Welcome to today's CIT Tech for Business podcast. Today we are sitting down with Todd, Nate,
and Ashley and we're going to be discussing Zero Trust Part 2. So if you guys are one
of our lovely followers and listeners, we already discussed Zero Trust a while ago,
but now we're going to bring in the Part 2. Before we get it kicked off, I always have
to pose a question. So we all know all three of you are super passionate about cybersecurity,
but tell me something else that you're passionate about outside of work. Todd, I'll kick it
off to you first.
Hello, I'm Todd Sorg. I was going to say good morning, but I have no idea what time of day
it is that you'll be talking to us or listening to us. I am CIT's Chief Operations Officer.
I am also the CISO. One other thing that I'm incredibly passionate about is music. Before
I actually got into technology and cybersecurity, I thought I was going to be a rock star. So
that is where my career actually started. Surprisingly, I'm not one. In case anybody
is aware of me, I'm not a rock star.
I guess I can go next. My name is Nate. I'm our Security Director at CIT. Something that
I'm really passionate about is classic cars. I actually have two of them and love fixing
them up, restoring them, bringing them into car shows. So actually in a car show this
weekend too.
I'm Ashley. I am a cybersecurity analyst here at CIT. I am super passionate about cooking,
love trying new things, different types of food. Recently bought a 20 pound bag of dent
corn to make homemade corn tortillas. So I really enjoy doing that kind of stuff.
That's awesome. I've never done that yet.
I'm learning a lot about you guys and I feel like I've worked with you for several years
now. This is great. I did want to kind of get us kicked off of, you know, we talked
about before the part one, but now we're at the part two of how do we get started with
this? Tell me more. Let's dive into that for our listeners today.
Awesome. Thank you. So before we go too far down the path, I just kind of wanted to do
a real, real brief recap of what we talked about. It has been a little while since we
did the last one. And one of the very first things that I kind of wanted to touch on was
why do organizations care? And I'll let Nate and Ashley chip in anytime they want. But
the biggest reason is the cybersecurity threat landscape just continues to evolve. It continues
to grow. It just gets worse and worse. So you're seeing a lot more ransomware. And one
of the other things that's been a major player in why people care is you're seeing a big
uptick in having Internet of Things on networks. And more importantly, you're seeing a lot
of people at home, which also introduces a lot more of Internet of Things. Expanding
the quote unquote edge of the network has now gone from the traditional building slash
castle, if you will, to a more spread out workforce. And I think that's probably the
next biggest reason. And then we've talked about some of the other stuff from the previous
one is what is zero trust? And zero trust was really it's not trusting anybody. The
traditional castle mentality was if you're inside the walls of the building, we trust
you, you can connect to our systems and anything else. And now it's really more of a it's no
longer a trust but verify it's we don't trust anything anytime anyway. So that's the whole
point of going nothing secure. There's no reason to assume that it is. Let's start there.
A couple other little things. It is not as simple as a single tool. You can't just go,
hey, I bought this thing off the shelf, put it in. Off we go. It's not as simple as turning
on multifactor. It's a lot more complex than that. So I'll pause there and I'll let Ashley
and Nate kick in anything else that they'd like to add to that recap.
Yeah, I guess the one thing that really comes to mind, and I don't remember if we use this
language in the first podcast, but I think zero trust and again, I'm not a huge fan of
the language because it's such a buzzword today. But zero trust overall, if I could
condense it down to a single thing is it's a culture, it's a mentality, it's not the
tools that you put in place. It should even be ingrained in the processes that you take
in order to do the job. So if that's the way I could condense it, that's probably the best
way I could phrase that.
Yeah, and it's definitely more of not really like a one and done, you know, we've implemented
zero trust, it's got to be something that's you're evolving over time and adapting to
new security threats, adapting with new technology, things like that. So it's not something that
you're going to implement once and then you're done.
I think the last thing that I was going to add to that potentially is Todd mentioned
just now that there's the sprawling edge, and we'll get into a little bit of the topics
of different components to try and focus on to actually help lock things down or secure
things. But, you know, I know we talked a little bit about the users, but it's going
to go beyond that and to actually the data, your vendors, all this kind of stuff. And
so there's a saying from our CEO that he says all the time is IT these days takes a village
to do it properly. This shouldn't just be the one item for that one individual, maybe
the help desk person, net admin, security admin. It's a joint effort for the entire
organization. So everyone has their different specialties.
Yeah, what I was going to add on to that was we've kind of preempted all of this conversation
of culture and it's a village and so on and so forth. So you can obviously tell that this
is not a simple process. You don't just buy something off the shelf, implement it, off
you go. So long story short with this, really what we're talking about is here it comes.
It's a journey. So the question today is how do you even get started? And it's a great
question. We're going to dig into it. We're not going to get super, super granular, but
we are going to kind of dig into this a little bit. One of the first things that we did as
we were talking about what we were going to cover today is just what does that look like?
And one of the things that we wanted to cover in particular is we would suggest that as
it was preempted preemptively set is this is a big deal. So this should be treated like
it is a full blown entire organization project. And what does that mean? That means you bring
in all the tenants of project manage. That means you get your core implementation team
in place, although you probably need to start much sooner than that, right? You needed to
find what is the scope? So you got to bring in that visionary group and you got to get
your buy in from your leadership team and so forth. That's where I would start. Again,
I'll pause and let Ashley and Nate jump in as to what that kind of looks like.
The I guess Ashley, feel free to chime in afterwards with some of the maybe the work
that you've been doing with CIT over the last couple of years. But in terms of the big project,
this has been a multi-year effort even for CIT. We've been talking about zero trust
or that concept and culture that we want to adhere to is I remember talking about this
back in 2018, 2019. We're still not 100% there. So we don't claim to be perfect at this by
any means. But again, that's the like Ashley mentioned that the constant reinventing yourself
and reinventing the processes. So what that looks like, I say at least a three to five
year plan on how you want to roll this out. And then also the budgeting to you know, your
employees are going to have time that they're not working on other projects. So how do you
incorporate that? There is a cost to it as well. So Ashley, anything else you wanted
to chime in?
Yeah, I mean, you definitely need to consider before I mean, deploying anything that affects
users, what that user implementation is going to be like. A lot of times when I do these
types of projects, we're rolling something out like an identity access management solution.
A good chunk of it is just getting the user sort of invested in what they're doing and
understanding why it is that they're being asked to do these things. And then just kind
of teaching them about the technology and helping them understand how it works and making
sure that they don't have any issues using it and then sort of going from there and you
know, people get used to things but making sure you have that plan in place prior to
doing those types of rollouts that you got understanding from users and that they understand
why this is being done. You're always going to get pushed back from people because the
change is hard. But having some type of plan in place to sort of ease that transition with
users.
Yeah, I guess as you're talking about some of that and also you mentioned, you know,
identity and I know identity and I think we talked about this in the first podcast is
that's one of the main steps, right? Just because people are typically the ones that
you're going to trust the least. At the risk of doing acronym soup and maybe Ashley, I'll
have you call off a little bit of the different services that organizations should think about.
So you know, we talked about, hey, you should think about the products or the solutions
that you want to put in place to actually lock a lot of the stuff down. And I guess
before Ashley does her alphabet soup and Todd and I maybe try and pick up a few extra letters
is, you want to think long term about this. So there are solutions. So if you're talking
about multifactor, you can put a multifactor solution in place. You don't want to rip it
out down the road because it didn't fit with something. You should think long term of what
the strategy is. So yeah, actually, if you want to maybe call up some of the different
like solutions, not necessarily products, but the solutions that organizations should
start considering before they start off with some of these different initiatives.
Sure. Can I interrupt real quick? Oh, sure. So, so well, the reason why I wanted to is
because you guys brought up a lot of really good things. And I thought maybe this will
help with organizations as they're trying to think about this and put it into context.
So when we did this for CIT, the first thing we did is we sat down and said, what does
this look like for us long term? Okay, so that's really broad. But we looked at the
architecture of our company and said, traditionally, we were that organization that had a lot of
servers on premise, and we had some of them in a co location. And the question is, does
it continue to be that? And the answer has been no, we've continued to move to cloud
apps and so on and so forth. So as we're looking at that context and saying, our people are
remote, our content, all of our content is in the cloud, the traditional tools that we
may have had in place may not actually be appropriate. And we'll get we'll get into
this VPN hopes, I was gonna say we'll get into the alphabet soup, which is VPN and so
on. But but what that looked like for us is, okay, so if we're looking at multifactor,
is it as simple as x tool or y tool? Or does that tool actually meet what our long term
goal is? And then again, Ashley and Nate brought up excellent comments of, as we're going through
this, this constant communication, the seven times seven ways of just making sure that
we're constantly updating and giving people the context of what are we doing? And why
are we doing this is something that's very important. So sorry, I interrupted, but I
just wanted to make sure people understood that for us, that's how that process began.
And as we were looking at our multifactors, we were starting to go, what does our identity
look like long term? Is it active directory? Is it something else? So I'll be quiet and
go ahead. You can go ahead, Ashley. Yeah, I mean, I totally agree with that. Like, it
doesn't really make sense to implement a product that is more meant to be used for on premise
applications when five years from now, your plan is to be solely in the cloud. So, you
know, wanting to plan out where, where you want to be in over a certain number of years,
making sure that the tools and products that you're looking at that you're implementing
fit that plan. Because yeah, you don't want to spend a lot of time and effort into rolling
something out only to essentially have to rip it out a short time later because you've
decided, you know, going forward, we're going to go solely cloud and now I'm using a product
that's really meant more for on premise functionality. So, but when we're talking about, you know,
tools, products, different types of technology. In the last podcast, we kind of talked about,
you know, once you implement identity and access management, which can be a whole podcast
in and of itself, that's a whole big thing. You really start moving into more of the context
based analysis. So, looking at various different signals that you're collecting via various
tools, some which cover multiple sections of that sort of context space that we kind
of went through, I think it was user context, application context, device context, location
context, network context. So, implementing tools, here's the alphabet soup. So, like
a cathby or a sassy in terms of network context. So, any type of ZTNA, zero trust network access,
MDM solution. So, for device context, where we're looking at and deploying different applications,
software to devices using an MDM solution, like Jamf, like Intune, things like that.
So obviously, you're looking at a lot of different tools that are going to be, some which cover
a wide range of those contexts, but some which are kind of niche and are specific to certain
types of data that you may be wanting to pull in. You know, tools like an EDR solution,
a SIM solution, pulling in some of that more of that risk based information. That's going
to be sort of a step beyond the context based analysis where we're doing more risk based
analysis, looking at some of the ongoing risk of that, of those authentication sessions,
you know, making sure that a device isn't jailbroken, and just continuing to analyze
that risk data even after someone has authenticated and making sure that we're not just saying,
okay, you've authenticated, you're good, we're now going to leave you alone. We're continuing
to look at that information. So if something changes, we can say, hey, this is different
now, this is not good, we're going to tell you that you're cut off from your connection.
So lots of various different tools that can be used for that context based analysis and
also for that more risk based analysis.
I'm gonna let Ashley get a drink of water there. Yeah. So I'm gonna quick pick up a
couple extra letters again on the alphabet soup. I know there's a couple floating. I
internally we joke that there's going to be a whole podcast where I read acronyms for
half hour. So maybe keep in tune on April fools or something like that. But quick other
things and then I'm going to kind of condense that down a little bit further and say, here's
the areas where people tend to go wrong of the implement the wrong solution. And it's
a lot of work to redo. So some of the acronyms that I don't believe Ashley mentioned, a
system collects logs, the some type of application whitelisting tool, a web app firewall or WAF,
vulnerability scanners, network access control, mobile application management, privilege identity
management, privilege access management, data classification policies. There's a lot of
other tools out there that you can bring into the collective strategy. However, I'd say
the ones that most people go wrong on and have to rip it all out is identity and access
management, which we're going to get to of that's why that's our number one recommendation
to start with. And mobile device management and how you actually control your assets within
the environment. With you have some type of mobile device management solution. It doesn't
matter if you're going on prem or on more of a SaaS solution, you can still implement
zero trust. It's just different tool sets. So just from the MDM standpoint, I'm going
to throw out a couple names just because they are widely known. MDT, SCCM for the more on
prem, Intune, Jamf, like Ashley mentioned, you really do not want to have to redo how
you manage all your devices and push it out. That is a ton of work. Most of the other ones
you can rip out pretty easily. But identity access management, mobile device management,
you need to get right off the bat. So I guess the last thing that I had and maybe I'll turn
it over to Todd for some comments before we move on is there's a lot of stuff here, you
know, again, that we can't stress that enough. But there's a couple frameworks that you can
at least start with. So if you don't know where to start, use something that already
exists, right? Don't have to, you don't reinvent the wheel. So Todd, Ashley, I don't know if
there's anything else that you had. But, Taryn?
I would say one thing that's kind of good to know is there are, like I sort of alluded
to, I guess a little bit. But there are certainly tools that you can implement that cover a
wide range of things. So even like an identity access management solution that then can provide
certain types of context-based analysis. So when you're looking at certain tools, just
kind of being able to go through and determine, okay, what context-based abilities does this
tool provide me in addition to certain identity access management tools as well? So it's kind
of nice to look at some of those tools that are more wide ranging and overlapping. So
you're not having to deploy tool after tool after tool after tool. They're very specific
to their little niche.
So one of the things that I kind of wanted to touch on is we covered a ton of ground
there. And I actually love the idea of the acronym thing. At first I was kind of like,
I'm not really sure. But now I'm thinking if we put in a little ding and then had a
definition for each acronym we threw out there, I think it would be fantastic. So we'll pause
the video every time we've got an acronym we slipped in. Circling back to a couple of
the things that we did is because there was so much there when we talked about putting
together the scope of where do you go and where do you find out where we're coming from.
Ultimately what we're talking about is trust. What do you trust? Who do you trust? When
do you do so? So some of the core takeaways are we jumbled it up a little bit. In my opinion,
one of the very first things you need to do is you need to figure out what your asset
management is. And more often than not, that's your JMP, your SCCM, WSUS. A lot of other
partners may use a tool like an automate that comes from an MSP or something like that.
That's the core of what are the things that are on my network? What are the things that
are connecting to my systems? And then ultimately, like we said, it's almost all identity. How
do I identify that? How do I assure that it is the person that they said they are and
how do we move forward from there? And then the last piece, so that's kind of why we talked
about it in that order where we're like identity is number one for us is if you can't identify
who the person is, what the device is and where it's connecting from, you can't implicitly
trust it. And if you can't trust it, it shouldn't be on your network. You kind of have to start
there. But as you're going through this process, again, doing those tenants of project management,
you should always have that component of life cycle. And it's right. So you get a portion
of the way of the implementation and identity and access management as Ashley alluded to
is it's going to be another podcast. It's just too big to not be. But there's components
of it where you say, how do I do this one piece? You implement that piece, you pause
and go, okay, what's changed? Has the world changed? Has security changed? Are threats
different than they were before? What do we now know that we didn't when we started this
process? So that whole life cycle is something we absolutely want to keep in mind as we go
through this. I do have a question that I kind of want to throw out there for the group
too. But I think Tara had a comment. So I'll wait for that comment first. And then I'll
circle back with my my super great question.
Well, I have a super great question too. But I think but just as my question, I'm like
over here, okay, I'm eating the acronym soup, I got it. But a lot of times I think to cybersecurity
can be overwhelming. Because you guys went through all these acronyms, you're like, hey,
there's a lot of frameworks to follow. But if I start with one, you know, of the frameworks,
is that going to be enough? Because we talk about it's ever changing. So if I do that,
then where do I go next? And you know, kind of the logical step and, you know, talk to
me about CIT at work. And they, you know, come into play to help me because if I'm,
you know, one of a potential customers, and I'm, you know, overseeing IT, and I know I
need to get these implemented, but how can you guys help me get through all this? Because
I'm like, all right, which acronym do I need to check off the list to make sure I'm adhering
to all of that?
Yeah, right off the bat, I'm going to call out NIST. NIST is government sector, they
provide framework after framework after framework. Basically, no matter what you're looking for,
there's a framework for it. That's the entire intent of it. So CIT, we tend to tell people
if you don't have any type of compliance that you are mandated to follow, go look at NIST.
It applies to everyone. It's intended to apply to everyone. There are other ones out there.
However, what you'll find is security is security. It doesn't matter if you're in healthcare,
finance, manufacturing, technology, retail, you still got to do the same stuff. And so
there are different frameworks out there, but they all do tie to the same concepts.
And then the reason why I also call out NIST is they do revisions to it over time as well.
So if you are talking about the long term strategy, you need to stay up to date on it.
Great, there's a revision one, there's a revision two, there's a revision three. You don't need
to reinvent it every single time. Now you can cross reference things to say, well, this
one I like how they phrase that. Maybe let's pull in components of it, but it's the same
data at the end of the day that you're trying to protect. So a couple of frameworks. I would
say if you had to start with one at all, and maybe Ashley has some other ones that she
has preferences on, but NIST Zero Trust architecture tenants, that's one of the big ones. There's
a CISA, that's another government sector. There's a whole executive mandate. I believe
that was, gosh, now October or something like last year where the federal government is
adopting Zero Trust. There's Forester's, ZTX framework pillars. But again, at the end of
the day, just start with NIST and you got to start somewhere.
Yeah, CISA one is the one that I feel like is well laid out, but like the name, the word
framework suggests, it's not so specific that it's constantly needing to be updated. It's
written broadly enough so it can be used as sort of a, I guess, a map for all types of
different organizations. So it's not so specific that it needs to be updated every other week.
So yeah, I'm going to circle back to Tara's question and I just want to say, excellent
question. It's a great one, right? If you go through this process, we've talked for
almost a half an hour already and I feel like we've hardly scratched the surface. So obviously
it's a complicated conversation. It's not easy to figure out what, where, how, etc.,
etc. And so when you're asking stuff like that, one of the things I was going to say
at some point too is you're not in it alone. There are people that have gone through this
process before. There's people that are going through it now and there are organizations
out there or coworkers or friends that are more than happy to help you through the process.
So there are plenty of resources available. As Nate and Ashley mentioned, NIST, CISA,
we're using the United States government as kind of our core of this is where we pull
our information is. But the reality is, is most industries are doing more or less the
same thing. Anyway, summary of the story is there's plenty of help out there and there's
plenty of people that can help you with it as well. Kind of answering my own question,
the one that I had hanging out there was as this continues to change and it's really tailing
off of what Tara said was things are changing so quickly. Security is changing. The tools
are changing. So for example, Ashley threw out SASE, which is S-A-S-E. And now they're
actually starting to change the acronym on that too is how do you keep up with that?
And what happens when you start to see a convergence of tools? If you're looking at the market
and cybersecurity, you're seeing acquisitions happen. There are vendors out there that say
traditionally I'll use an example of they used to be SD-WAN in case anybody doesn't
know what that is. That was software defined wireless, I'm sorry, wide area network. So
that was how do I connect my multiple sites without using the traditional infrastructure
that was there? Those organizations are starting to gobble up bits and pieces and they're starting
to put in the CASB, which is your cloud brokers and so on and so forth. And they're trying
to say my network is secure, I'll manage it. And the question I had for the group is what
do you do when this is changing so rapidly? How do you know you've picked the right tool
and how do you keep up with it?
It's a great question. And I really hate this question because it's going to play into one
of those things where we said try and pick tools that fit this long term solution. At
the end of the day, you can't foresee where some of these companies are going. But there
may be a possibility that you rip a tool out. Even at CIT, we've done that. I think this
is there's a couple jokes at CIT internally. We've gone through I think four different
password managers and three different multifactor solutions. And not necessarily the last couple
years. But historically, we've cycled through things. Now we've been on longer term solutions
because we've had quite a bit more forethought into the strategy, into where we're going
over the last couple years. But yes, you may rip out a tool, unfortunately. It's just one
of those ones where if the strategy has changed, you need to be able to shift to keep up with
the strategy. If a vendor is falling behind and not meeting what your strategy looks like,
that's not the vendor for you because it's only going to slow you down. So I'm not an
advocate of just rip and replace all the time, but it will happen at the same time.
Sometimes it can be helpful to just take a look at the types of technology that certain
tools are using. You've seen a particular technology that something is using has been
around for 20 years and now slowly a new type of technology is replacing it. You can kind
of see the writing on the wall that, okay, well maybe down the road this is not, you
know, this 20 year old technology is probably not something that's going to stick around
forever. And so being able to sort of take a look at some of those tools and obviously
see how they fit in with what your plan is, but then taking a look at those technologies
and seeing, okay, in 10 years is this still going to be viable?
Yeah, so to wrap that up, just my feedback on it as well is I agree with everything that
both Ashley and Nate said is the reality is as tools do change, threats change. For example,
a couple years ago everybody was like, antivirus is gold. I don't have to worry about it. It's
not anymore. It just isn't. So that's kind of the way things are. So how do you address
it? I kind of mentioned it before. One of them is you keep doing that refresh of where
are we at today? How did that go? What did we learn that we didn't know a couple days,
couple months ago? That process of keep looking back and revisiting is a way to go. And then
also lean on the partners that you have or your friends and everybody else. It does matter.
So like Nate said, I mean, there's some things where we're like, well, this is the best tool
out there and you kind of shift and move as the world changes. But a lot of times they're
not long agreements or they're not long-term investments. So just doing the best you can,
doing the research, finding the resources around you that help you make that. What is
the vision? What is the strategic objective and connecting the dots for you is great too.
Which hey, by the way, we've got podcasts for that too.
I guess I had one final thing just riding off of Todd. And I think the most important
thing from my takeaway as Todd was talking is collaboration, talking to the peers, talking
to others in the industry. It's no surprise. CIT, we are a MSP. We have competitors. I
talk to other MSPs all the time about the security stacks that they have, what they're
doing, evaluating the competition, not necessarily even from a sales perspective, but just the,
how are we all staying secure together? Because, and we've seen this over and over and over
in the past is when one company gets compromised, it builds distrust against that entire industry
experience. If they had their hack, now the Equifax and all those other ones, Transamerica,
there's a stain on the industry. So as long as we're working together to collaboratively
start security posture over time, that's only a benefit for everyone. So putting a little
bit of pride aside as well and just saying, yes, we're going to work together because
we all benefit together.
Great. I was just going to say, Nate makes a good point about collaboration, understanding
that we can't know, security is a very complicated thing. There are tons of different domains,
different technologies. It continuously evolves and you just kind of have to understand that
you're not going to be able to understand it yourself most of the time. So being able
to collaborate with others and people that have more experience working with particular
technology, have done different deployments of different tools, seeing, getting their
perspectives on how a tool works and how that could potentially work with your plan for
the future and collaborating with lots of different people from different industries,
partners, whatever, so that you're getting enough perspective on something and not just
trying to learn it all yourself, I think it's really important.
Wonderful. Very valid point there, Ashley. I did want to kind of help wrap up the podcast.
I know we talked a lot today and hopefully everybody is full as we all ate the acronym
soup. So I think we're good there. And kind of to that point, it's really just never trust
and always verify with some of these tools and moving that forward. But a big thank you
again to Todd, Nate and Ashley. As you guys can tell, we do love to talk and very passionate
about our certain services that we offer. But if you guys have any feedback ideas for
us in marketing, Kelsey and Sarah, let us know. You can visit cit-net backslash podcast
or you can email info at cit-net.com. And as always, we look forward to chatting with
you about home documentation.