Adopting Zero Trust with Bloomberg: Implemented

May 25, 2023

In this episode, we chat with Phil Vachon, Head of Information Security Architecture at Bloomberg, about how they transformed their security organization with Zero Trust. Zero trust involves three principles: trust but verify, assume compromise, and strong posture. It is a continuing journey, not a destination, requiring a good mindset about implementing controls and reasoning about security architecture.

Ask episode

Chapters

Transcript

Episode notes

Introduction

00:00 • 2min

The Concept and Principles of Zero Trust

02:00 • 14min

Advantages of Owning and Controlling Tools, Security Through Obscurity

16:09 • 2min

Ordering Security Badges and Evolving Threat Actors

17:42 • 1min

The Evolution of a Technology Company

18:53 • 30min

Making Technology Accessible and Implementing Zero Trust

49:11 • 3min

Season two, episode nine: Featuring Bloomberg’s Head of Information Security Architecture and the Information Security Program, Phil Vachon.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.

What does implementing a Zero Trust strategy actually look like in an organization? Nearly a year into our podcast’s journey covering how practitioners view, define, and apply zero trust, it’s time to look under the hood at how a notable organization put its strategy into motion. This week we chat with Bloomberg’s Head of Information Security Architecture and the Information Security Program, Phil Vachon, about how they transformed their security organization with Zero Trust.

Most interestingly though, while many organizations are just now exploring how they will start their zero trust journey, Bloomberg was ahead of the curve even before covid thrust the concept into the limelight.

“I will always say it is continuing to be a journey. It's not a destination,” said Vachon.

Key Takeaways Zero Trust Principles

Zero trust is not a new concept but has been repackaged and branded as a solid ideology.
Zero trust involves three principles: trust but verify, assume compromise, and strong posture.

Zero Trust Journey

Zero trust is a continuing journey, not a destination.
Zero trust requires a good mindset about how to implement controls and how to reason about security architecture.
Zero trust is not just about securing the corporate IT estate but also about securing the data center estate and the communications between components.

Challenges in Implementing Zero Trust

Balancing security with usability is a challenge that must be addressed to enable a high-collaboration, low-friction workflow.
Bloomberg leverages many SaaS services for collaboration, but they also have their own core services that are still on-premises. They focus heavily on their offerings on-premises and have a big drink-your-own champagne culture around them.