloud afin d'aider nos clients à protéger leurs données et leurs collaborateurs.

Rencontrez notre équipe
Group of hikers scaling a snowy mountain
L’équipe de services professionnels talentueuse et expérimentée de Netskope propose une approche prescriptive pour une mise en œuvre réussie.

En savoir plus sur les services professionnels
Services professionnels Netskope
Sécurisez votre parcours de transformation numérique et tirez le meilleur parti de vos applications cloud, Web et privées grâce à la formation Netskope.

En savoir plus sur les formations et les certifications
Group of young professionals working
Vignette du message

Ceci est la deuxième partie d'une discussion en deux parties sur les principes de la transformation de la sécurité. Dans cette partie, Jason et Erick sont rejoints par leurs collègues James Christiansen, vice-président de la transformation de la sécurité du cloud chez Netskope, James Robinson, directeur adjoint de la sécurité de l'information chez Netskope, et Lamont Orange, directeur de la sécurité de l'information chez Netskope. La discussion qui suit, ainsi que le podcast Security Visionaries, font partie du Security Transformation Playbook, un ensemble de nouvelles ressources de Netskope et de certains des leaders les plus avant-gardistes du secteur, qui examinent les questions les plus importantes en matière de sécurité aujourd'hui.

Pour être un innovateur, pour être un leader, vous devez constamment remettre en question le statu quo. Vous devez continuer à remettre en question les idées d'hier

James Christiansen, vice-président de la transformation de la sécurité dans le nuage chez Netskope
James Christiansen

 

Horodatage

*(2:05) - Définition du thème de la deuxième partie de la discussion
moitié de la discussion & introductions
*(5:00) - Premier principe
*(7:29) - Deuxième principe
*(10:54) - Troisième principe
*(15:05) - Quatrième principe
*(18:50) - Cinquième principe
*(21:55) - Sixième principe
*(27:50) - Principe sept
*(29:34) - Principe huit
*(37:16) - Principe neuf
*(41:09) - Principe dix

 

Autres façons d'écouter :

vert plus

Dans cet épisode

Erick Rudiak
SVP et Chief Technology Officer de Northwestern Mutual

signe chevron

Erick Rudiak

Erick Rudiak est actuellement SVP et Chief Technology Officer de Northwestern Mutual. Auparavant, il a été RSSI pour Express Scripts et Hewitt Associates. Erick est également un conseiller de confiance pour les PDG, les conseils d'administration, les comités exécutifs, les CIO, les CTO, les CPO et les GC. Avec plus de vingt ans d'expérience à la tête d'équipes techniques et non techniques très performantes, il possède une expérience incroyablement solide pour attirer et développer les meilleurs talents afin qu'ils réussissent à occuper des postes de direction.

James Christiansen
Vice-président de la transformation de la sécurité dans le nuage chez Netskope

signe chevron

James Christiansen

Vice-président de Netskope chargé de la transformation de la sécurité dans le nuage et chef du Global Chief Strategy Office. Il s'attache à aider les clients internationaux de Netskope à comprendre les défis et les solutions des déploiements dans le nuage, en contribuant à la réflexion sur la transformation de la sécurité dans le nuage.

Lamont Orange
Responsable de la sécurité de l'information

signe chevron

Lamont Orange

Lamont a plus de 20 ans d'expérience dans le secteur de la sécurité de l'information, ayant précédemment occupé le poste de VP de la sécurité d'entreprise chez Charter Communications (aujourd'hui Spectrum) et celui de directeur principal des services de sécurité et de technologie chez Ernst & Young. Avant de rejoindre Netskope, Lamont était directeur des systèmes d'information pour Vista Equity Partners/Vista Consulting Group. Il était responsable de la gestion des programmes de cybersécurité et du développement des talents dans la matière au sein du portefeuille de Vista, qui comptait plus de 50 entreprises. Avant de rejoindre Vista, Lamont était RSSI chez Websense. Dans le cadre de ce poste, il était responsable du développement, du maintien et de la socialisation du programme de sécurité interne de l'entreprise.  Il était également chargé de travailler avec les clients et prospects en leur expliquant la sécurité des solutions et leur lien avec l'écosystème de sécurité global.

James Robinson
RSSI adjoint chez Netskope

signe chevron

James Robinson

James est un professionnel chevronné qui possède près de 20 ans d'expérience dans les domaines de l'ingénierie, de l'architecture et de la stratégie de sécurité. Il développe et fournit une gamme complète de services et de solutions stratégiques qui aident les dirigeants à modifier leurs stratégies de sécurité grâce à l'innovation.

Jason Clark
Directeur de la stratégie et du marketing chez Netskope

signe chevron

Jason Clark

Jason apporte à Netskope des dizaines d'années d'expérience dans l'élaboration et l'exécution de programmes de sécurité stratégiques réussis.

Auparavant, il était directeur de la sécurité et de la stratégie chez Optiv, où il a développé une gamme complète de solutions pour aider les dirigeants à améliorer leurs stratégies de sécurité et à accélérer l'alignement de ces stratégies sur les activités de l'entreprise. Avant de rejoindre Optiv, M. Clark a occupé un poste de direction chez Websense, où il a joué un rôle moteur dans la transformation de l'entreprise en fournisseur de technologies essentielles pour les responsables de la sécurité de l'information (CISO). Auparavant, en tant que RSSI et vice-président de l'infrastructure d'Emerson Electric, M. Clark a considérablement réduit les risques de l'entreprise en élaborant et en mettant en œuvre un programme de sécurité efficace pour 140 000 employés répartis sur 1 500 sites. Il était auparavant RSSI pour le New York Times et a occupé des fonctions techniques et de direction dans le domaine de la sécurité chez EverBank, BB&T et l'armée américaine.

Erick Rudiak

Erick Rudiak est actuellement SVP et Chief Technology Officer de Northwestern Mutual. Auparavant, il a été RSSI pour Express Scripts et Hewitt Associates. Erick est également un conseiller de confiance pour les PDG, les conseils d'administration, les comités exécutifs, les CIO, les CTO, les CPO et les GC. Avec plus de vingt ans d'expérience à la tête d'équipes techniques et non techniques très performantes, il possède une expérience incroyablement solide pour attirer et développer les meilleurs talents afin qu'ils réussissent à occuper des postes de direction.

James Christiansen

Vice-président de Netskope chargé de la transformation de la sécurité dans le nuage et chef du Global Chief Strategy Office. Il s'attache à aider les clients internationaux de Netskope à comprendre les défis et les solutions des déploiements dans le nuage, en contribuant à la réflexion sur la transformation de la sécurité dans le nuage.

Lamont Orange

Lamont a plus de 20 ans d'expérience dans le secteur de la sécurité de l'information, ayant précédemment occupé le poste de VP de la sécurité d'entreprise chez Charter Communications (aujourd'hui Spectrum) et celui de directeur principal des services de sécurité et de technologie chez Ernst & Young. Avant de rejoindre Netskope, Lamont était directeur des systèmes d'information pour Vista Equity Partners/Vista Consulting Group. Il était responsable de la gestion des programmes de cybersécurité et du développement des talents dans la matière au sein du portefeuille de Vista, qui comptait plus de 50 entreprises. Avant de rejoindre Vista, Lamont était RSSI chez Websense. Dans le cadre de ce poste, il était responsable du développement, du maintien et de la socialisation du programme de sécurité interne de l'entreprise.  Il était également chargé de travailler avec les clients et prospects en leur expliquant la sécurité des solutions et leur lien avec l'écosystème de sécurité global.

James Robinson

James est un professionnel chevronné qui possède près de 20 ans d'expérience dans les domaines de l'ingénierie, de l'architecture et de la stratégie de sécurité. Il développe et fournit une gamme complète de services et de solutions stratégiques qui aident les dirigeants à modifier leurs stratégies de sécurité grâce à l'innovation.

Jason Clark

Jason apporte à Netskope des dizaines d'années d'expérience dans l'élaboration et l'exécution de programmes de sécurité stratégiques réussis.

Auparavant, il était directeur de la sécurité et de la stratégie chez Optiv, où il a développé une gamme complète de solutions pour aider les dirigeants à améliorer leurs stratégies de sécurité et à accélérer l'alignement de ces stratégies sur les activités de l'entreprise. Avant de rejoindre Optiv, M. Clark a occupé un poste de direction chez Websense, où il a joué un rôle moteur dans la transformation de l'entreprise en fournisseur de technologies essentielles pour les responsables de la sécurité de l'information (CISO). Auparavant, en tant que RSSI et vice-président de l'infrastructure d'Emerson Electric, M. Clark a considérablement réduit les risques de l'entreprise en élaborant et en mettant en œuvre un programme de sécurité efficace pour 140 000 employés répartis sur 1 500 sites. Il était auparavant RSSI pour le New York Times et a occupé des fonctions techniques et de direction dans le domaine de la sécurité chez EverBank, BB&T et l'armée américaine.

Transcription de l'épisode

Ouvert à la transcription

[00:00:00] James Christiansen: I mean, I think you have to be an innovator to be a leader. You have to keep challenging the status quo. You have to keep challenging yesterday's thoughts. That's what we really did when we sat down as a team started listening to our colleagues and taking that input along with their own cost to really develop out these principles, challenging the way we've been doing things and really thinking about, how does this digitalization is changing us and our organization.

[00:00:34] Producer:Hello, and welcome to security visionaries hosted by Jason Clark, chief security officer and chief strategy officer at Netskope. You just heard from James Christianson, the vice president, chief information security officer at Netskope on this show. You'll hear from world-class practitioners and thought leaders like James on how they stay on top of the game in networking and cloud security. You're about to listen to the second half of a two-part discussion on the principles of security transformation. In this half, Jason and Erick are joined by colleagues, James Christianson, the Vice President, Chief Information Security Officer at Netskope. James Robinson, deputy chief information security officer at Netskope and Lamont Orange, Chief Information Security Officer at Netskope. The following discussion and the security visionaries podcast are part of the security transformation playbook, a set of new resources from Netskope and some of the industry's most forward thinking leaders examining the most important issues in security today, before we dive in, here's a brief word from our sponsors.

[00:01:38] Sponsor: The Security Visionaries podcast is powered by the team at Netskope. Netskope is the SASE leader. Offering everything you need to provide a fast data centric and cloud smart user experience at the speed of business today. Learn more at netskope.com

[00:01:57] Producer: without further ado, please enjoy episode two of security visionaries with your host, Jason Clark.

[00:02:05] Jason Clark: In the last episode, Erick and I talked about the genesis for the security transformation project and explained that there are several principles for the future that we should work on, right. 10 principles that we're going to do a deep dive on specifically today. And so I'm joined first by Erick, Rudiak, Erick, how are you?

[00:02:24] Erickk Rudiak: Hi Jason. Glad to be back. Thank you so much for having me on.

[00:02:29] Jason Clark: Happy to have you. And Lamont Orange.

[00:02:31] Lamont Orange: Hey Jason, thanks for having me on the show. I look forward to the conversation.

[00:02:36] Jason Clark: And James Robinson.

James Robinson: Hey, happy to be here. Thanks.

Jason Clark: And James Christiansen.

James Christiansen: Let’s rock and roll!

Jason Clark: So guys, welcome. Welcome to the conversation. How you guys doing? Are you ready?

James Robinson: I'm ready. Let's do it.

Jason Clark: Awesome. Lamont, I know that you, uh, this morning had to, uh, you already were on stage on a panel conversation. You had to race to this conversation. So thank you for that, but it's gonna, it's probably easy and nice to do back to back.

[00:03:06] Lamont Orange: Definitely. So my pleasure.

[00:03:09] Jason Clark: So we altogether, you know, over the last couple of years had worked on. Really with the industry, right. Spending time on, you know, hundreds of, of round table dinners and, and workshops and, you know, surveys and one-on-one conversations, right. Trying to collect. What is the future of security look like? And in this new world, Kind of digital transformation is just happening period. Right. For every organization. And security is kind of in this upside down world where we're trying to, you know, security teams are being stretched beyond belief. Right. And, and trying to keep up. So how are they going to be able to perform and gain leverage. In this new model, right? Cause they're obviously stressed and, um, they're looking at the legacy technology architectures and, and in the end, kind of these, these past ways that we've done stuff for the last 25 years, that we've all been working in this industry or more, we spent time together on 10 principles for the future. Right. And then obviously the rest of the security transformation playbook as part of, what does, if I need to get to by 20, 25 and beyond. So, you know, all of you have helped tremendous amount in this, right? And so just look for each of you to, to give, you know, your context to each principle, as we talk to them and experiences that you've had in these conversations, when these, you know, I'd say over, gosh, probably well over a thousand CISOs and CIO conversations that we. On this. Right. But also in your experiences as CISOs in any, you know, past lives as, as operating other organizations, as CISOs write about the past, moving to the future. So with that, you know, I'm going to start off with the principle one, right? Principle one is challenge all your existing principals, right? So what, what principles do you believe needs to be challenged from the past?

[00:05:04] James Christiansen: Yeah, you know, I really am. I always challenge everything. I think every day. I mean, I think you have to be an innovator to be a leader. You have to keep challenging status quo. You have to keep challenging yesterday's thoughts. And I think that's what we really did when we sat down. And as a team started listening to our colleagues and taking that input along with our own thoughts to really develop out these principles, it was really about challenging status quo. It's about challenging the way we've been doing things and really thinking about how business digitalization is changing us and our organizations, and certainly the, the quick movement to work from anywhere and what that's doing to the things we have to do as we look for.

[00:05:51] Jason Clark: What about the principle of, if it's not broke, don't fix it.

[00:05:54] James Christiansen: Yeah. I don't know. I've always been really good at breaking things, so I'm not the right guy to ask.

[00:06:00] Lamont Orange: And when you look at digital transformation, honestly, you're probably sanded. It's already broken. From how you want to move the organization forward so that, that you have to say that it is broken already, and it does need fixing because we're still having an escalated amount of attacks from attackers. They’re still being successful and are being successful at a high velocity rate. So we must come back to, it's already broken. Now it's how do we plant a seed and move forward?

[00:06:32] Jason Clark: So James, you’re a product security and application, you know, expert. And in my view, right, you've been doing it for a very long time for very large organizations. Well, how are the principals changed? From an app sec or product security or software pipeline standpoint.

[00:06:50] James Robinson: Yeah, one, the one that came to mind that, uh, I think it also got looped into a different principle was that trust, but verify that was one that for a long, long, long time we relied on the all through out the product security AppSec domain. And I think that now that really gets challenged a lot. That's one that was actually a very comfortable principle. Um, and one that, that I've relied on for many, many years that now it just totally gets broken, totally gets challenged and know that there's a lot of conversations about zero trust principles and it having its own. But it's really the zero trust architectures

[00:07:24] Jason Clark: That’s a good point. Trust, but verify has changed into zero trust. Right? That's that's a very good point. So principle two. Stop buying black box solutions and buy open and integrated. So I'd like to kind of say that in general vendors have bought a lot or technology companies, right, they’ve bought a lot of companies and integrated them, or they claim to integrate them. But generally the integration is a price list and the sales person selling to you. So overall, what's your guys' view on how the, how the industry needs to change in the way that we procure technologies?

[00:07:59] James Robinson: I'm jumping on this one first, because this, this was actually one that I saw that I've been talking internally a lot with Lamont about. Um, and it's that idea. I love the idea of open, you know, open NDR, open XDR, open cloud. Yeah, those, those types of things, we have to be able to, you know, make that almost requirement number one. In many ways, you know, we know the sum of many things is better than the sum of One, if you buy the black box, that's what you're getting is that sum of one, or maybe a sum of a few, um, and you have to, you know, build that intelligence by being open. That's really where it comes into. I'm a huge believer you'll out of, uh, out of some of them, you know, I know we've only talked about two, but right now this one is a probably ranked higher for me then principle one that we, that we talked about with challenge, everything, right? This one is, you know, this one is, is core. I think for us to be able to succeed with the future,

[00:08:54] James Christiansen: You know, I'm Jason I've bought best of breed products a lot through my career. You know, we, we very much went after with, uh, very aggressive companies like these, uh, that I was working for, you know, but today's world, you know, I have to look at best of breed platforms. I just can't afford the manpower it takes to manage all these different solutions. And the complexity it's brought to the organization, you know, just leads to human errors, leads to patches, not getting applied versions, not getting updated. So I've really had to move away and my thought process away from best of breed and started looking at best of breed platforms. Now, what can give me the best tightest integration, like you said, in your opening conversation, it can't be somebody with a lot of skew numbers, it has to be a truly integrated platform to solve the real problems.

[00:09:50] Jason Clark: So Erick, any thoughts from you on open and integrated? Why every solution we buy from this point forward, it should be more part of the ecosystem versus being the black boxes of kind of that we procured in the past.

[00:10:03] Erick Rudiak: Yeah. Great question, Jason. So like when I think about open and integrated and why it's so important, our systems are so interconnected. If there's no API to create visibility, like the complexity and interconnectedness of our systems kind of demands that signal from one defensive system, uh, be available to others so that they can orchestrate a response nearest to where the attacker is, and also so that a coherent user experience results. Um, and it becomes very, you know, both, uh, difficult for defenders to manage that. And candidly creates a drain and demands a level of complexity to weave those systems together that open an integrated, uh, is just a superior pattern for them.

[00:10:51] Jason Clark: Brilliant answer. Love it. So principle three is focused on foundational technologies that integrate with your entire security ecosystem. So I'll start with Lamont, you know, you've had the opportunity to build a Greenfield security program. What does that, you know, when, when you look at that right. What was the first stack that you built? What were the five core kind of foundational technologies that were part of this Greenfield infrastructure?

[00:11:16] Lamont Orange: So I think that's a very important question because when you talk about the transformation that security must go through you, you have to look at it. Not only from what tools are in my stack, but it's what capabilities we want and make that more aligned to the outcome. So I'd say the first capability That I wanted. It is around visibility. I had to see what was happening and order to affect the risk level of the organization and be able to put controls around that and tools that help you to understand what is happening would, would be a tool that looks at your usage of even legacy applications, as well as SaaS, IaaS, and PaaS technologies, you also have to take into consideration your identities. Many companies are struggling with identity as they have several IDPs. They have several managers of those identities, whether they are production systems or, uh, corporate systems. And what you want to do is have some sort of governance around it. So identity was one of the other areas that I focused on. And then you look at data protection. Well, we're all in it to protect our data. That is the crown jewel for the bad actor. We have to understand what valuable data we have and what data we like to protect. And then you look at where is that going? So you want to understand the data protection from the user to app to end point. So you have to have back to a comment that James Robinson made about being open with XDR NDR and whatever we put in front of. That DR capability, you have to have that understanding around the configuration of that device and even the organizations that may be using that data. And then there's one other capability that I think is very important to help organizations scale. Uh, when they're looking at a Greenfield, you need something that's going to manage your configuration automation and orchestration. And I think those are solutions that can be kept in one, one area, but they need to have the following those three capabilities in order to be effective.

[00:13:29] Jason Clark: Erick, on, on this, uh, principle around kind of foundational technologies. You know, landed in the other organizations. And now as a CTO, what would any thoughts on this one from an ecosystem standpoint around security,

[00:13:43] Erick Rudiak: There's a couple of things. So identity is one. Um, and you know, I think about that in terms of kind of the various levels of assertions that people in systems can make about who the human is at the other end of the line or who the system is that another system is working with. So that it kind of encompasses everything from multi-factor to kind of directory services, like that's absolutely vital to get right. I agree with Lamont, uh, that having data protection, having visibility into kind of data at rest and data in motion. Is another, and then, uh, it nowadays it's not particularly exciting, but the, kind of the very basics of encryption and configuration management and, you know, in thinking about configuration management, kind of incorporating both, uh, kind of config drift golden builds, you know, system hardening as well as, uh, vulnerability management, which I consider an instance of that class. Kind of pulling that all together. Those are among the first places that I have looked myself for, the kind of assurance that the basic blocking and tackling that the outrage factor of, uh, getting those wrong is managed and minimized for any organization that I’m part of.

[00:15:04] Jason Clark: Okay. So principle four only buy cloud powered new technologies. Right? So essentially everything you buy should be cloud power to cloud enabled or cloud born. You know, there's a Gartner paper. That's. The future of security is in the cloud, as we were doing this tour, there was a, a sentence said that, you know, cloud is the perfect reset for security programs, right? Because you get to kind of start fresh and do things, right. What do you, when you, so overall for all of you, what curious what you all think about this, this principle and, and why we wrote it.

[00:15:34] James Robinson: I think the principle is good. I think for us to take advantage of and, and to meet, you know, one of the things that we say internally is meet your customer, where they're at, you know, if the customer is, is in the cloud or they're moving to the cloud, right, which is even better to be where they're going to be, you have to adopt this principle. It has to be a foundational component for anything that you're looking at. ou know? And, and if it's, you know, cloud assisted, you may look at it. For instance, cloud assisted EDR. Okay, get it right. It's got to have something on the end point. It can't just all be cloud, but you know, for, for anything that's on the network stack for anything that's in the application stack server stack, um, you know, anywhere in between, you know, it definitely has to, has to carry with this principle.

[00:16:17] James Christiansen: You know, uh, Jason, this is the third major transformation I've been through it in my career and, and, um, technology and security versus movement from mainframes to client server. Then from client server to cloud enabled system. And now with business Digitas, digitalization, you know, we see these transformations and I think, you know, the further you resist them and don't recognize them the further you drop behind. So as you start thinking about cloud and cloud enablement, I talked to many CISOs every year, I mean, three or four hundred. And when we talk about what their plans are, where they see as SASE came out or are now secure service edge, And you start looking at definitions. When I start working with an organization and start looking where they're at, they're already somewhere down the path. They may be further in the maybe far, uh, ladder down, but they're, they're already on that path, which just, it just says we're the most common security folks recognize this is the pattern to go to. This is the direction. The only new investments I see are really just renewables. Cause they, they can't get moved off quick enough to the new cloud enabled, uh, technologies. But I think, you know, from a people process and technology perspective, all three it's about training our people on how to work in these cloud technologies. It's building out the processes that support those and the things, and finally implementing the technology, to enable those people and enable those process to provide the level of controls we need nowadays. But certainly the business is going there. We've seen the acceleration of that movement in the business and us as security professionals.

[00:17:59] Jason Clark: I mean in the end, isn't it, every bit as businesses going there and therefore your security needs to be where the data is and where the businesses. And also whenever you have a mobile workforce, you need to leverage the cloud to be able to secure that workforce because you can't just do it from your data center, right? Like in its simplest form, you just changing a leverage point in your scale.

[00:18:18] James Robinson: I love what James said, because when you talked about, you know, moving from, you know, from mainframe to client server, you know, we saw that major shift. If anyone's part of it, I definitely saw it and was part of it as well. And watching that happen, I could not imagine if you didn't make that shift, or if you did make that shift and you still tried to maintain, remember how hard it was to maintain in client server, those controls that you had and, and deliver those via the mainframe. It was almost impossible to do. In fact, it was impossible, which is why everyone's shifted and you saw the market change.

[00:18:49] Jason Clark: So the next one is principle five and. It potentially has more weight than many of the others. It is protect business data with security controls that follow the data everywhere. Right. So, which essentially to me is, you know, this is, this is the grand strategy of sec