Cybersecurity Vault podcast - How Zero Trust is Crucial to Innovation

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, cybersecurity strategist and CISO at Eclipse. Today, we're going to talk about how zero trust is crucial to digital innovation. And I have a special guest. I'm going to be talking with Ingrid Valsiliu-Filtes. Did I get that right, Ingrid?

Vassilio Feltus, very close.

Vassilio Feltus, yes. Now, Ingrid is a healthcare executive, a futurist and globalist who is highly dedicated to digital and ethics advocacy. She's a Forbes Business Council member, digital strategist, passionate educator, and board advisor, as well as consultant. And I've known Ingrid for many years now, have had the pleasure of working with her on all sorts of different projects, So I am so happy to have you here, Ingrid. And one little plug here, today's podcast is created in part by Eclipse, securing data in transit through any cloud network or device. Welcome, Ingrid. Thank you again coming and talking with us.

It's a pleasure. I know we planned this for a long time, so finally we get a chance to talk about things that we're both very passionate about.

Finally. Yes, yes. This has been in the works for a while. So let's dive into it. Zero trust, it's the buzzword in the industry. Governments have said, oh, we're going to move towards this. Some people think it's a particular box or tool. And, you know, it's the discussion around what it is has been around for a while. Can you kind of, in your words, tell us what is zero trust and why it's so critical?

Thank you. So first, I wanted to highlight that it's a concept, and the concept makes us think about the fact that you should not trust anyone and verify everything, everybody, and that means devices, people, and data exchanges, as well as any type of transactions. So that's the first thing, concept. The second thing is it involves a complex process. Zero trust is not a project that just ends that has a finite start and endpoint. It's an ongoing process. So when you think about zero trust, you want to create a zero trust environment, a zero trust architecture, a zero trust culture, and it's a never-ending quality improvement project because if you don't, you're going to have problems and negative consequences. The third part I would say is it's a combination of, technology, mindset, diligence, QA/QI, and innovation, which you highlighted already. That's how I like to think about it. And that's why when we're gonna maybe later talk about challenges of zero trust, I think that's one of the challenges. It doesn't fit into anybody's clear jurisdiction. A lot of cross-disciplinary and interdisciplinary Efforts have to be made to deploy it the right way. And also maybe just to highlight, maybe we get a chance to talk, the typical budgeting in organizations doesn't work for zero trust. The typical compliance doesn't work because you're gonna have to hit multiple areas. The typical quality metrics that the company's accustomed to tracking don't work. Work. So it requires a profound transformation the way the organization or the enterprise runs, uh, their other operations, not just cybersecurity. And I think that's the biggest challenge that I see.

So you're talking about a lot of fundamental changes or differences, but, you know, I mean, we've got banking today, we've got healthcare today. I mean, don't we already do security? Don't we already do checks? I mean, You know, what in your mind is that delineation between what zero trust is and what we have today? What's the big change that people really have to kind of comprehend in their mind?

So yes, you're right there. Of course, organizations, no one is going to tell you we don't have any cybersecurity in place. Most large organizations have, but one of the major trends that we see is that many organizations still have a static cybersecurity system as opposed to a dynamic, continuous, continuously adjusting cybersecurity. And that means also from a technology and like hardware and software optimization perspective, but also how they allow new entrants into that safe environment, how they manage transactions. So it's all static and one way in, one way out. And that unfortunately opens them up for a lot of problems. When we think about zero trust, it's a completely different perspective because you'll have, like we mentioned, an ecosystem, if you will. I know that word is overused, but it's a cyber ecosystem where you really have to devote much more resources and not have this static environment. And that means, like we just highlighted a few minutes ago, to authenticate every device, every user for every transaction and every data exchange. So in a traditional, let's say, take healthcare or financial industry setting. If I am an authenticated user at the beginning of my employment and I have a user ID and password, I'm in. Now I might have specific sections that I'm not allowed to access, like based on my role, but that's the traditional way. The zero trust would be, it doesn't matter who I am, it doesn't matter what access I have, you're gonna still authenticate and verify everything I do in that environment. And that includes all the devices I'm using to access it. So it's not only based on my role and the user ID and password, but more importantly, based on the transactions and the access that I'm having at any given time. I don't know if that resonates.

No, it does. I mean, the real difference is, you know, our normal traditional login with our username and our password, it's very, very shallow. Once we get past that, We get to go anywhere we want, and there's very little checks in the background, whereas Zero Trust starts adding that depth. Okay, you've logged in, you can get this one resource. Oh, you want to go over here? All right, we're going to check again to make sure you, you are who you say you are, and maybe the machine you're using is secure, and maybe the network path that you're taking is also secure. And so you start getting much more depth And so it's not, okay, I'm in and therefore I have access to everything I normally have access to. There's just continual checks, which creates friction for bad people trying to do bad things or attackers trying to get in. It's not just break through, you know, one wall. It's a whole complex maze that you're constantly checking. But it also sounds like, well, that's a lot of work. I mean, to be able to do that. Okay. Before we get into some of the potential issues and downsides and costs, I love where your mind was going there with costs because there's always a cost to security. Where is this most applicable to? Because, okay, I go to my crossword site. Does the crossword site really need zero trust? Or, you know, we hear a lot for like the US government has said, hey, we're going to transition to zero trust. We're going all in on it. It's in executive orders now, things of that sort. There's been talk about critical infrastructure, right? Power, water, food distribution, sanitation, all those kinds of things. Where's the right fit or maybe what's the priority in your mind?

Well, I'm not sure if in my mind, but what I've seen is definitely organizations that are functioning in highly regulated industries are first. So we've seen the FAA, NASA, Chevron, just to give a few examples, move towards zero trust and yes, governments are highlighting the need for that due to, frankly, security issues that are national or international in nature. So industries that have also potentially catastrophic consequences for all humanity, such as nuclear industry, power, water, like you already highlighted. But in general, yes, wherever you have data that can affect people privacy or societal privacy, or potential harm, physical harm to people or society at large have been traditionally moving faster towards this type of environment. And people think it's a new concept, but there have been articles published for many years on zero trust. It was, until now it was a nice to have. Now it has become an imperative, I think, because people have realized with the increases in cyber, threats and cyber attacks that if they do not do this, all the other traditional methods seem to not work. I mean, we've been investing massive amounts in cyber insurance, cyber, traditional cybersecurity methods, and we still have breaches in the $6 trillion per year globally. So if you think about it, I saw this very nice article that highlighted that cybersecurity consequences are like a separate economy. And it's the largest economy in the world. Unfortunately, a bad economy, but it is the largest one. So it's bigger than any GDP currently. So that shows the magnitude. And I think that's where we see this transition now for organizations. But to your point with the crossword puzzle, yeah, I don't think anybody's gonna care what my previous crossword puzzles or my Sudokus look like. Now, if that's an entry point, just, Yeah. Although just maybe is worth one more point to make for our audience. Although if that, if I use the same password for that, like for everything else in my banking and my healthcare, then it is a problem, which just to specify that sometimes malicious actors use one entry point that might seem safe. And people say, well, who cares if I put my birthday here? Cause no one cares about this. Yeah, but they can use it as a, Trojan entry point, right? And then they can get to the other things.

Right. Credential stuffing. Ah, yes, we love that. So always have unique passwords, never reuse them. Okay, so less on the crossword, more on, you mentioned, you know, nuclear agencies and things of that sort. Very, very important. Are you saying they're done and we don't have to worry about that? Or, I mean, where, where is the industry right now in developing and implementing, I guess, this, the Zero Trust methodology?

So I think the industry is in an evolving and maturing state, like a wine or a cheese, if you will. So I see a lot of organizations that have started planning and have maybe deployed pilots or the beginning stages. As some of our audience might be familiar, you have different levels of readiness and different levels of maturity for Zero Trust. Zero trust architecture. So some organizations have the whole strategic roadmap and have embarked on that journey, so to speak, on the, on the zero trust journey. Others are just in the planning stages. Others are, you know, avoiding to even think about it. So I think we see the full spectrum, but definitely since last March, when some of the major players have announced that they are transitioning towards that, and some of the regulatory guidelines have said that, it's gonna have to be a requirement by, you know, 5 years from now. For instance, healthcare, maybe some of our audience members are in healthcare. Until now, you never heard anybody talking about zero trust at a healthcare conference, and now everybody's talking about it. And that start— so it started last summer when HHS put out a warning that all our imaging devices hadn't been updated in 20-something years. So they're again, a great example analogy to your puzzle. You are putting millions or billions of dollars in cybersecurity for hospital systems, but then you don't secure your MRI or your nuclear, whatever other department, CT scanner or Betatron. And then unfortunately they can access private data from there. So again, same example. I think we see stages of deployment, but I think majority of the organizations are at the beginning stages. No one that I'm aware of has, that is in a large organization, has fully deployed across all their headquarters, all their locations. And that's another, I think, part worth mentioning, 'cause you asked where does it end? Like we mentioned earlier, it never ends. So once you make this commitment, you need to continuously update it. I call it like the brushing teeth, right? You cannot just say, okay, I brush my teeth today, I'm done. So the same way with zero trust, you have to, If you're in it, you have to continue and dedicate the right resources. That means human capital and dollars.

Yeah, and I think that's one of the biggest misnomers because everybody is talking about zero trust and a lot of people think, oh, this is what's going to solve cybersecurity. We implement this and we're done. One-time investment, pull the Band-Aid off. Let's get this done and move on with life. Cybersecurity and cyberattacks are a thing of the past. And that's— unfortunately, that's just wrong, right? We have an escalating war with intelligent attackers, and right now they're ahead. We see zero trust as the way to at least reach parity and maybe a little bit further, but they're going to adapt, and we have to continually invest and adjust to what they're doing. It's just that zero trust gives us a whole new set of capabilities and tools which can evolve, you know, with the attackers that give us an advantage. Without it, we're left in the dust and we just become more victimized. But a lot of people think it's, "Oh, that's the magic box." And I mean, do you hear that as well? I hear that from people and it frustrates me.

I like to sarcastically say, "It's not like an iPhone that comes in a box, you plug it in and you're done and you can relax." It's not like that. So, you have to dedicate, and it's enterprise-wide, resources. That's another thing. And I, I've also noticed, because you asked what type of companies, I think I see the trend multinational companies, multiple locations where each of the locations maybe has another cloud, another software system, another type of configuration in the way they started their, let's say, business operations at that time. So different phases at different stages of cybersecurity or different layers. And I think there you really have an urgency to deploy it because they're wide open. And I've seen that. So for instance, large organizations that are in 30-something countries, each of the countries might have their own cloud, their own server, their own gateway type, their own, who knows how many software systems that they're using to run operations. Imagine that's like a bonanza for cyber. Attacks. So that's why you see them deploying first.

Yeah. And the whole concept of, you know, you know, micro authentication and segmentation, it's great to talk about. But what that really means is you can't just put a security wrapper around things. You have to understand the nuances in every application and every, you know, version of equipment and, and be able to integrate in with those and then stay integrated as the environment changes. And so it's a lot of work. And you had mentioned cost, because there's always cost with security, right? Whether it's the investment dollars, whether it's integration costs, whether it's the sustaining cost, or simply the cost of the friction that it introduces, right? Nobody liked it when we introduced passwords or strong passwords. That's going to slow me down. Right? Don't want that. You know, now we're talking micro-segmentation and multiple types of authentication, not just authenticating users, but also devices and network paths and everything else. Talk to me about the cost, because again, this is a concept. This isn't a one-time, one-shot line item on the budget, and we have to be able to explain it to the CEO and to the boards. To justify it. Tell me about cost. Is this gonna bankrupt companies? Is this 10x what we're gonna have to pay every year for what we're currently investing? What are your thoughts here?

I, the way I like to describe it is not about the amount because there are massive amounts spent on cybersecurity now and it's still not working very well. And then on top of that—

Hey now, wait a second. Okay, okay.

Not in your case, not in your case, but across the world, we know that there are still the same industries that are in the top 10 that have had had cyber attacks that yielded severe consequences, right? And the average cost per cyber attack is $4.5 million per attack. That's an average internationally. US, unfortunately, is up, up high on top for the wrong reasons. Our costs are even higher. And healthcare and financial industries are the highest. So if you— it depends how you calculate. If when you do your long-term strategic budget, you take into consideration how much you're spending on cyber insurance, how much your premium will go up if you get the threat, even if your insurance covers, then definitely you're gonna have a better balance. But yes, there is an upfront— that's the difference. It might end up the same or less long term, but upfront you need to put much more money, and that's the difference, and that's where people have a hard time. The second thing is it's not fitting neatly into the one-year budget. And it certainly doesn't fit neatly into the quarterly earnings calls to say, oh, we deployed this much money and we're seeing quarterly results. So you put a lot of capital investment up front. The budgeting cycle needs to be way longer than anything else you do in the organization. Maybe ethics comes close to that, which we don't have to talk today. And then the third part is also you don't have anything to report for a long time to show the benefits, right?

Well, hopefully you have nothing to report, but that's the benefit, right? I don't have to report a breach. I don't have to report attack or downtime or anything.

So that's the biggest problem, that there's nothing to fit in an Excel sheet to show other things. So it's an inverse metric, right? It's a cost avoidance, cost savings, and that doesn't look good because you can't show it. And it's very difficult because most organizations expect this to work well. So very difficult to show. And the only way you can show it is, look, all our peers, all our competitors are in our industry out of 100 organizations, of organizations, 90 were having a cyber attack and it cost them this much and we didn't, but that doesn't fit very nicely into a budget unless you do a reserve. So I've seen it done well, if our audience maybe cares, the same way you do reserves for audits, right? Or in revenue cycle management, for instance, in healthcare, you do a reserve because you don't ever know what kind of claims you'll have that might need appeals or that might be, lawsuit or so forth. So the same way boards do risk reserves and revenue cycle reserves, or, or health plans, or any other insurance companies have that reserve, the same way you can do the budgeting for zero trust. You put a reserve and that's there, and if you don't use it, you can keep showing it on your balance sheet. That's the only way it works for boards to tolerate it.

No, I like that. I think that's a great concept because again, if security works perfectly bad things don't happen. But then how do you measure what didn't happen? That, that'd be, that's the biggest problem in cybersecurity metrics, but it is a big potential cost, probably more than what organizations are spending now. And that is a tough, tough, tough pill for C-level executives, for boards to swallow because security is not in most cases, a revenue generating organization. And that's really what profits and, you know, what garners the attention. Okay, so it costs a lot depending on your organization. There's no perfect cookie-cutter implementation. It's not just a single tool or single box that you can buy and, or service that you can spend on and, you know, make it look nice and easy in the budget. How do we potentially over time reduce some of those costs, right? Is there innovation, blockchain, AI, quantum, things like that that you see? Because I know you work in all these different areas, right? Do you see evolving technologies able to come in and either reduce the cost or improve the delivery of risk reduction? What do you see?

I actually do. Have a lot of ideas on this, and there are many that have implemented already pockets. Unfortunately, organizations are not always ready to deploy all these converging technologies for some of the same reasons like we mentioned, zero trust. But yes, so the first one I would mention is blockchain can give you some advantages, but it depends which kind of blockchain. So for our audience, we just want to clarify, there are many types of blockchain technologies. There are multiple generations of blockchain technologies. And the ones that we're gonna refer to today are the latest generations. And specifically when we talk zero trust, you might need to have a hybrid of private and public or a consortium of blockchains to actually get the job done, particularly if you're a multinational company. So that's one. The second one—

Well, hold on, before you do that, let me just clarify. So, you know, you had mentioned hybrid, right? When we think Bitcoin, we think public blockchain, everybody can see it. And then if you imagine a blockchain that only your company can see and nobody outside of that, that's a private. Hybrid normally is, it's a private one, but you've opened it up maybe to trusted suppliers or partners or customers. So it's kind of control. It's not the world can see everything all the time. It's very much controlled by the organization, hence security, right? So that's what we're talking about when you said hybrid, correct?

Correct. Correct. And then there's another layer just for our audience to make sure, because I see a lot of miscommunication sometimes in social media. You, even if you deploy a blockchain technology for anything, doesn't matter what the use case is, you don't have to put all the information on the chain. Only the information that's absolutely necessary you need to put on the chain. So the art in deploying blockchain is to select the right use case, to select the right type of generation of blockchain, to decide if it's going to be a hybrid, a private, or a public. And the most important part is what belongs on it and what doesn't belong on it, right?

And we see that in healthcare, right? Especially in healthcare.

And then also in the financial industry, right? So let's take as an example banks. They need certain information to just stay within the bank, but then they need other information that they need to interact with other banks to do the transactions, such as Zelle is a great example, right? You, you share only a certain amount of information that's required to make that transaction, to transfer money. You don't need to share all my bank account and everything I did with anyone else, your history and all that.

You don't need all that, right?

But so to decide what goes on the chain is very important. There are certain sophisticated blockchains now that also allow you to have like a blockchain within a blockchain, and it's not about private or public, but it's like an enclave, like a a more secure area. And so there are a lot of tricks. So I caution everyone, when you say blockchain, there's so many nuances there. You have to specify all these things, otherwise a lot of confusion can happen because it's completely different. It's like talking about Mars or Jupiter if you talk about a private blockchain or a public blockchain.

A crayon's not a crayon, right? There's 16 colors today, there's going to be 64 tomorrow, and 128 different colors the day after that. Same kind of thing with blockchain.

Now, some of the recent social media examples where breaches happened and people say, oh, it was supposed to be secure, how come it happened with blockchain? Well, there are blockchain connectors. People need to integrate the blockchain into the rest of the enterprise. And the problem is, like we talked before with your nice, you know, puzzle, word puzzle analogy, If the connector you're using is not safe, well then you can have all the safe blockchain, whatever cybersecurity solution that you want because you opened up the gate. So that was a very famous one. I'm not gonna mention the name that happened recently where the connector was not right. So again, like we always say, everything has to be in place to function. So blockchain technology is one. The second one that I specifically love, and I came to know it also when I was involved with precision medicine and genomics. I, I learned the first time about it, and I was like mesmerized and became very much focused on it, which is federated learning. So combining federated learning with blockchain in a zero-trust architecture has a lot of benefits and almost no negative consequence. And the nice thing is the extra cost is not that much. So if you're gonna do zero trust, having federated learning is not gonna be an exponential additional cost and the benefits are endless.

Okay, so define what federated learning is because there's all sorts of different stuff within the AI area and whatnot.

Well, to keep it simple for our audience, you usually, when you analyze data, most people think that you need to analyze it by decrypting it. The beautiful thing is when you do federated learning is that you can analyze data without decrypting it. And what does that mean? And why do we care about it? And why do we care about it in a zero trust context? So let's pretend I'm a multinational company and I function in 40 countries in 5 continents. And the mothership, the headquarters wants to see a dashboard for all these locations. But guess what? All these locations in the 14, in the 40 countries have, like we talked earlier, their own cloud that they use, their own servers, their own gateways, their own devices, their own people, their own, who knows how many software systems that need to be secured. So by having now a federated learning model that's complementing your zero trust architecture, you can start to get all the data, but keep their private clouds and analyze the data to gain strategic intelligence that helps you without having to violate their privacy or their, or make them change their current operations or worry that their competitive edge is being lost or their IP or whatever else they're worried about. And the benefit to that for a zero trust environment is, you know, there are multiple, but at least 3 big ones I would like to mention. One is you can, of course, react faster to whatever threats, because we know everybody's going to get attacked. Zero trust doesn't mean you're not going to get attacked. You're just going to be able to manage it better. So reaction time is faster. Even if you get attacked, the postmortem to detect the source and to mitigate it is way faster. Than without. And then the third, which is the most important part, even if we didn't have the first two ones, is that you can start to predict, because that's the whole point to do the predictive analytics and to decrypt this data. You can start to predict where are our vulnerabilities, where can we actually bolster our defenses, where do we see that we have vulnerabilities that, you know, are constantly exposing us to risk. Is it inside or outside? And that predictive capability while preserving everybody's privacy is very important. So I am a big fan of deploying it and it works for all industries. It's industry agnostic and everybody, when you tell them that they can maintain their privacy, they love it. Privacy as an organization even, right? Even if they belong to, 'cause most organizations say, well, aren't they part of the same headquarters? They are, but there are competitive edges even between countries and between the same company markets, right? And you want to protect your IP. IP. And then from a practical perspective, they don't want to change if they just deployed, you know, who knows what amazing software or their private cloud. And now you tell them, what, you have to change? No. So the federated learning is like an umbrella coverage on top, and they don't have to change anything they're doing now, but you can provide this extra layer. So it's been a much easier sell and a much better reaction. I think this is the most palatable one that I, I see when I present that.

Well, from a security perspective, because you were saying it still preserves their privacy, which it absolutely does, but with the security lens, it also preserves your security. And think about, you know, 3 different organizations that need to be able to share data to be able to do predictive analysis, to be able to gain the benefits of what each, you know, company organization has, but they have 3 different levels of security or 3 different types of systems or risk acceptance. That's really tough. You can't just open— if you're more secure than the other one, you just can't open your world to them because now you're, you know, they're the weakest link. So federated learning allows us to preserve our own security while still being able to share discreetly the information that's necessary without undermining our security posture. So It's a great thing from a security, not just a privacy perspective, but also a security perspective.

And the other beautiful thing that I forgot to mention is that you can share the strategic intelligence to everyone. So everybody benefits from all the analytics, even if they just contributed a tiny portion. So to give you examples in healthcare that maybe are more relevant for, for our audience, so your data Physician practice data, hospital data, payer data, pharmacy data, laboratory data. Let's just take this like basics, okay? We're not going to complicate it. Imagine if you want to analyze this data, the reason why we're still having these lags in healthcare currently to maybe analyze the data the way we would like to is because of not being able to share. Now imagine if you can do federated learning Health plans, hospitals, doctors, pharmacies, laboratories, imaging centers, everybody can share without losing the security or privacy and can gain the benefits, for instance, for equitable health or for better impact and whatever else you wanna do. Research. Research, exactly. So you can see how in any type of industry, and we can go over multiple examples. Like, like that. Pharma industry is another great one. Supply chain, many other things. Air security would be another one, right? So the idea is that if you can share this strategic intelligence with every stakeholder and every stakeholder still feels like their security is preserved and their privacy and their IP, because that's what they also worry is preserved, then it works much better.

Yeah. One of the areas that I see this really coming into play is actually voting systems. Systems, right? You know, when, when you've cast a vote, they need to validate your identity, and then you get to vote. You know, when you're tabulating the votes, you don't need to know that person's identity, so you can compartmentalize this stuff. But you need to absolutely be able to, to make sure that there is a one-to-one connection and all those things. So, you know, I'm seeing in the, you know, the voting industries that they're, they're moving towards something like this because you also mentioned you know, being able to analyze data without decrypting it, right? So if you look at something like homomorphic encryption, which is exactly that, there may be encrypted data that I voted— Matthew voted for something that's encrypted, but federated learning can come in and without decrypting to know I voted or who I am, they can at least tabulate what my vote was. Without ever decrypting the data. So they don't know. So if that system ever gets compromised, they don't know who I am and what I particularly voted. So, you know, that those kinds of compartmentalization and yet attestation to make sure you still have the right data that you need, but only the data that you need is really powerful. And that goes back to kind of what you were talking about with the cost and the benefit. It may not fit on a line very well saying we need to invest in zero trust, but when you can say in doing so, it can enable federated learning and secure that, now you've got all this research and development, you've got all this competitive advantage, you've got all these other things. Those are wonderful things to talk about to the board and to be able to quantify what is the economic value to the organization in having that. That's where you start getting into amplification. That's where you start getting into the, I think, the true value where we see zero trust potentially going.

Absolutely. And then if, do we have time for one more or no?

Yeah, one more, one more. Let's do one more here. What do you got?

Well, digital twins, I think digital twins are my passion and I have a book coming out soon on that, but I think definitely digital twin technology can be one of the future potential weapons as well that we have because they, they allow— again, if imagine a cyber digital twin that constantly runs the analysis and allows you to secure everything. So when we talked about, when you asked me when does it end and how much do you need to budget, well, investing in a digital twin allows you then to have that ongoing quality assurance and quality improvement without having to have a a massive human capital investment.

Okay, but explain what a digital twin is.

Well, a digital twin is another one that's a concept, and it's a portfolio of a lot of tools and methods. And most of those tools and methods belong in the AI category. However, more recently we've seen also digital twin technology portfolios that incorporate also some of the blockchain tools in addition to that. As well as some of the other methods such as image recognition or other type of tools that traditionally were not incorporated. So the digital twin is a virtual replica that is generating intelligence, and it can be a virtual replica of a human, of an organ within the human. We already have digital twins of the heart and lung that have been created. They are currently functioning. It can be a process, it can be a building, it can be a car, it can be an engine, it can be a city, or it can be all Earth. So as we know, Google Earth and NVIDIA are doing the digital twin of planet Earth to try to tackle net zero. So it's already functional for the past year and a half. So they keep generating data. Also for smart cities, we've seen cities such as Singapore and others that have deployed digital twin technology to help them not only in the design and deployment of all other technologies that, that are going into a smart city, right, but also to do the quality assurance and the quality improvement, to do the cyber safety of that smart city, to do the maybe the physical safety of that smart city, so like the policing, also all the utilities such as firefighters, everyone else that is part of a smart city utility grid. Can benefit from it. So upfront, again, investment, not much more than if you're gonna do a zero-trust architecture anyway, and then having that digital twin component, think about it as your auditing officer, compliance officer, security officer, all in one, that it can actually do if it's designed and deployed appropriately.

And it has, I mean, there's tremendous benefits, especially in, in security. It's the king's food taster, right? Let's see what happens. It's, it's, you know, we're putting them out front. Let's try things. Let's see what's going to happen. And then let's learn from it without jeopardizing your crucial operating environment, your crucial intellectual property, things of that sort. Okay. So and again, zero trust, it's great in that kind of aspect. What are the downfalls? We've talked about cost. We've talked about the challenge of even getting the approvals, right? What are some of the other pitfalls for going down the path of Zero Trust?

So it spans across all your enterprise in terms of the adjustments that you need to make from talent retention, upskilling and reskilling the workforce. You can't say, okay, Monday morning, we're starting Zero Trust, everybody watch a video. That doesn't work. So you need to think that minimum 6 months, if not a year, to start training the workforce. If you start to plan your zero trust so that they're— by the time you start to deploy the actual technology architecture and infrastructure, your, your teams are already trained. Otherwise they become those weak links in the system. And if someone, no matter what zero trust you have, leaves their password with a sticky for the who knows what very, very confidential information, then it's gonna be a problem. So human capital training, workflow is the second very big one I see. People forget that if you just, okay, let's bring overnight all the genius trained talent in the company, no problem. Let's pretend we solve it in one night. If you don't adapt workflows in the company to be conducive to a zero trust right, environment. And we said it's a culture change, a mindset, that it's a culture of cyber resilience where you don't trust anyone and verify everybody and everything. So that is a very big workflow change. So the way you do, let's say, vendor assessments, the way you do your cyber insurance questionnaires, the way you choose your partners, what merger and acquisition process you have, What type of quality metrics? The way you do performance evaluations. What type of technology you allow to be deployed that has nothing to do with cyber, but that can be a vulnerability.

IT infrastructure. Yeah. Huge.

So endless things that, like, I can show someone if we go with a checklist for every single enterprise department, you will have an adjustment that needs to be made so that zero trust actually functions optimally. And that's what people don't like. And then where does it sit? Where is the accountability? So if you try to make a RACI matrix for a zero trust architecture, good luck because it's gonna be a problem, right? And then if we do also the failure mode analysis on a zero trust architecture, who is responsible to fix all the things that you find, right? So it's a complex distribution of roles and responsibilities and that RACI matrix and the org chart need to be shaken. Like it's a tectonic change in the way you handle things. Now, some organizations are already structured much better. So it requires tiny adjustments. Others unfortunately require much more. The problem is if they don't think about these things, 'cause if you think about them in advance, they're easily fixable. They might not like it, but if you plan it well, it can be done. But what doesn't work is, okay, Monday morning you start zero trust and no one did think about all this. These things because then it's useless to try.

Everything is broken.

Exactly. And then the only other thing I would say is your auditing mechanism and your vulnerability testing, all that has to also change. It doesn't work to say, oh, we are doing our annual checkup and that's great. That doesn't work. It has to be a much more dynamic process and ongoing process. So therefore compliance officers and cyber officers need to be on board, of course, to work together.

And I would add one more to that, to that bucket of pitfalls. Again, it's a concept. It's not a particular piece of software or service or a tool. And for every organization, it's different, right? We know that. However, there are an inordinate number of vendors out there who have just suddenly slapped the term Zero Trust on their product, on their device, on their service. And they are unfortunately going to the industry and to their customers customers who don't understand the depth that we're talking about and going, hey, we, we do zero trust, right? And they're thinking, oh great, it's just an upgrade and I've got zero trust. And that's generating great revenue for these security companies. One, it's not ethical because it's not actually true. And two, you're not going to get the benefits that we're talking about because somebody slapped a plastic label on their device that says we support zero trust. And so we've got, unfortunately, some quasi-ethical practices going on, even with some big vendors in saying, oh yeah, we've got you covered for zero trust, when in fact they really don't. And I think that's really shooting ourselves in the foot in the security industry, right? You know, trust, it's earned in drips and it's lost in buckets. And we have to watch out for that. So buyer beware. Do your research. Buyer beware.

And I think one more that we quickly— we had talked once, I think, about people confuse factor authentication for login with zero trust. That's not it. Just have it two or three-factor authentication does not mean you have a zero trust ecosystem because that has come up a lot.

No, it has. Right. Oh, well, I've got two. I get this text on my phone. That's great. That's better than not having two-factor. But when we start getting into the depths of zero trust, it's not only authenticating the person, but it's also authenticating the device they're using. Maybe we can tell it's really you, but you're on, you're in a computer cafe, you're using an untrusted device. Sorry, you don't get access, right? Or maybe you're connecting in from Starbucks free Wi-Fi, and that's not a secure network. Okay, no, we're going to block you. Maybe you're sitting in a controlled country and everything else is great, but you're sitting in a controlled country and we have policies that say, no, you can't access this super sensitive data when you're physically in a controlled country. So there can be lots of different factors. And again, it's customizable for each company, each organization, and even, even each asset you're talking about. But you're right, just because you're implementing second factor or multi-factor, that does not equate to the fulfilling the concepts and the benefits of what zero trust really is. Okay. So lots of pitfalls. I mean, great benefits, potential benefits with zero trust, but equally lots of cost and pitfalls there. So it is that journey. It's a journey for each organization. Last question, though, here for you. In a year from now, right? Because you said everybody's on this journey and people are learning more and there's new technologies and there's certain mandates and regulations. A year from now, turning ahead the dial, what do you think we're gonna be talking about when we say zero trust?

I think we're gonna talk about, and I'm actually, I just gave a prediction yesterday to an audience journal about this. We're gonna talk about doing Zero Trust for Web 3.0, because if people like it or not, there is a lot of push towards transitioning to Web 3.0, which is another journey. So forward-thinking companies are gonna find themselves in two parallel journeys, and if they don't manage it well and plan it together, it's gonna be chaos. So I strongly advise organizations that wish to embark in Zero Trust to think about Web3 because a lot of things can be done jointly and planned appropriately in advance. Those that already embarked to zero trust to already start to maybe upgrade and make sure that they're ready for Web3 enablement. And then I think also future, future, a little bit more than next year, they need to start thinking about quantum because we've seen huge quantum leaps, no pun intended, in the advances that are being made internationally. So what we thought would take 10 years to start playing a big key role in cybersecurity can play a role within 2 years or 3 years. So that's another term, by the way, to use your cautionary statement, how you said that people just say they're offering zero trust and you can just download it. I see the same thing with quantum proof. It's not quantum proof. So if we wanna caution our audience, that's another mis— like a misstatement and label. Label that people use to trick, unfortunately, buyers or vendors, and it's not, not, uh, right. So another—

same thing with AI, right? Last year everything was AI. Um, so yeah, yeah, misdirection going on with those kinds of things. All right, hey, this has been an amazing conversation, and I know you're so involved with digital twins and AI and quantum and zero trust and ethics, right? We haven't even talked about ethics. We could do a whole nother discussion about that. You are all over the place. Thank you. Thank you so much for joining and sharing your insights because I know you're so close. You feel the pulse of what's going on in all these industries and you can see how they connect and how they potentially can benefit or harm, you know, all of us end users out there. So thank you so much, Ingrid, for joining today.

Thank you for inviting me and looking forward to the next.

And to the audience, thank you for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders like Ingrid to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. Thank you much. See you next time.