So I want to welcome you, Carlene. We're so glad that you can join us
Awesome. Thank you so much for having me. I'm gonna try to flip over to my screen.
Now let me know if you guys can see that
Yep.
Got it. Okay.
We Gotcha. Well, we had you
I know I don't know what just happened. Hold on, and I even tried to do this before or we went live to.
That's true.
It. It works for me. I think there was just a little bit of a lag
Yeah, that's up. You're good
Okay, okay, just wanna make sure. And you guys can see the full screen view.
Yes.
I can see it, and the only thing I would say is, if you have a problem with lagging, we may just need like.
Maybe turn off your your own webcam if there's problems.
Okay. Okay. Hold on. Let's see. Awesome. Okay. Well, thank you so much.
Thank you for the introduction, and I know I'm the last presenter today.
So I'm between you, and probably like snacks or a drink or something that's that's much more fun than 0.
Trust but I'm hoping today we're gonna turn a topic that seems really complex and convoluted into something that you can understand. So 0.
Trust is definitely become a major trend in the security space.
There's a lot of uncertainty about what 0 trust means.
Is it a technology? Is it an architecture? Is it an approach at its core?
0 trust is really about fundamentally changing our philosophy. To have we approach enterprise, security, namely, access, as Rob mentioned.
My name's Carlenecki, and I'm the Executive Vice President of strategy for Tantis security is something that I really hold near and dear to my heart, and I get really passionate about most recently speaking at the Cfo officer Consortium presenting on challenges
Facing Federal it. Security systems today and then also at Cms security training day.
So talking today, a little bit about 0 trust here's some of the items that we're gonna talk about today.
We're gonna talk about the landscape, and what's right, created.
This need for the concept is your trust. Why we need it, especially in health care, settings and potential impacts on usability.
A lot of times when we think about security. There's a lot of friction between confidence and usability from the end users.
So it's something that we definitely have to address. So my goal is that when you leave here today you know what 0, trust is, and you understand some of the pieces that go into achieving a 0 trust architecture so let's start with the security link landscape today to understand why we need 0 trust I
Think it's really helpful to understand what we're facing today, because it's really really different and it's changed pretty dramatically over the last 2 years.
First of all the networks are storing more and more vital and personal information which really increases the impact of breaches when they occur.
Breaches, can access personal information, disrupt major public services, and bring supply chains to a complete hold.
Add to that that ran somewhere. Attacks are on the rise.
According to the FBI, as many as 2,048 ransom more complaints were registered in 2021 alone, with so many devices and poorly properly designed access control systems users are constantly having to change and create new passwords think about when you get
That reminder from it that it's time to change your password we're all like oh, my gosh, right, and we're scrambling to come up with something unique or we write it down on a sticky and stick it on our laptop is really create a new and different kind of
Threats, and in fact, password, conferences are one of the most common way that companies and organizations are breached today.
Covid has also accelerated the pace at which the workforce has adopted work from home and remote work meaning.
We don't just have to protect a single network or set of devices coming through a single source.
And finally increased reliance on devices connecting to the Internet or the network create a hotbed of potential threat sources, for example, think about your office.
The last time we were all in there right. How many devices we're connecting to the Internet.
You have laptops, mobile phones, printers. We have maybe even sign in devices that print our baggage.
Even the coffee maker is connected to the Internet, and these are all potential access points for hackers.
So to answer all of these concerns in all of these risk security, and it teams are forced to string together kind of an alphabet soup with our framework of policies that are really just not designed to work well together as a result security and it teams are constantly trying to navigate the
burden between security, compliance, and us access, and that's really what the question of 0 trust is looking to solve the right amount of access at the right time, and that's something that I I want you to remember because I think if you walk away from this session and really understand the role of access and
0 trust. And this kind of concept at the right time then you'll really walk away with a fundamental understanding of what 0 trust is looking to so here's our question.
Does. Your trust is aiming to solve for us. Should this user on this device, under this context, be allowed to access this resource source, this sounds like a very deceptively easy question.
Right but once we start to peel back the layers, and we think about applying this question within a typical organization it becomes very complex.
Really really fast. So think about it is the user a full time employee.
Are they a contractor? Is it a service? Is the device, a company device, a personal device or a server?
Can you tell the user and the device pairs working in an office at home?
A public cloud, environment do we allow access through multi-factor of off authentication or VPN, even when you have all this information, how do you determine whether the app access should be granted immediately routed for approval or denied and how long should access even be allowed we start looking at all the
Different permutations again. It's really unmutey.
Very quickly. Moreover, we need to string together multiple different tools, to address all of these answers.
You can see how complicated access control becomes in practice
1 s. I think you'll lag in a bit
So to start, to understand, access and kind of the problem that we're looking to solve.
I think it really helps to start to talk about how we handle access today.
There we go, and I just wanna let you know. That is me standing outside the castle.
So for many years, when we design security models. We've used what we call perimeter perimeter style, security, and so in perimeter sour security we basically just secure around the perimeter and we've always trusted that once the user comes into the perimeter that they will
Act and access only the areas that they are intended to access.
And there's not a lot of control for lateral movements within the perimeter.
So once that user gets in, they kind of are free to move around within different systems or sets of data.
We tend to refer to perimeter style, recruit, security as castle and mode.
The castle surrounds, or the moat surrounds the castle, offering protection.
But once you cross that mode you're able to move freely within the castle, and again, that's me with the purple hair.
The issue now, and that worked for quite some time. But as we're continuing to become more reliant on it systems as we're starting to address all of these different points of connectivity and we're relying more on advances in technology like software as a service and cloud the threats are what we call the
threat. Landscape has really really changed, and so we need to come up with a better solution for how we approach access
And again, remember perimeter style, recruiting, or perimeter south security because of the way it's set up.
It's really creating risks in this new landscape, and that the perimeter is becoming so almost like fluid and dynamic that the boundaries that we've used for security in the traditional sense they just don't work anymore.
So 0 2 looks to treat access differently. And so now, when we're thinking about access, we think about access more in the sense of that.
It's cannot be inherited, or it cannot be an implicit.
So before we have perimeter style security when you got in you were kind of given a lot of trust, and that trust was in fine, we never thought that employees were going to try to attack the network in internally or that people would be giving out their password so that bad actors could access information or the
Network. So now under 0 trust, that kind of implicit trust that we day before it's gone away.
Organizations must verify anything and everything that is trying to connect to the network.
0 trust is centered on the belief that organizations can't give out that trust automatically.
And instead the organization has to continuely verify anything in everything trying to connect to its systems before Agree's access.
0. Trust means there was 0 implicit trust or 0 inherited trust.
0 trust is about creating the appropriate amount of access at the appropriate time through the use of multi access and decision and enforcement points.
We're gonna talk a little bit about what all of that means.
But now, instead of thinking of security, using a castle and most analogy, 0 trust approaches it a little bit more like a stadium, so I want you to think about the last time you went to a football game right are you allowed to go wherever you want no you show your ticket to go
Through security. But once inside your free movement within the State, the Cdm.
Is relevantly controlled and contained. You might be able to go to the bathroom right but only, on the level that coordinates with your ticket.
You show your ticket once you get to your section usually once you need to get to your seat if you have a suite you generally have to show your ticket at the elevator, and again at the entrance to the suite right so you're constantly showing that ticket over and
Over again. Also think about like, for instance, if you have a ticket and you're sitting in the 2 hundreds, you can't get down to the 100 you can't get down to the field.
You can't get into the locker room. You have to regularly show your ticket to access different parts of the stadium in the stadium access has to be continually continuously validated and that's how 0 trust treats access and security as well
So a lot of people ask is 0 trust a technology that would almost be so simple and make all of this so much easier.
You have to really think about 0 trust as more of an approach.
It's a model for securing the network apple and data resources with a focus on an identity centric policy for how we can control Access 0 trust isn't a one fit all at approach it really has to be tailored to each organization?
0 trust is a principle, or I'm sorry. A set of principles and tools for workflow policies.
System, design, and even operation. 0 trust is actually technology agnostic.
It's an approach, not a single solution. And again it's not one size fits all let's think about the core. 0.
Trust question that we looked at earlier what were all of the elements that we need to answer this question
So when we think about this this question right? In order to answer each one of these elements we have to think about the polynomial architecture.
Culture and training behind it. So, for example, we need to have a well done policy that says: Who can access systems or devices, and when and think about how complicated policy is in a hospital setting where you have so many different provider types and they need very different kinds of access at different time, and issues with access can result in impacts to
the care that's provided technology we have to have the right technologies that can confirm and control access and verify identity technologies that support offensation or enforcing our policies about access we have to have the right architectural configurations that promote security help segment
Our network and keep bad actors out to integrate all the tools and technologies we need to control access, and finally, we have to have the right culture and training we need team members thinking about security and how it.
Impacts our work we need people to understand the threat that they're creating when they use the same password for all of their devices, right or when they're writing their password on a sticky and sticking it to their laptop or when they accidentally leave their piv card
On the lunch table. All of these elements are what come together to create a 0 trust architecture.
So I just wanna kind of just stop there for 1 s and make sure that that we're pulling all of this together.
So is 0 trust technology or 0 trust a technology no, it's this entire framework of policy, technology, architecture, culture, all coming together to create the 0 trust architecture.
So one of the things I get asked a lot is, Why is everyone talking about 0 trust?
Now it seems to be a big but 0, trust and elements of your trust had actually been around since it about 2010, and we're gonna talk a little bit about some of the models that attempt to address 0 trust that have been around but one of the biggest reasons why 0.
Trust, is getting so much buzz right now is because there have been some very high profile attacks.
Most of us have heard of what happened with solar winds right there have also been very high profile, ransomware attacks against government organizations like the Washington police department large organizations like the Nba, and even healthcare organizations, like spring Hill Medical Center, in Alabama, which
basically arranged somewhere attack took them offline for days.
So because of that, and because the impact of these attacks, it's really been at the forefront which has gotten the attention of many government organizations, and that resulted in executive order 1,402 8 so 14 o 2 8 was issued in may of 2021 and it
Requires agencies to enhance cybersecurity and software supply chain integrity, and it's got a lot of different pieces to. It.
But one of the biggest pieces talks about multifacet authentication, which means we are conforming users, using multiple methods, and it also is talking a lot about 0 trust.
So the order highlights that importance of 0 trek, trust architecture, and it actually mandates that agencies have to start meeting specific 0 trust architecture, requirements, and a multi-factor authentication requirements within a specific time, period so the executive order came out and
Then Omb followed up with a director as well that was released in January of 2022.
So this was sent to all the heads of Federal agencies, and it's sets forth a 0 trust, architecture, strategy, and it requires that certain parts of the executive order and other parts of the memo be in place by the end of fiscal year, 24 and that's
Actually creeping up pretty quickly. So that's also kind of the impetus for a lot of the buzz around getting a lot of this done now.
So I know we have a attendees from a lot of different organizations.
Not everyone is is just government. So one of the questions that I get a lot and that I want to talk through is, should my organization address Z.
Trust, the the most basic and easiest answer is the Yes, Yes, you should threat cases create significant organizational risk for all types of organizations, right and 0 trust will help mitigate the probability and the impact of those risks we are also starting to see some business insurance and cyber insurance policies
Where elements of 0 trust as well. The health care, industry is especially vulnerable right to network attack ransomware attacks, and so, having moments of 0 trust, become incredibly important as well because the networks and systems store sensitive medical records that if a ransom where attack happens it can literally prevent access
To systems that contain vital healthcare information and even devices that store medicaidations because of the criticality of the environment and the access Usability also creates a huge challenge in healthcare settings that we're going to talk about again in a few slides
So we've covered a lot of information. So I just wanted to do what I call a 0 trust.
Rewind and talk about kind of 3 main nuggets that I've hope that you've picked so far.
So what is 0 Trust? Remember, it's a framework or a strategy for preventing an authorized access to data and services.
It isn't just a tool. It isn't just a technology it's a collection of policies, technologies, governance all coming together.
Your trust? Is it shift from castle emote or implicit trust to stadium style?
And remember when we're talking about 0 trust we're talking about appropriate amount of access at the appropriate time.
And then the third nugget that I want you to walk away from.
So far is just being aware that there are 2 major kind of federal meetings that are pushing government systems to have to comply with certain components of 0 trust within a certain amount of time
So we've talked a lot about what 0 trust is let's talk a little bit about some of the challenges to implementing 0 trust I want to start this conversation with recognizing that some of the common challenges with 0.
Trust, actually help, give or help lend almost a better understanding of of what 0 trust is, and what we really have to do to in order to address it successfully.
So from a technology perspective achieving 0 trust is going to require several refresh cycles, and it needs to coincide with our larger organization.
Modernization efforts like moving to the cloud. In fact, moving to the cloud, gives us an environment that we're really allows us to achieve.
Elements of 0 trust, architecture, much easier legacy systems and networks are are really built more on this idea of implicit trust, so as we start to refactor app applications for cloud we can use this as an opportunity to shift security to more of that stadium style.
That we talked talked about earlier, but this takes a lot of time right and so, as we're thinking about 0 trust, we almost have to play 2 games that immediate let's address immediate risk and that longer game where we're refactoring applications and and moving them to the cloud one of the other big
Challenges that we see with 0 trust is that there isn't like a one size, fits all formal adoption model, and some of the adoption models that we do see they tend to just focus on the network.
Layer that's really almost like tactical, and I think one of the easier components to solve.
It's the culture, the training, the poverty, and the governance that are all equally and as important.
But those are so specific to organizations that we have to tailor it to each organization.
And then finally one of the one of the biggest challenges we see with 0 trust is just that it involves a lot of strong change management and full engagement from a variety of teams across the organization and most importantly leadership buy-in so there's one big thing that I think we don't like
To talk about in the security space, and that sometimes this friction between the user community or the business owners and security a lot of people.
The user community or the business owners feel like security, keeps them from doing what they need to do, and we almost have to shift our mindset and c security as a way to enable what the business owners or users need to do in order to reduce that friction so when we're talking about
0 trust. Remember, we're talking about appropriate access at the appropriate time, so there's a big challenge with that.
A lot of folks are overlooking with your trust, and that's usability.
If we are limiting access right and your users going to log into a system or they used to be able to access data, and now they can no longer access that data or that system, or they have to access it in a different way, it really creates some sometimes almost behaviors that engage in risky behaviors
That circumvent some of the access issues, and we see that usability is an even bigger challenge in healthcare settings right healthcare organizations do some of the most complex networks and ecosystems and Internet based devices, including you know excellent expert machines, cat scanners.
Ultrasale machines. In fact, one study showed that the average hospital room might be contains more than 10 different medical devices.
That can be connected to the network right, then add into that desktop's laptops, mobile devices, and the total number of assets on a network per hospital is crazy complex.
Then add into that that the health, care, setting face is really significant issues associated with timely access right if I'm a provider, and there is a medical emergency going on, and I can't access something or I have to go through a multi-factor authentication process that I have to get
a code on my cell phone and use my car. Well, now, all of a sudden, right.
You have providers that are frustrated have to do extra steps in order to do their job, and we're kind of adding additional steps for a community that's already facing burnout right providers can't afford to have their access denied to a patient's records at a
critical moment it staff has to figure out a way to work with security staff, and end users to create access solutions that provider that provide that right access at the right time without compromising compliance and this is really where usability testing and getting users involved early and often as we're
designing these 0 trust solutions becomes really really incredible and important
Alright. So where do we start?
So some organization. Most organizations already have elements of 0 trust in place, because they have some type of security, or they have to comply with miss or business standards.
We do recommend an agile approach that matures over time.
So one of the things that we've been doing with some of our customers is kind of breaking it down into these 4 steps.
Discover. First, we have to know what we have from a network data device and workflow perspective.
Once we have that baseline. We know we're our strings are, and we know what we need to focus on. Next.
Observe, we have to create dashboards and trappers that allow us to look at 0.
Trust goals, map them into current states and milestones.
So that from this data we can make informed decisions about changes that we need to make and addressing gaps over time, respond.
We have to start, to build, extend, test and deploy strategies around 0.
Trust. And here's where usability testing becomes really key.
We have to recommend working on one process at a time, getting it right, because the implications to not having appropriate access, the impact is so high, and then finally, through protect, we look at how we can continue to improve controls all the time over time including access, and tools, and protecting our most critical systems and
processes. First, one of the things that we think is incredibly important is finding an experience partner not just with security, but a partner that can help with strategy and change management.
Because those are really really key to getting this organizational change done right.
There are some models and frameworks that are available
I'm not gonna go into these in too much depth.
Forster has one that's been around since 22.
Gartner, also has one. But what we're really seeing emerge as the most common one is the Dhs.
Sisa model, and so that model is really unique, and that it it it really takes kind of an agile approach and maturing over time as well.
It also, I think, takes the most holistic look at the organization.
So it's the dhs. This is your trust model.
We're looking at these kind of 5 different pillars across the organization, and we're also layering visibility and analytics, so that we're measuring how we're doing on our journey to 0 trust we're looking at automation orchestration.
So how can we automate some of these elements associated with access?
And then we're also considering governance. So for many of our customers, this actually gives us a really solid start because we're looking at the organization holistically.
But also this model focuses on advancing the pillars where it makes the most sense for your organization, so you can kind of look at these different pillars.
Say, Hey, here's where we're mature. Let's keep moving here, or oh, Hey!
Here's where we're the weakest. Let's focus our attention here, and each pillar can mature kind of at its own pace.
It also defines a model for maturity. So with a this is 0 trust maturity, model.
We have traditional kind of like where we are today with a lot of the perimeter style, repute, perimeter style. Security.
We have advanced which is, we're starting to achieve 0 trust and then optimal, which is where we?
Have a lot of automation, a lot of orchestration, and we can do automated access authentication as well
Alright. So I'm gonna do one more rewind for you guys, and that's on just the employment.
So we always recommend for everyone that we work with. That you start with where you are and what you know, plan immediate changes and long term changes that coordinate with larger it.
Modernization strategies. You can't address 0 trust in a vacuum right?
You have to think about your cloud strategy, other security strategies any of your other modernization strategies, all of these have to work together.
We recommend taking an agile approach over time. 0 trust is not kind of like.
Let's do it once and get it done. You really have to identify kind of where are the some of the biggest risk focusing attention.
There and then making sure that you've got a game plan for how you improve those over time.
And then look to industry, best practices and models. The Dhs system model again, is one of the best.
I think it's also one of the most mature.
The other thing. That's really great about the Dhs system model is that it aligns really nicely to M.
22, o, 9, which is the omb guidance that was released in January.
And so, if you take that guidance there's a really nice mapping for what Omb is saying.
You have to be compliant with, and when and how things are kind of prioritized within that system, model as well
How make sure you address usability. I cannot stress this enough and I think that's something that we really overlook in security is making sure we're thinking about.
You know these access requirements that we're putting in place.
How do they impact our users? How do they impact their ability to access the systems?
Do their jobs and are we creating barriers to entry that are then creating kind of bad behaviors that increase potential security risks
I wanted to leave you with a couple of sources. So if you're interested in learning any more about 0 trust and you have a lot of extra reading time on your hands I put some of the links to some of the critical mandates that we've been seeing so we have then this
special publication on Zeros at the bottom is also the 0.
To trust maturity, model, and then in the middle. I also included the act.
I app guidance for 0 trust as well. If you need more information, this is something.
Teachers has been working with on our clients and customers.
I'm happy to tell you how we've helped them. We've done everything from white papers and assessments to actually achieving full 0 trust architecture
And then finally, in closing, I have my little Mario here, blowing up the castle because we are no longer thinking about security as tassel and moat.
But right now you see my
And we're thinking about it more in state. Am style.
So please feel free, to reach out if you have more questions.
I know this is gonna seem like an overwhelming topic but at its core it's really about access, and I'm happy to explain anything else.
If you guys have