Adopting Zero Trust

Season two, episode 15: We talk ZT History and API security with the godfather of Zero Trust, Dr Zero Trust, and Richard Bird.Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.In the past few years, supply chain attacks and their impacts have or will soon overtake that of the damage done by ransomware. It’s of no surprise then that APIs are a critical attack vector that threat actors like to exploit, yet many organizations do not have a good understanding of how many doors they have running into their data.This week we chat with the godfather of Zero Trust, Dr. Zero Trust, and a chief security officer about the current state of API security maturity. Considering our guests, we, of course, also took the opportunity to chat a bit about Zero Trust's history.This week we have three very special guests:John Kindervag, the creator (godfather) of Zero TrustChase Cunningham, AKA Dr Zero Trust, and the now VP of Market Research for G2Richard Bird, Traceable AI’s Chief Security OfficerKey TakeawaysLike any other cybersecurity concept, APIs must have an asset inventoryThere is enough margin of error tied to the intended use of APIs that require continuous monitoring/verificationThere is a current maturity gap associated with securing the use of APIs in the name of speed and innovation, and often there is not a well-established ownerEditors NoteWe will be taking a publishing break for the month of September as my daughter has arrived, and I will need to catch up on all the sleep I can get. We should be back in October and run through until the holiday break before we wrap season two. I’m also working on a few experimental podcast series during my parental leave, so stay tuned. At least one in particular should be of interest to our audience here. Also, if you work for a cybersecurity org and are interested in launching a podcast, slide into my inbox if you need a hand. Hosted on Acast. See acast.com/privacy for more information.

The podcast discusses the illusion of passwordless technology and how it is not a new concept. It emphasizes the importance of multifactor authentication for successful cybersecurity. The guest, Derek Hanson, shares insights on passwordless concepts, passkeys, and the split between identification and authentication. The podcast also delves into the significance of physical devices and certificates in security practices, explores vulnerabilities of using MFA through smartphones, and highlights the need to move away from SMS OTP for better security.

Global CISO Janet Heins discusses cybersecurity prevention in a global organization like iHeartMedia. Topics include Zero Trust philosophy, prevention measures, challenges in the radio industry, navigating tools in media, OT/IT security intersection, and cultural perspectives in cybersecurity.

Guests discuss the journey towards deep trust in Zero Trust, building a culture of security awareness in product companies, meeting security requirements, and the intersection of compliance and security. They emphasize the importance of multiple layers of trust and the role of security practitioners in guiding the business.

Last episode, we brought to you a wild story of a victim who was SIM-swapped four times, and this week we’re back to basics with some fresh research and a closer look at a critical piece of Zero Trust: Non-federated applications. Cerby’s Chief Trust Officer, Matt Chiodi, was kind enough to add a bit of color to a research report they released at RSA that helps validate what they’ve been building the past 3 years. Before we get to that, it’s worthwhile to define what nonfederated applications are, as, like many cybersecurity concepts, it’s going through an identity crisis. Nonfederated applications are essentially the opposite of how organizations should be inventorying, tracking, and providing access to applications (SaaS platforms are a good example). To align with Zero Trust, or really any modern cybersecurity strategy, SSO, SAML, and other solutions designed to scale are necessary so IT and security teams can properly manage access. However, there are always outliers, which the business still needs access to, such as managing admin access to a social media profile. This brings us back to Matt and the Ponemon Institute, who produced the recent research report: The Hidden Cybersecurity Threat in Organizations: Nonfederated Applications. Hosted on Acast. See acast.com/privacy for more information.

Taking a break from our usual format, this week we chat with a victim-turned-CEO who was hit by SIM-swapping attacks. However, not all harsh starts have to end that way, and Haseeb Awan made the best of a bad situation. After being compromised not once… nor twice, but four times, Haseeb eventually took matters into his own hands and developed a new solution and company, Efani.Haseeb was kind enough to share his personal experience of being SIM swapped where he describes the fear and anxiety felt as a result of the attacks and explained how easy it is to compromise a phone number. Hosted on Acast. See acast.com/privacy for more information.

In this episode, we chat with Phil Vachon, Head of Information Security Architecture at Bloomberg, about how they transformed their security organization with Zero Trust. Zero trust involves three principles: trust but verify, assume compromise, and strong posture. It is a continuing journey, not a destination, requiring a good mindset about implementing controls and reasoning about security architecture.

There’s no avoiding it, the headlines have not been kind to the ways we access systems today. Users are still using 1234, password, and even their dog's name. Not just using these weak passwords but also reusing them across multiple platforms, making it incredibly easy to breach someone once they’ve been caught up in a previous breach. On the vendor side, well we all know what’s happened there in the past 12 months, and now more than ever, password management platforms have growing targets on their back as high-value assets. But we are not here to throw rocks in the glass house nor try to dissect what goes well or goes wrong in these situations; however, we should all focus on what we can take away from them and ensure they are not repeated. This concept aligns well with Zero Trust, where we should assume systems are already breached, that your users - be it intentionally to shitpost in a discord channel or accidentally fall for a phishing lure- and we should remove as much implicit, unchecked trust as possible. At least until Skynet takes us all out, but we have a few good years ahead.  Jokes aside, we have a great episode for you and appreciate Bitwarden lending us two of their C-suite members who cover a range of topics, including how they navigate these challenges. This week we chat with Bitwarden’s CEO Michael Crandell and Chief Customer Officer Gary Orenstein. Bitwarden offers an integrated open-source password management solution for individuals, teams, and business organizations. It also offers a self-hosted solution, which appeals to those who want greater control over their secrets.Key TakeawaysThe use of a Zero Knowledge architecture means that the company, whether cloud-hosted or self-hosted, should not be able to access sensitive information without the user's permission.Open-sourced solutions offer additional layers of trust as there are more eyes are on the product and can vet it for securityPasswordless authentication is the future Hosted on Acast. See acast.com/privacy for more information.

For many, cybersecurity is seen as a cost center that reduces risk to the business. This can be oversimplified to something akin to how HR reduces people-related risks but comes with layer on top of layer of complexities ranging from technology to physical buildings and, of course, people. Regardless of organizational size, cybersecurity leadership requires a top-down approach, leaving room for discussion at the board level and aligning it with business goals.This week on AZT, Neal and I chat with Kris Lovejoy, Kyndryl’s (IBM spinoff) Global Security and Resilience Leader, former CEO of Virginia-based BluVector, and a former IBM CISO prior to being made GM of their security division. Having danced the line between startups and mega-enterprise organizations, there are few others who could so adequately discuss the role of cybersecurity leadership within modern organizations and why having a competent person at the helm is critical to the business (not just to reduce risk). We also play a bit of RSA buzzword bingo. Hosted on Acast. See acast.com/privacy for more information.

AJ Grotto, cybersecurity expert and Stanford Fellow, discusses the lack of innovation in government cybersecurity and the challenges of scaling innovations. The speakers also explore cybersecurity regulations, the impact of budgets on cybersecurity innovation, and suggest solutions like dedicated budgets and revolving capital funds.