Zero Trust: It's More Than Just Identity

Emily Wearmouth [00:00:01] Hello and welcome to another edition of the Security Visionaries Podcast, the place where we grill experts on a wide range of cyber data and other related topics. I'm your host, Emily Wearmouth, and today I have two expert guests joining me, John Kindervag and Neil Thacker. So let's get some introductions out of the way. I'm going to start with you, John, because you have one of the most impressive informal titles I think we've ever had on the show, The Godfather of Zero Trust. You picked up the title at Forrester, where, for the listeners benefit, John gave the name to the principle of what we now know as zero trust as a data security approach. I think for an analyst, The Godfather title is probably the pinnacle of a career. So in recent years, he's been working as an evangelist for a number of security vendors, and he's now the chief evangelist at Illumio. So welcome to the show, John.

John Kindervag [00:00:47] Hey, thanks for having me.

Emily Wearmouth [00:00:49] Neil Thacker is a voice that regular listeners might recognize because he joined us on our pilot episode back in September. He's a practicing and very busy CSO, but he still makes time to be one of my go to experts on governance, compliance, AI, all sorts really. Neil is here to give us the view from the trenches as a practicing CISO he'll hopefully be able to give us some doses of reality as to what really goes on when principles and ideologies get into business. So can you guess what we're going to be talking about today? Yeah, it's the topic on everybody's lips zero trust. And we're going to dive right in. And I think it would be remiss having got The Godfather onto the podcast. John, can we start off with you? I want to ask you to give us a brief explanation of zero trust, but in particular, I'm keen to hear what prompted the initial conception of the zero trust approach when you were at Forrester.

John Kindervag [00:01:36] So, before I got to Forrester, I was a practitioner. I was a security engineer and network engineer, security architect, pen tester and firewalls, from the beginning, I had this trust model where interfaces were given a trust level 0 to 100. And so zero, the, least trusted interface went to the public internet, and 100, the most trusted interface went to the internal network. And then every other interface had a different number. But that could be neither zero nor 100 and couldn't be the same as each other. And those trust levels determine policy. So, for example, you did not have to have an outbound rule if you were going from a high trust level to a low trust level. And I would always try to put those in because I was worried about data exfiltration and I would get in trouble, because that's not the way the manufacturer says you need to do it. I'm like, well, logic dictates that, if somebody gets in, they're going to get out. And, having a door that, you know, only needs to go one way is silly. And so zero trust is my reaction to that broken trust model. That trust is a human emotion. And and it needs to get out of the digital world. It has no relationship to packets. People aren't packets. You you can't apply the concept of trust. So get rid of the the word trust. That's the easiest thing to do. Replace it with validation where validating signals so that we have confidence in allowing access to a resource.

Emily Wearmouth [00:03:14] And I know we're all talking about zero trust now, but it's been a little while since you came up with the initial idea. So what was the reaction like back when when you first came up with it?

John Kindervag [00:03:22] Well, it was less than enthusiastic. In fact, people told me I was completely nuts out of my mind. This would never go anywhere. Other things that I would not say on a public podcast. So, you know, then 11 years later, 2010, I wrote the first report. 11 years later, the president issued an executive order on it mandating all, U.S. federal government agencies adopt it. And it's now become this global movement. So that's something I never thought would happen. And I was told explicitly by lots of people that that would never happen, and that I was literally one of the craziest people on the planet.

Emily Wearmouth [00:04:00] Why do you think it has caught on?

John Kindervag [00:04:03] Because it makes logical sense, and also because a lot of early adopters who were having really big difficulties securing their network, tried it out and told other people and told other people and told other people that it works. And so, it proved itself in the trenches. I mean, I did two years of primary research before I published the first report. I built prototype environments. I worked with government agencies. So I never had any doubt that it was going to work, that it was the right strategy. Because zero trust is a strategy, first and foremost, that resonates to the highest levels of any organization like the president in the United States. And then can be tactically implementable using commercially available off the shelf technology. So I always knew that I needed to make sure that the strategy was decoupled from the tactics. Strategies don't change. Tactics get better and better over time. Right. Yeah. So Neil and I go back a long time to, a hotel in London. Right, Neil?

Neil Thacker [00:05:13] Yeah. I think we first met in 2012. So that's scary that's 12 years ago now. And I heard about the term. I heard about your definition of zero trust. And we had a discussion. I think it was over lunch during the conference. And, yeah, we were talking about how what zero trust can be, can be applied. And in those days, yeah, it was firewall, it was IPS. I remember talking about IPS and looking at context around IPS and these tools or these, these new features that were being implemented like, real-time network awareness, where it was trying to take different variables of trust. Exactly. To your point, right, in terms of how you how you define policies and how you should be adjusting policies based on the trust levels. But it was interesting because at that time that in that hotel, Tom cruise was staying. And it's probably it's putting a great analogy, right, in terms of there was people around the hotel, in the hotel, staying at the hotel or having conferences at the hotel. And then on the top floor, Tom cruise had about 6 or 7 rooms that were knocked into each other. So he had his gym and obviously his place where he was staying, while he was filming Mission Impossible. And I think that's a great analogy, right, in terms of zero trust and the fact is that people were in that hotel, but there was zero trust applied to those individuals, right? They were not allowed to go onto those floors. There was very tight security to completely restri