Episode 69: Junaid Islam on Zero Trust Architecture

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda.

Loop.Com hello, I'm Bob Gourley, the chief technology officer with OODA LLC. Today on the OODaCast. Junaid Islam Junaid is a senior partner at OODA. I've worked with him for years and watched him firsthand as he helps organizations understand how to improve what they do through smart network design. Junaid, I want to mention a couple other things about you. I've always had a deep respect for your ability to contribute to national security missions. You got your start serving around the timeframe of Operation Desert Shield. You've also spent a lot of time investigating cyber attacks. You've done direct contributions to a lot of security protocols and networking protocols, including MPLS, MLPP mobile, ITV6 software, defined parameters, and other zero trust kind of architectures. Welcome Junaid.

Great, great. Thanks for having me.

Another thing I really like about you is your writing and ideas that you put out on CTO Vision and OODA Loop and I'll be linking to a lot of those in our show notes here. But today would really like to talk to you more about this concept of zero trust and Zero Trust architectures. I think you are well positioned to tell us where this concept came from. Would you give us your view of the history of Zero Trust?

Sure, sure. So the word zero trust, a lot of people think it's a new concept that's only been around. Actually, the Zero trust concept has been around for quite a long time. You kind of mentioned that I had started my career before Operation Desert Shield. For those people, it's like the first Gulf War. It's like 30 years ago. And I started my career as an equipment installer for the US government. At that time, the US government was installing encrypted faxes as well as encrypted x25 devices. I asked people why there's an extra box beside the X25 pad. And they would say, well, we have zero trust in the public service, so we have to create an overlay network. The actual idea of zero trust actually came from the US national security kind of establishment as a way to in those days counter. You're going to laugh, you know, inside attacks at phone companies where, you know, the people would get into a phone company and tap lines and then copy faxes or people would get onto the data network and look at the packets. Right. And what's kind of funny is after 30 years, we're talking about the same thing now, but at an even bigger scale than before.

Well, I'm with you. I have seen the creation of zero trust concepts from the national security perspective. It's this whole need to be able to communicate while your adversaries are watching you.

That's right, because I think in your case you had looked a lot at the old Soviet Union and how they would spy on everybody, including their own people. And now the interesting thing, decades later, our own phones are spying on us. So we have to be careful about what we say. So the idea of a zero trust architecture, if anything, is even more pervasive now than back then.

Right. So zero trust did have some roots in the national security establishment, but it's also totally relevant to the corporate world. Of course, and I wanted to ask your context there. How does the zero trust architecture translate to corporate America?

So here's the incredible thing. What started purely for national security purposes and actually for coalition networking, how does the US work with a partner over a public network? And I'm talking from 30 years ago, we find that is very relevant today because today companies are now a mix of companies and entities. They have employers, they have consultants, contractors, but then they have outsourced personnel who handle entire functions like HR or supply chain. We also have computers in the company mixed in with cloud services. So there's those. No notion of inside or outside or my resource or your resource. It's all kind of blended. So if anything, this notion of having a zero trust architecture is actually kind of relevant to companies because there's nothing the company owns anymore. All companies today are highly reliant on supply chain partners. And the partner might be great, nice person, but what about their architecture? They might have a breach in their network that they don't know about that's now going to affect you. So we need to have not only a zero trust model for ourselves, but extend that model into our partners, our contractors and consultants.

Yeah. And to do this, you know, a key point that I have seen is all of these companies have their own legacy architecture. And the bigger they are, the older that architecture seems to be. So everybody's at a different spot on their journey towards a zero trust architecture. And I just wanted to ask your views. Where do you start and what do you recommend companies do first?

The most important thing is to really look at your own operational model. You know, really take time to understand what's the workflow. Companies have changed so much in the last decades. It's pretty, not. It's pretty normal for a company not to even know how it operates, you know, because somebody might have outsourced hr, somebody might have brought a new franchise partner, somebody might be using a new. So you need to get everybody together to figure out what's going on and, and also understand some of these people you're partnering with, some of how are they an entity or have they really outsourced? Right. First step, figure out your operational model. Then look and identify all the cyber risks that are creating in that architecture. Identify the vulnerabilities. After that, start bringing in these concepts of a zero trust architecture with the partitioning. You know, how do we partition our external partners who are maybe handling the shipping of goods from people who are specifically handling funds transfer or payments to supply chain or consumer data which is protected by law in the United States and Europe. Right. So we really want to start doing that at the beginning. You know, do the, do the analysis and assessment first. That's foundational in the zero trust architecture.

Great. And then architecture is design. So first you do the design, then you find gaps, and then you address those gaps with products or services. And I wanted to underscore that because as I've learned from you, you don't just reach out and try filling the gaps before you even identify them.

That's right. That's right. So one of the biggest mistakes people make is they get excited about the zero trust marketing or some zero trust product, and then they buy it and it doesn't give them what they want. So let me give you a simple example. A lot of companies operate flat networks and they'll see a zero trust access control product or service, you know, and they'll go buy it. But the problem is you have people with different roles all resolving or connecting to a flat network. So you've kind of lost the whole benefit. What they really need to do is think about a zero trust architecture where their corporate resources are partitioned by role and by risk. And then before they buy a product and service, see what they can do with their existing technologies. What can they do with Active Directory or Ping or Okta in terms of having different levels of authorization? What can they do with existing firewalls to create some partitioning, see how close they can get. And then once they figure out what the gap is, then you pull in the products and services and software, the zero trust, and then kind of fill out your architecture.

Perfect makes perfect exam, a perfect perfect sense. Can you give me an example of how this could be implemented? What's the next step? You do the architecture, you find the gaps, you decide to fill the gaps. What's next?

Well, then the part is Actually looking through the collection of zero trust, you know, product services and software. So for example, I mean, the good news is we actually have a great set of vendors out there. There's people all the way from Palo Alto who have zero trust gateways. They were one of the first to people like Illumio who are doing server to server zero trust isolation. There's people like Zscaler who have a zero trust access product, which is great. There's newer companies like XQ Message that have zero trust data protection that encrypt data and only unlock that data based on identity and authorization. The good news is there's a lot of great products out there, services and software. But first figure out the architecture, see how far you can get with what you've got and then fill out the rest. If you do it that way, you will find a zero trust architecture not only reduces risk but, but actually can help rationalize the number of security products and services you're buying. Because now you're doing everything on a risk basis.

Yeah. So if you can reduce the number of security products that you are buying, there's a good chance you can reduce your security spend.

That's right.

And maybe even reduce your complexity. Nobody likes extra complexity. That doesn't add any value. And reducing security spend and security complexity should be increasing your agility and just seems virtuous.

That's right. One of the mistakes companies make now, and it's a common mistake, is they hear about cyber attacks and they will try to implement a high level of security posture throughout their entire organization, even asking their suppliers to do things or their contractors. And that actually backfires because then they have so many complicated things and, and they're pushing this on all the users, non employees. It backfires the converse. The zero trust architecture is actually the right way to do it. Think about an architecture that's partitioned where people because of their authorization have access. And then the high risk partitions, we can have more controls there. But for the low risk we can use appropriate levels of technology. So definitely that allows us to be way more agile. Because not everybody in the company needs access to your bank. And if they did, that sounds really odd that even a supply chain partner can access your bank account. No, no, that should be like a few people and some other people handling the intellectual property and some other people handling legal. And then you might have people you know, who are, who are outsourced and helping. They can be on a different system with a different risk posture.

And Junaid, I have seen firsthand you help companies out in doing this, and we have done a lot of design work, a lot of security work. And I just wanted to mention a logical next step would be to.

What? Well, people are more than happy, more than welcome to connect to me via LinkedIn. I'm happy to talk to them and share my ideas. Also, there is, I believe, a Zero Trust paper on OODA Loop that I'd encourage people to just take a look at. And it reflects a lot of the content we've discussed, which is, you know, Zero Trust is really about, you know, improving your operational posture. And. Yeah, I mean, the good news is there's a. There's a lot of great information. So please do contact me on LinkedIn and would love to help people any way I can.

Great. Well, I'll put a link to your LinkedIn profile in the show Notes here as well as a link to that paper.

Great.

Thanks, Junaid.

All right, thanks for your time.

Thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.oodaloop.com.