David Hughes

It's not just one thing that you do for the bad guys to get what they want.

There's usually two or three or four or five steps.

But often on that chain, in fact, in a majority of cases on that chain somewhere, is an IoT device or a consumer-type device.

And that means it's really important to be able to track the behavior of those devices to understand if they've been compromised.

Those devices, they're basically a complete server inside that IoT device.

So it may look like something small or something insignificant, but from the point of view of being a point to leap off from, they're very capable.

Well, yeah, Zero Trust is all about making sure that users are only able to connect to the applications that they need to be using as part of their organization's policy.

And that IoT devices are only able to connect to those resources that they need in order to do the job.

So for the example of the door lock, it's connecting back to the manufacturer's website, for instance.

Now, what zero trust means when it comes to networking is all about being able to enforce that policy, that global policy, with the network.

So rather than having a network where anything can talk to anything, you have a network where each device or each identity can only talk to the resources that identity needs to get its job done.

And so this means that when something's compromised, instead of it being able to be a leapfrog kind of point to get to anywhere, it's only going to have a few locations or a few applications or a few servers to which it's authorized to connect.

Without zero trust, the door lock would be able to access the server.

With a fine-grained zero trust policy, that door lock wouldn't even be able to see the server because that's the whole idea of zero trust, least privilege access, and it will not be able to even see the things that it's not allowed to connect to.

I would describe it this way.

So in the traditional internet, when it started, it was really an any-to-any network where any server and any university could be used to connect to any server in any other university.

This is back in the 1970s and 80s.

And then obviously, as it became adopted by enterprise, things like firewalls were invented so that you could have a good inside and a bad outside and block things coming in and out through a single point.

But

As things have gotten much, much more complicated over the last couple of decades, people have deployed firewalls everywhere during what we call segmentation.