Well today on our type for business podcast, we're joined by Kyle, our president and CEO,
and Nate, our director of cybersecurity and VC so.
So this episode is kind of continuing our audience question series from the tech fair,
and today we're talking about zero trust.
So if you don't know anything about zero trust, I'm going to have a bunch of links in the description,
a bunch of old podcasts just so you can kind of get a little caught up.
I'm going to start with Kyle, and I'm going to start not on our list of questions and ask,
of all the things you could have talked about at the tech fair, why was zero trust the thing that you chose?
I chose it because it was so close to our, we're recently been deploying in our final stages of implementation at CIT.
So it was very well, it was very personalized to what I was experiencing as a leader within our organization
and working with Nate and his counterparts on our internal efforts around it.
So I really felt I could add a lot of additional input as to the leadership view of why this was important
and what the journey looked like, because it does take a big effort and a lot of time and a lot of commitment.
And I was hoping to emphasize that it takes a lot of leadership involvement behind it as well,
because it is a big organizational shift, it is not just an IT department initiative.
Yeah, for sure.
Hi, you didn't ask me, but just writing on, writing on at the tech fair,
one of the things that we had told our customers is that CIT is a steward of many of these organizations and networks.
And so we feel the weight of that responsibility to first protect our own network,
because we know that we are interconnected with so many other networks.
And so you read about these data breaches left and right or ransomware, anything like that.
And that's something that we never want to happen here.
And so we put a ton of effort and time and money into protecting our own internal network,
removing all these different servers off the network so we can't have something like ransomware.
I could go deeper and deeper and deeper, but the biggest thing there was you trust us with your networks.
Therefore, we bear that weight and responsibility to help protect ours, to better protect you along the same way.
Yeah, yeah, quite simply protecting us protects them.
And that's a big effort on our part.
And we take that responsibility very seriously.
With that comes with a ton of knowledge of implementing and budget and all the things we're talking about today.
So diving into our first question, can ZeroTrust be implemented alongside other existing security measures?
Or is it kind of an all or nothing approach?
Yeah, I guess the way that I rephrase this is I kind of hate the term ZeroTrust altogether.
You know, it is a great buzzword, but it's one of those things where you'll see that term thrown around all over the place.
But the biggest thing is ZeroTrust is a mentality.
It's not a avenue or a tool or something along those lines.
You know, similar with cybersecurity and security maturity of an organization.
It's not just the responsibility of the IT and the security team.
It is the culture of every individual in that organization, right?
It could be everything from do you have the proper procedures for wire transfer requests?
That's pretty basic things like marketing team.
If you see something suspicious, do you report it?
Right? That's the culture that is tied behind that.
So if we take that same concept and apply it to ZeroTrust, it's not the tool.
Kind of if I rephrase that question, it is can ZeroTrust or can the culture be implemented along with other security tools?
Or is it all or nothing?
The answer is 100%.
You are going to have multiple tools for the different multiple layers, you know, what we call security in depth to be able to get to a state that people typically considers ZeroTrust.
It's an all or nothing approach similar to kind of what Kyle is saying is it comes from the leadership.
It's push downstream.
You have to have the full buy-in of the organization.
There just happens to be a lot of tech behind it as well.
Yeah, I think that sums up that it isn't just one product.
So, you know, by its very nature, you are going to have multiple security measures in place.
And there is definitely the way to approach it in phases or layering of those based upon typically what produces the highest return is where to start.
Right?
So things like EDR and a lot of components of those things are, you know, in multi-factor.
You start the year and then you start layering in the other components that help protect at a more granular level.
But there are ways to definitely continue to move those down and continue to close the gaps.
And it's by its very nature is going to be alongside everything.
Shameless plug.
We do have multiple podcasts about ZeroTrust.
And this first couple of steps you could start doing to start implementing it.
One of the big things here was how do you get rid of your on-premise critical servers?
Right?
Those are so dependent.
Or sorry, those are so critical where other servers have dependencies on them.
So if those are compromised, the rest of the system starts crumbling.
You know, we see this all the time with like ransomware.
The main, let's say a domain controller, which is running the main area where all your user accounts and passwords and where everything's logged into.
If that goes down, all these other systems that we're trying to log into, you know, check your password and everything,
you bring down multiple systems along the way.
And so it's trying to remove those, which means all your workstations have to start getting moved somewhere else for, you know, logins.
You can tell this is a subject I'm really passionate about, so I can just keep going.
Yeah.
It's been a lot of effort here, and it's been really exciting.
So our next question is, and we might have to rephrase it a little bit.
Is there any concern that ZeroTrust addresses?
So I'm going to throw that to Nate, quite where they were going for it.
Yeah.
It's really intended to say, how can we validate that every action that someone or a device is doing is legitimate behavior and intended in the proper scope of what they need access to?
And so the intent here is that, for example, let's say, Ario, you gave up your password, right?
And then someone else comes in and tries to access those systems.
If you don't have a control in place to validate that your user account is still you, which is, you know, the first layer of the multi-factor, then someone can come in and do whatever they want.
So that's where you put in that first layer with things like multi-factor.
I'm not going to quite tip my hand because I know there's a question that I want to talk a little bit deeper on in a little bit.
But you can start bringing those into things like, can you trust the user account?
Can you trust the device that they're coming in on?
Maybe you're trying to work off of a home computer that's infected rather than your work computer that's all nice and clean and locked down.
What happens if malware is introduced there, right?
We've seen that actually with the big, well-known data breaches.
I'm not going to call it the name specifically, but an employee working on their home computer got phished, had a keylogger installed, and then came in and compromised through the corporate network because it gathered a bunch of passwords while they were typing at home.
So you could bring all that type of stuff.
And then are the files and the times and the behaviors also legitimate?
So for example, if you logged in in New York and then all of a sudden logged in in California in five seconds, it's probably not legitimate.
Can you put in additional verifications surrounding something like that?
And then also, Ariel, if you're trying to access board reports here at CIT, that's probably not going to be allowed.
There has to be identification, notification, and action on that as well.
So taking all those into consideration starts to develop that zero trust, and that's truly what it's trying to address.
Does everything check out and is it legitimate?
Yeah, I think just when you look at the user permission sides of where you start to filter down to and looking at role-based access on the system sides,
knowing that somebody again could be potentially compromised in some level of access,
which is usually what we see when they come in at some kind of account takeover,
as Nate was alluding to some kind of credential harvesting that was done to get into the system sides with it.
So now it's at that person's level permissions dictates a lot of the risks that the organization's facing.
So with what their user account has trusted access to starts to become at risk.
And inherently, we find with many of our customers that we're trying to get them off.
The very nature has been a pretty open structure.
You had open file shares, you had company shares, you had department shares, and a lot of information is very wide open and obtainable.
And through that method sides of it, it induces a lot of risk.
And just where the state of things are in this day and age, that is no longer, you know, really the advice.
You have to really bring that back down and start scrutinizing that and have more filtering in layers to do validations,
that point of access instead of just saying, using passwords good enough, now you have access to everything.
And it's got to be far more scrutinized down to that.
I'm so interested in this next question when I read all of these, this was the one that I was like, that I feel like this is a good question.
And I know we're going to go down the rabbit hole, but they're asking what are good strategies for using Zero Trust with a global workforce,
especially when you have employees that are coming from those bad actor countries?
This is the one that I was alluding to that I wanted to withhold info on.
You guys have a move?
Have a move, yeah.
Well, I'll make a joke and say, well, do as the British and just ship everyone to Australia or something.
Relocate.
But, yeah, no, the, let me just, I think there's also a little explanation that I need to do before this is the specific part of bad actor countries.
There is no bad actor country.
Every country is a bad actor country.
It's just saying, where do we see most of our employees and inherently distrust everyone else?
If you go take a look at actually logs of where people are trying to get into your networks, it is your state, your city, you know, the next state over.
It's all over the place.
People are scanning brute forcing all the time.
Also, if they know that US countries are going to inherently trust the United States, I'll just come in with the VPN or actually what we oftentimes see is someone will compromise the network and then use their resources to go project another attack somewhere else.
I actually just dealt with this is.
And so what happens is one account compromise comes in and then, you know, maybe it's through a VPN or, you know, something like, you know,
an online server running somewhere.
It could be a website, something along those lines.
They hop on there.
You start paying for all the credit card fees as they spin up new resources and then they use your environment to go attack the next person.
All the logs look like it's coming from your location.
So think about that when it comes to a legal component is it's going to look like it's coming from your organization trying to attack another one.
And they might be sitting somewhere like Romania and Netherlands or literally right down the street from it.
You just don't know.
So with that being said, this is where zero trust comes in and it attempts to say, again, trust every action no matter who it is.
But the one critical component of this is multi factor all the time everywhere.
Right is even if the employee is outside of the nation.
If you have to have something like VPN, we're trying to get rid of VPNs altogether.
VPNs are terrible.
Right.
You have a hole on your network that someone can probe all day.
There's better ways of doing that.
That could be a whole nother podcast.
But the other critical thing is device trust.
And so this is what I was talking about earlier about your home computer is there's ways to say, I can validate that this is a work computer when someone is actively logging on and don't grant access unless both that user account.
And the device are met.
And then grant the access so you could still have someone logging in from overseas and be just fine.
But that's a long winded answer.
But my biggest thing here is every country is a bad country.
Yeah, I think that's well stated.
I also think things like and you and I have had this discussion hardware based keys like UB keys and those things as the requirement on the authentication side of it.
So even enhances that multi factor beyond just a software key or something potentially be intercepted side of it when it's an actual physical plug in or introduces the biometric side into that authentication side of it really makes that very difficult to be hijacked.
I mean, it's almost a point of presence where the person would be having to be having some kind of physical threat logging in to get in.
Those even your most renowned hackers will tell you that is pretty much they don't have a way around that hardware key.
You know, so in looking at those authentications and all those other tools do the other layering on the software side.
But if you really add a if you don't if you feel there's a high risk of potential account intercept or take over stuff, just look at hardware keys would be another way to enhance that further.
And this is also a really interesting time in the industry where you may have heard that key or the term past keys floating around today is a lot of these websites are adopting past keys.
So if you're on Windows, that could be something like Windows. Hello.
So taking your biometrics and turning that into essentially not a password, but an authorization authentication token to allow you in because it trusts that user with that device again.
Max, you know, Face ID, Touch ID here at CIT.
I just got a new phone today and I was logging into our system.
It took my face print with the face ID.
It's matched to this phone.
If someone captured my phone, let's say, you know, my spouse or anything wanted to try and log into CIT.
It doesn't have their face.
And then also if I tried logging into a different device, you know, and someone tried using a picture of me,
they didn't enroll my phone.
So everything gets paired to this device essentially.
No one else can compromise that.
And there's no password associated with it.
So I can't be phished.
So it's a really, really powerful combination.
We're seeing the industry move that direction.
Yeah.
So kind of zooming out a little bit.
Someone asked, how does Zero Trust align with compliance regulations?
And I'll kind of tag something on.
And is it just blanket across the board or how might that change based on industry?
Sorry.
I feel like this is going to turn into a Nate Soapbox episode here.
That's why I waited for you to answer.
I was like, I don't let Nate go with this one.
You can tell I'm really passionate about this kind of stuff.
So this is still pretty early.
I will say that, right?
And so back in, oh shoot, I want to say it's 2021 now, but it might be 2020.
I'm totally blanking right now is the federal government pushed out their
executive orders, improving the nation's cybersecurity posture.
And one of the things that they did was mandating that the federal
government start to mandate a Zero Trust approach to their networks.
First things were pushing down the EDR and then better architecture of those
networks.
It's going to take a lot of time to get all those switched over to this.
But when you see the federal government make a decision first, that is a giant
stone that's rolling and it's going to be very hard to stop that, right?
And so what we did see was now insurance providers are asking a lot of these
same questions such as, do you have the EDR?
Do you have the multi-factor?
Are you protecting administrator of accounts?
Are you protecting your critical networking infrastructure?
We haven't seen it get into a full implementation at this small, medium
business level quite yet, but we do continue to expect to see these
regulations continue to adopt it.
Government did that.
And then we also see things like CISA pushed out their Zero Trust framework
and everything like that.
So get ahead of it, but even the slow government is pushing it.
Yeah, and I think you kind of said it.
I mean, there are pieces of us that have already been rolling through many
compliance regulations out there.
It's just a matter of time.
You're just going to be more and more of it just because many of the other
tools and ability to do things like application ring fencing and network
access control and number of these components are really just a little
bit more of a risk control and number of these components are really just
starting to become added to the questionnaire every year.
We see more on each one of these get adopted and for good reason because
it's all about risk reduction and it's how you do it.
So continuing our Zoom out, I'm going to throw this question to Kyle.
Obviously Nate can share as well, but we had someone ask what kind of
financial investment do you need to start Zero Trust?
I'm going to add on what kind of time investment is someone maybe looking
at for Zero Trust?
Certainly organizational size dictates a lot of what the investment looks like.
Of course.
Where it's at.
It is not free and it's not inexpensive.
I mean, that goes for people's time and for different software and solutions
that you deploy.
There's no exact one price to kind of place on those things, but they definitely
come in at a cost, but I would bring it with, it is far less than an incident.
And if you had an incident, the cost of not only the cost of insurance,
but reputation, those things is way far greater than anything you would ever
spend for these tools.
So that kind of frames my decision process around it is there's
the cost of any of these solutions in the time is so much far less than
the overall risk to the organization that it deserved its priority to be high.
And I think it's all about planning to me and the sooner you plan and the
sooner you can work through it, again, it's not at all, you're not going to do
this in 90 days.
This is not a 90 day process.
It's a layer in his name, Lutie.
And I think that's where the other podcasts say, where do you start?
You need to start if you haven't.
You probably most people are priority have some steps are along the way,
which goes that first question.
There is a layering approach to get through those things.
And it's understanding where your largest risks are, because again,
every customer is different in every organization is different as far as
where they're at and where their risk exposures are at finding the different
solutions and tools that will give you the greatest reduction in risk exposure
is where you start.
And then you start layering on from there to go through it.
It does help spread the cost.
You will layer on costs, you go, but they become organizationally adopted
and they become part of your operational expenditures.
You don't necessarily have to have a huge capital outlay to get started with it.
And then it's also good on the time and the people side of it.
And the people aspect of it is multiple.
You have, you know, we have the, we have the blessings of having people like
need on staff to help oversee these things.
And, but as you roll these out, I mean, it isn't all just needs impact to
or the people, the users in the systems too, because many of these, you know,
it's going to disrupt their, their, their work.
They're going to have to have a change in the way that they do their job.
We're going to ask them to do some additional steps.
There's going to be some changing processes that have to be adopted.
And that has to be done in a, in a controlled manner as well to allow people to,
to come along with it.
Not only in just education, but just also in time to learn,
because you don't want to impact your organization's profitability or ability to service
their, your customers.
So, you know, there's a lot of steps there, but the big question side of it is,
I don't think you can afford not to do it.
That's the kind of the general my view on it.
Yeah.
The, yeah, the two things that come to mind for myself is I think one of the challenges
that a lot of these organizations faces that they're chasing annual budgets, right,
is they say, what's my budget for this year?
What's my, you know, and then as that year expires, they say, okay, in October,
what am I going to spend in the following year?
This is a multi-year initiative to implement.
And so if you're, you know, if you are setting your sights on something and you're just changing
direction annually, it's going to be very, very difficult to trudge forward efficiently
in the straight line to the end goal.
And so here at CIT, Kyle had visions, you know, five years ago to start implementing stuff like this.
And then I'd say over the last two years has been 100% dedicated focus trying to make it a reality.
And so that was a multi-year initiative that took a lot, a lot, a lot of time and effort.
And then because Kyle had mentioned that it also is potentially impactful to your organization.
One of the things you have to do is have a lot of empathy during this process is when your users say,
this is so frustrating.
I hate all these changes, right?
Empathizing with them and say, yes, I know.
But also trying to have that influence to start guiding them.
Why? Right?
Why do we do these types of things?
How does it better protect us?
Everything like that.
So if one of our CIT employees is listening to this, I have one that I have always called my squeaky wheel.
But he has now been self-proclaimed as the best beta tester we have because over years of influence,
we've built a great relationship of saying, if I can get something implemented and you don't become that squeaky wheel,
we know that we're successful.
Right?
That's awesome.
I love it.
To end out today, I'll kind of open it up to both of you if there's anything else you wanted to share.
But my kind of last question is, we're talking about zero trust.
It feels like such a big, you mentioned it being almost like a culture thing, a company culture and mindset.
Is there ever a point in which you feel like you plateaued, not finished,
because I think this is something maybe that's never done.
But is there a point in where you feel like you've met a goal and you're just maintaining,
or is this something where the goalpost is always moving?
It'll always shift a little bit, but I do feel like you can get to a spot that actually does make a lot of sense.
And you can start to sustain that.
Right?
So I'm not going to say that I'm 100% done because I still want to keep influencing Kyle for more money on our team's budget for fun tools.
But no, here at CIT, we are getting to a very nice point of saying,
I can validate the users, the devices, you know, essentially go completely passwordless so you can't be phished
and reducing that major risk that tends to happen, or tends to be involved with almost every single type of data breach.
And so there's a lot of really, really fun stuff you can do to get that point.
And then once you get to that point, it's kind of fine tuning all these different tools and then fully utilizing the licensing that maybe you're paying for.
And then at that point, you can maybe potentially take a look at new tools if needed.
Yeah, I think that just given the very nature of technology and how quickly things change on there, there is always a moving component to it where it's another lego in the stack.
You just continue to build on it.
It doesn't.
But you do reach a point where your maturity level is high.
So you're, again, you're covering a high percent of those things and now you're just adapting to the shifts in the space and where things are going.
You know, since it is a defensive stance side with it, the whatever is being done on the offensive matter would dictate what we need to do on many things.
Because again, that part seems to be changing at all times.
And bringing AI and machine learning and other things, there's a lot of things always in motion side of it, which he just always have taken account.
But I do feel like where we're at and what made it a little too over the multiple year side of it, we are, we are very close to, you know, the high maturity side of rolling through.
Where now we just, it's optimizations of that and continuing to build on to what we already have, which greatly helps.
And the only last thing I'd say on when we talk about the multiple year initiative sides of it, the reason that that is so helpful is that you reach business decisions you need to make over multi year periods.
We changed our, you know, our main accounting system that aligned with the strategic nature of what we wanted to do.
You know, so you make other decisions that may not necessarily seem like they're related to zero trust at all, but they have to fit within that structure.
And so when we looked at where we were going for our main accounting system, it had to work in that structure, which eliminated many vendors.
You know, and that's true of everything is to go through those things as we were rolling out new desktops, the desktops and how we deployed them were rolled out in the new methodology and new, new, new approach.
But that allowed that again to be spread over a period of multiple years, but we were making the decisions with the end game in mind.
So it wasn't just this, you know, you're not flipping a switch and trying to do the sledgehammer. It was a long term decision that we were able to weigh into the other decisions we made.
And the one thing I'd say is once you get to this really high level of maturity within your organization, First Cybersecurity is now it's holding others accountable to the same level of security.
And so we see this from time to time is, you know, robust security solution has some type of data breach, and it's usually due to some type of third party that they offer, you know, use.
And so it's the having the robust vendor due diligence processes to ensure that they're doing what they can. But also if you're granting the max is to your network, again, taking the same zero trust approaches, can you limit the potential exposure in case that did come in.
So I won't get too deep into it. I have a lot of different examples, but that's where the shift then focuses a little more externally.
I think we can, you know, deep dive into this for a long time.
Yeah, come join me on the soapbox series with Nate Schmidt.
Yes, for sure.
Thank you so much, Kyle and Nate for joining us today. Thank you all the audience who submitted these questions. This is really great. And I loved it.
If you have a question or a podcast idea, you can reach out to us at info at CIT-net.com or head out to our website CIT-net.com slash podcast.
And we'll be back next week with an all new back to CIT.