Accelerate your SASE deployment with the SASE Week Backstage Series. Explore sessions

close
close
  • Why Netskope chevron

    Changing the way networking and security work together.

  • Our Customers chevron

    Netskope serves more than 3,400 customers worldwide including more than 30 of the Fortune 100

  • Our Partners chevron

    We partner with security leaders to help you secure your journey to the cloud.

A Leader in SSE.
Now a Leader in Single-Vendor SASE.

Learn why Netskope debuted as a leader in the 2024 Gartner® Magic Quadrant™️ for Single-Vendor Secure Access Service Edge

Get the report
Customer Visionary Spotlights

Read how innovative customers are successfully navigating today’s changing networking & security landscape through the Netskope One platform.

Get the eBook
Customer Visionary Spotlights
Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn about Netskope Partners
Group of diverse young professionals smiling
Your Network of Tomorrow

Plan your path toward a faster, more secure, and more resilient network designed for the applications and users that you support.

Get the white paper
Your Network of Tomorrow
Introducing the Netskope One Platform

Netskope One is a cloud-native platform that offers converged security and networking services to enable your SASE and zero trust transformation.

Learn about Netskope One
Abstract with blue lighting
Embrace a Secure Access Service Edge (SASE) architecture

Netskope NewEdge is the world’s largest, highest-performing security private cloud and provides customers with unparalleled service coverage, performance and resilience.

Learn about NewEdge
NewEdge
Netskope Cloud Exchange

The Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.

Learn about Cloud Exchange
Aerial view of a city
The platform of the future is Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG), and Private Access for ZTNA built natively into a single solution to help every business on its journey to Secure Access Service Edge (SASE) architecture.

Go to Products Overview
Netskope video
Next Gen SASE Branch is hybrid — connected, secured, and automated

Netskope Next Gen SASE Branch converges Context-Aware SASE Fabric, Zero-Trust Hybrid Security, and SkopeAI-powered Cloud Orchestrator into a unified cloud offering, ushering in a fully modernized branch experience for the borderless enterprise.

Learn about Next Gen SASE Branch
People at the open space office
Designing a SASE Architecture For Dummies

Get your complimentary copy of the only guide to SASE design you’ll ever need.

Get the eBook
Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn about NewEdge
Lighted highway through mountainside switchbacks
Safely enable the use of generative AI applications with application access control, real-time user coaching, and best-in-class data protection.

Learn how we secure generative AI use
Safely Enable ChatGPT and Generative AI
Zero trust solutions for SSE and SASE deployments

Learn about Zero Trust
Boat driving through open sea
Netskope achieves FedRAMP High Authorization

Choose Netskope GovCloud to accelerate your agency’s transformation.

Learn about Netskope GovCloud
Netskope GovCloud
  • Resources chevron

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog chevron

    Learn how Netskope enables security and networking transformation through secure access service edge (SASE)

  • Events and Workshops chevron

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined chevron

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

The Future of Security: Quantum, AI, and Macro-political Change
Emily Wearmouth and Max Havey speak with Netskope CEO Sanjay Beri and CTO Krishna Narayanaswamy about the future of security.

Play the podcast Browse all podcasts
The Future of Security: Quantum, AI, and Macro-political Change
Latest Blogs

Read how Netskope can enable the Zero Trust and SASE journey through secure access service edge (SASE) capabilities.

Read the blog
Sunrise and cloudy sky
SASE Week 2024 On-Demand

Learn how to navigate the latest advancements in SASE and zero trust and explore how these frameworks are adapting to address cybersecurity and infrastructure challenges

Explore sessions
SASE Week 2024
What is SASE?

Learn about the future convergence of networking and security tools in today’s cloud dominant business model.

Learn about SASE
  • Company chevron

    We help you stay ahead of cloud, data, and network security challenges.

  • Careers chevron

    Join Netskope's 3,000+ amazing team members building the industry’s leading cloud-native security platform.

  • Customer Solutions chevron

    We are here for you and with you every step of the way, ensuring your success with Netskope.

  • Training and Accreditations chevron

    Netskope training will help you become a cloud security expert.

Supporting sustainability through data security

Netskope is proud to participate in Vision 2045: an initiative aimed to raise awareness on private industry’s role in sustainability.

Find out more
Supporting Sustainability Through Data Security
Help shape the future of cloud security

At Netskope, founders and leaders work shoulder-to-shoulder with their colleagues, even the most renowned experts check their egos at the door, and the best ideas win.

Join the team
Careers at Netskope
Netskope’s talented and experienced Professional Services team provides a prescriptive approach to your successful implementation.

Learn about Professional Services
Netskope Professional Services
Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn about Training and Certifications
Group of young professionals working
Post Thumbnail

On this episode of Security Visionaries, host Emily Wearmouth explores the concept of zero trust with cybersecurity experts John Kindervag, the “Godfather of Zero Trust,” and Neil Thacker. Listen in as they recount the origins of zero trust, its underlying principles, and how it’s reshaping modern organizations. They also clarify the common misconception that zero trust is only about identity and access management, stressing that its broader scope in safeguarding organizational assets. Moreover, they delve into the trials and tribulations of implementing zero trust, and the need for comprehending the organization’s mission and protect surface. Finally, we encourage organizations to gradually, iteratively, and inconspicuously adopt zero trust while keeping a close eye on the system.

People aren’t packets. You can’t apply the concept of trust. So get rid of the word trust. That’s the easiest thing to do, replace it with validation. We’re validating signals so that we have confidence in allowing access to a resource.

—John Kindervag, Chief Evangelist at Illumio
John Kindervag

 

Timestamps

*00:01 - Introduction*18:29 - Importance of understanding the protect surface and mission
*01:36 - Prompting the initial conception of zero trust*20:32 - Zero trust beyond networks and the role of technology
*03:14 - Initial reaction to the zero trust concept*25:23 - Zero trust as a bespoke approach
*06:54 - Factors to consider in zero trust decision-making*28:59 - Why zero trust is the right term
*10:12 - Zero trust as a board-level topic*29:35 - Conclusion
*14:26 - Transitioning to zero trust architecture

 

Other ways to listen:

green plus

On this episode

John Kindervag
Chief Evangelist at Illumio

chevron

John Kindervag

With more than 25 years of experience as a practitioner and industry analyst, Kindervag is one of the world’s foremost cybersecurity experts and is known for creating the transformational zero trust Model of cybersecurity. Previously, Kindervag led cybersecurity strategy as a senior vice president at ON2IT. Previously, he served as field CTO at Palo AltoNetworks. Before that, Kindervag spent over eight years as a Vice President and Principal Analyst on the security and risk team at Forrester Research. It was there that he famously developed the concept of Zero Trust, an architectural approach founded on the principle of “never trust, always verify” that operates on the assumption that breaches are inevitable and that threats can originate from anywhere, even inside the network. Kindervag also serves as an advisor to several organizations, including the Cloud Security Alliance and Venture Capital firm NightDragon, and he was a contributor to the National Security Telecommunications Advisory Committee Report to the President.

LinkedIn logo

Neil Thacker
CISO, EMEA at Netskope

chevron

Neil Thacker

Neil Thacker is a veteran information security professional and a data protection and privacy expert well-versed in the European Union General Data Protection Regulation (EU GDPR).

LinkedIn logo

Emily Wearmouth
Director of International Communications and Content at Netskope

chevron

Emily Wearmouth

Emily Wearmouth is a technology communicator who helps engineers, specialists and tech organisations to communicate more effectively. At Netskope, Emily runs the company’s international communications and content programmes, working with teams across EMEA, LATAM, and APJ. She spends her days unearthing stories and telling them in a way that helps a wide range of audiences to better understand technology options and benefits.

LinkedIn logo

John Kindervag

With more than 25 years of experience as a practitioner and industry analyst, Kindervag is one of the world’s foremost cybersecurity experts and is known for creating the transformational zero trust Model of cybersecurity. Previously, Kindervag led cybersecurity strategy as a senior vice president at ON2IT. Previously, he served as field CTO at Palo AltoNetworks. Before that, Kindervag spent over eight years as a Vice President and Principal Analyst on the security and risk team at Forrester Research. It was there that he famously developed the concept of Zero Trust, an architectural approach founded on the principle of “never trust, always verify” that operates on the assumption that breaches are inevitable and that threats can originate from anywhere, even inside the network. Kindervag also serves as an advisor to several organizations, including the Cloud Security Alliance and Venture Capital firm NightDragon, and he was a contributor to the National Security Telecommunications Advisory Committee Report to the President.

LinkedIn logo

Neil Thacker

Neil Thacker is a veteran information security professional and a data protection and privacy expert well-versed in the European Union General Data Protection Regulation (EU GDPR).

LinkedIn logo

Emily Wearmouth

Emily Wearmouth is a technology communicator who helps engineers, specialists and tech organisations to communicate more effectively. At Netskope, Emily runs the company’s international communications and content programmes, working with teams across EMEA, LATAM, and APJ. She spends her days unearthing stories and telling them in a way that helps a wide range of audiences to better understand technology options and benefits.

LinkedIn logo

Episode transcript

Open for transcript

Emily Wearmouth [00:00:01] Hello and welcome to another edition of the Security Visionaries Podcast, the place where we grill experts on a wide range of cyber data and other related topics. I'm your host, Emily Wearmouth, and today I have two expert guests joining me, John Kindervag and Neil Thacker. So let's get some introductions out of the way. I'm going to start with you, John, because you have one of the most impressive informal titles I think we've ever had on the show, The Godfather of Zero Trust. You picked up the title at Forrester, where, for the listeners benefit, John gave the name to the principle of what we now know as zero trust as a data security approach. I think for an analyst, The Godfather title is probably the pinnacle of a career. So in recent years, he's been working as an evangelist for a number of security vendors, and he's now the chief evangelist at Illumio. So welcome to the show, John.

John Kindervag [00:00:47] Hey, thanks for having me.

Emily Wearmouth [00:00:49] Neil Thacker is a voice that regular listeners might recognize because he joined us on our pilot episode back in September. He's a practicing and very busy CSO, but he still makes time to be one of my go to experts on governance, compliance, AI, all sorts really. Neil is here to give us the view from the trenches as a practicing CISO he'll hopefully be able to give us some doses of reality as to what really goes on when principles and ideologies get into business. So can you guess what we're going to be talking about today? Yeah, it's the topic on everybody's lips zero trust. And we're going to dive right in. And I think it would be remiss having got The Godfather onto the podcast. John, can we start off with you? I want to ask you to give us a brief explanation of zero trust, but in particular, I'm keen to hear what prompted the initial conception of the zero trust approach when you were at Forrester.

John Kindervag [00:01:36] So, before I got to Forrester, I was a practitioner. I was a security engineer and network engineer, security architect, pen tester and firewalls, from the beginning, I had this trust model where interfaces were given a trust level 0 to 100. And so zero, the, least trusted interface went to the public internet, and 100, the most trusted interface went to the internal network. And then every other interface had a different number. But that could be neither zero nor 100 and couldn't be the same as each other. And those trust levels determine policy. So, for example, you did not have to have an outbound rule if you were going from a high trust level to a low trust level. And I would always try to put those in because I was worried about data exfiltration and I would get in trouble, because that's not the way the manufacturer says you need to do it. I'm like, well, logic dictates that, if somebody gets in, they're going to get out. And, having a door that, you know, only needs to go one way is silly. And so zero trust is my reaction to that broken trust model. That trust is a human emotion. And and it needs to get out of the digital world. It has no relationship to packets. People aren't packets. You you can't apply the concept of trust. So get rid of the the word trust. That's the easiest thing to do. Replace it with validation where validating signals so that we have confidence in allowing access to a resource.

Emily Wearmouth [00:03:14] And I know we're all talking about zero trust now, but it's been a little while since you came up with the initial idea. So what was the reaction like back when when you first came up with it?

John Kindervag [00:03:22] Well, it was less than enthusiastic. In fact, people told me I was completely nuts out of my mind. This would never go anywhere. Other things that I would not say on a public podcast. So, you know, then 11 years later, 2010, I wrote the first report. 11 years later, the president issued an executive order on it mandating all, U.S. federal government agencies adopt it. And it's now become this global movement. So that's something I never thought would happen. And I was told explicitly by lots of people that that would never happen, and that I was literally one of the craziest people on the planet.

Emily Wearmouth [00:04:00] Why do you think it has caught on?

John Kindervag [00:04:03] Because it makes logical sense, and also because a lot of early adopters who were having really big difficulties securing their network, tried it out and told other people and told other people and told other people that it works. And so, it proved itself in the trenches. I mean, I did two years of primary research before I published the first report. I built prototype environments. I worked with government agencies. So I never had any doubt that it was going to work, that it was the right strategy. Because zero trust is a strategy, first and foremost, that resonates to the highest levels of any organization like the president in the United States. And then can be tactically implementable using commercially available off the shelf technology. So I always knew that I needed to make sure that the strategy was decoupled from the tactics. Strategies don't change. Tactics get better and better over time. Right. Yeah. So Neil and I go back a long time to, a hotel in London. Right, Neil?

Neil Thacker [00:05:13] Yeah. I think we first met in 2012. So that's scary that's 12 years ago now. And I heard about the term. I heard about your definition of zero trust. And we had a discussion. I think it was over lunch during the conference. And, yeah, we were talking about how what zero trust can be, can be applied. And in those days, yeah, it was firewall, it was IPS. I remember talking about IPS and looking at context around IPS and these tools or these, these new features that were being implemented like, real-time network awareness, where it was trying to take different variables of trust. Exactly. To your point, right, in terms of how you how you define policies and how you should be adjusting policies based on the trust levels. But it was interesting because at that time that in that hotel, Tom cruise was staying. And it's probably it's putting a great analogy, right, in terms of there was people around the hotel, in the hotel, staying at the hotel or having conferences at the hotel. And then on the top floor, Tom cruise had about 6 or 7 rooms that were knocked into each other. So he had his gym and obviously his place where he was staying, while he was filming Mission Impossible. And I think that's a great analogy, right, in terms of zero trust and the fact is that people were in that hotel, but there was zero trust applied to those individuals, right? They were not allowed to go onto those floors. There was very tight security to completely restri