Zero trust is a hot topic, so we invited the Director of Cybersecurity from Plurilock, Paul Baker, to discuss the subject in detail.

In this episode, Paul Baker from Plurilock and co-founder of Assurance IT, Luigi Tiano, discuss: 

1. What is zero trust? 
2. How do you never assume someone is a good actor?
3. How do you get an enterprise to prioritize zero trust?
4. Is it easy to calculate the cost to protect a network?
5. How do you get people to buy into cybersecurity?
6. What role does zero-trust play in identity access management?
7. What is continuous authentication? Compared to MFA?
8. Is continuous authentication safe?
9. How does a team measure the effectiveness of implementing zero-trust initiatives?
10. Has zero trust helped you get cyber insurance?
11. What are the long-term benefits of zero-trust?

Resources: 

Watch the episode: https://youtu.be/D5oL9B1-0qw

Paul Baker’s LinkedIn: https://www.linkedin.com/in/paul-baker-uk/

Plurilock website: https://plurilock.com/

Luigi Tiano’s LinkedIn: https://www.linkedin.com/in/luigitiano/

Assurance IT Website: http://www.assuranceit.ca/

About Paul Baker: 

A customer-facing manager who collaborates with all levels of stakeholders, from developers and technical staff through to C-Suite executives. Builds solid relationships and quickly becomes the reliable "go-to" person internally and externally. Analytical thinker with a creative edge who deftly identifies client needs and assesses financial and technical viability. Passionate about helping clients discover new possibilities, maximizing investment in technology, and driving revenue for their company. Translates customer requests into detailed requirements, then follows through to delivery and beyond.

About 10 Questions to Cyber Resilience: 

Learn about how IT leaders are strengthening their cyber security practices twice a month. Every episode comprises of 10 questions that get you one step closer to cyber resilience. Subscribe to stay up-to-date with hot topics in cyber security. 

About Assurance IT: 

Assurance IT (www.assuranceit.ca) specializes in data protection and data privacy for the mid-market in Canada, since 2011. The Montreal-based company’s unique approach to helping customers become cyber resilient is called the PPR Methodology which stands for Prepare, Protect and Recover. Based on industry best practices, the PPR Methodology is an easier way to achieve cyber security and compliance objectives.

I wanna welcome everyone to

the podcast this morning or

this afternoon, depending

on when you're listening.

With me today, I've got Paul

Baker from Plurilock who's gonna

talk to us about Zero Trust.

Really looking forward to

hearing the Zero trust story

specifically from Paul.

I've heard him talk

about this before.

I think he's got a lot of

information for us which

we're gonna appreciate.

Paul, before we get started

into the questions, I want

you to introduce yourself,

who you are, what you do, and

what brought you here today.

Hey everyone.

My name's Paul Baker.

I'm director of

Cybersecurity at Plurilock.

Plurilock is a Canadian company

that develops some really cool

cybersecurity products, but they're

in the General Zero Trust world.

I spend a lot of time talking

about Zero Trust to people

just digging into what it means

for them and what actually

is it in the real world.

Fantastic.

Yeah, a great company

Canadian bred company.

We're always proud to

see some fellow Canadians

pushing the envelope when it

comes to cybersecurity and

like you said, zero trust.

I've got a lot of

questions on my mind.

Paul, I've heard you

explain zero trust before.

The term is not new

to the industry.

It may be new to

certain individuals.

So can you explain the

concept of zero trust in

really simple layman's terms?

Sure.

Why don't we go back a little bit

in history and I'll set the scene

for where zero trust comes from.

So back in the late eighties

digital equipment corporation,

DEC published kind of one of

the first papers on firewalls.

That really set the scene for

security for an awfully long time.

It really got this sort of

castle and moat approach

to security, a super strong

perimeter, keep the bad guys out.

But once you break through

those castle walls, you can walk

around and do what you like.

As I said, that remained

really the standard approach

to security for a long time.

And that of course was why we

see so many breaches because,

a wall is not impenetrable.

And it wasn't really until

the early two thousands

when people started to think

about de-parameterizing.

A lot of that was because there

was a big move away from the

sort of the slightly older IT

corporate setups of mainframes

and thin clients, everyone within

a building and into this more

sort of complex distributed full

desktops hybrid work cloud kind

of world that we live in now.

The internet, of course, and

the ever expanding reach of the

internet was a huge part of that.

Then in 2010, John Kinderg,

coined the term Zero Trust

in a Forester research paper.

Really until the last few years,

zero Trust as a phrase has mostly

stayed in the analyst space and

not really so much in the corporate

security psyche, although many

people in security have been

looking at defense in depth,

which is a very similar thing.

So if we fast forward to 2020 NIST

the American standards published

SP 800 207 which was really the

first attempt to try and formalize

this zero trust framework of

standards and requirements to

help define what it really was.

Last year, of course the US Office

of management budget, I think it

was, mandated that all US agencies

had to adopt zero trust principles.

So this is a thing

that isn't going away.

So what is it?

One of the common mottos phrases,

whatever you wanna call it,

associated with zero trust,

is always verify, never trust.

And what it really means is

that you need to assume that

users and systems and so

on are already compromised.

And so while that perimeter itself

is still, of course very important,

you need to start thinking

about how do we limit damage if

someone is inside it already?

So it's really, it's an

approach to security.

It's not a specific tool.

There's no magic,

zero trust button.

You can go and press and how

you press, you're protected.

You need to go through this

whole process of kind of

identifying really what is

it you're trying to protect.

What's the things that

you wanna protect?

And then start to consider

how do we protect that?

And usually you wanna start

with things at the highest

risk to you as an organization.

And then find the right tools that,

that help you protect those assets.

And then you can use the

guiding principles in standards

like 802 0 7 or referring

to some of the reference

architectures that are out there.

D o d have released one fairly

recently with a whole bunch of

zero trust specifications in there.

So say really it's just a change

in concept from let's make

the perimeter really strong.

Because the point is really

the perimeter doesn't

exactly exist anymore.

And let's focus instead on how

do we minimize damage, right?

How do we never assume that

everyone is good and that

they're doing good things, right?

Let's assume that every user

and every application and

every system is compromised and

treat them accordingly, right?

Make them prove that they're

valid, rather than just

saying, yeah, you're good.

Great.

Always verify, never trust.

Yep.

Or important words.

And it's 802 0 7 you said?

Is that the Yep.

802 0 7.

The part of the nist standard.

It's, yeah it's a pretty

good read actually.

It's a pretty good read.

So I'd highly recommend folks go

out and take a look through that

to kinda get a really good idea of

what's expected from zero trust.

And it's amazing that this,

the concept has been around

for a very long time, and

we've seen it evolve over time.

And again, it's, you said

it's a principle, right?

It's not really a, you can't really

call it a framework per se, because

there's really no standard for it.

It's more of a principle.

Yeah.

Yeah.

It's an approach.

It's of, it's a way of thinking

about security, about thinking

about how you secure everything

in your corporate environment,

whether that's, users,

data applications, systems,

networks, the whole lot really.

And given that.

Always verify, never trust,

ideology or approach.

What are some of the biggest

challenges organizations

are facing today when trying

to implement Zero Trust?

Because it sounds like a pretty

fundamental or logical approach

to securing the enterprise.

It is, and I think the

biggest hurdle is overcoming

paralysis at the start.

It's such aing, it's such a

potentially huge project because

it hits all parts of your

business and I think people

don't know where to start.

How do we eat this massive

elephant of zero trust?

You pick up a spoon

and you start scooping.

Key things that, that companies

need to make sure is that

they have, they've gotta

have buy-in at board level.

There has to be that real

drive from the top to

say, we are doing this.

It's important to our business

for all these different reasons.

And we need to do it right.

We need to commit to do it,

commit to do it properly.

There's not an easy way.

There's no zero trust

button, as I said.

It's gotta be, it's gotta be.

Done and done properly.

Yeah.

There's no easy

button, like you say.

But, and there's no, we

there's no way to even

determine the actual costs.

Until you dive into,

then you start eating it.

Exactly right.

It depends on what

you're trying to do.

My, my recommendation to companies

who want who want to go down

this path, and it should really

be all companies, cuz let's face

it, everyone needs good security

is to really first look at

what you care about protecting.

What's the crown jewels

that represents the highest

possible risk to your

company if it's breached?

It could be something related

to your intellectual property.

It could be your

customer information.

Who knows?

But that's the thing that you

wanna focus on protecting first.

That's what you care about, right?

If that piece of information,

that data, that system,

whatever it is, goes away.

That's your business at risk.

So those are the things that

you really wanna focus on first.

And look at all the different

ways that you can protect those.

Cause that's gonna be your

biggest bang for the buck.

And as an organization, I think

some of the challenges stem from

not understanding the PR priority

of the valuable assets they have.

Sometimes I would say to be fair.

That, that becomes a

challenge in itself.

So you're right.

I think we need to understand

what, where we prioritize, what's

the most important, valuable

asset you have, and then based on

that, then you work your way down.

That would be a

great start for sure.

And you're, I like your,

when you said buy-in at the

highest level I, you need

buy-in at the highest level.

And often what I say is you

need executive sponsorship.

You need someone absolutely.

Someone or some team.

And oftentimes it's one person.

You need to have that one person

who's driving the initiative.

Yeah.

Because without that, Then

there's no funding there,

there's really no strategy.

And oftentimes it's someone

who understands security

and of course the business.

Totally.

And typically in most companies

that's driven from the CISO

role I was about to say, yeah.

The CISO role.

Exactly.

And then that's a challenge

in itself because CISOs are

overworked, overwhelmed,

for the most part.

They've got a lot of things

coming at them right now,

being thrown at them.

Yeah.

And I see a lot of times where

the CISO is reporting to,

initially with cio, and this could

be a conversation itself, but

reporting to the ccio, and then

now, there's a, dotted line to

the cfo and then, the operations

people want to know what's

going on because it's impacting

every part of the business.

Ex Exactly.

It's a critical role.

Very critical.

Very critical.

When it comes to zero trust

and network infrastructure,

is it, what's the, what's an

impact on your organization's

network infrastructure?

What and is it easy to say

what costs are involved

with protecting the network?

It, that varies depending on what

tools you're trying to use and

how big a network is and so on.

But in terms of impact, if

it's done properly it shouldn't

really affect anything in terms

of day-to-day operations other

than making it more secure.

It's, it should be invisible

and be, and that's either

to people or to systems.

Is there gonna be some cost?

Yes, of course.

If you have to start buying new

tools, there'll be some kind of

cost involved that if you need to

bring in the services of experts

in the field of zero trust,

which I, if you are not one, I

absolutely recommend you do, right?

You can make a huge amount

of shortcuts by not having

to try and learn everything

from scratch yourself.

Get someone in that you trust

that can advise you on what

you've got that can advise you on

solutions that are gonna be able

to help your particular needs.

So definitely do that.

But yeah, a lot of companies

have tools in their stack

already that can help them in

this zero trust journey, right?

So it may just be a case of

better levering to leveraging

tools that you already have, in

which case it's just some time

cost to do that and perhaps

learning how to use them better.

The tools is definitely part

of the equation, and oftentimes

we see when you're trying

to have a culture shift,

Paul, and you obviously I

welcome your comment here.

It's also an, a change,

a culture change within

the organization, right?

I think that's sometimes is harder

to do depending on what type of

organization you're working with.

If you're a low tech organization

who's not really, familiar with

technology or you don't use it on

a day to day I see that adoption.

That rate of adoption sometimes

comes down a little bit,

and that becomes a challenge

in itself, regardless of

whatever tools you have.

Yeah.

Yeah.

Saying change is difficult.

Yeah.

It's a fact.

Change is difficult.

And I think the key to that

is, is engaging people.

It's in helping them to understand

why you are doing something right.

What's the benefits to, to what

you are doing and get their buy-in.

If you are expecting your end

users, for example, to have

to do something different.

Yes, you could just mandate

it and send out the, the

note that says this is what

you will do from now on.

But I think if you get buy-in,

if you get understanding,

if you involve them in that

process a little bit more,

then they become engaged.

They become aware that security is

a thing they need to think about,

and you just end up with, with

happier people and better security.

It's everyone's responsibility

within the organization.

I, I agree.

Yeah, absolutely.

I agree.

Absolutely.

And so this leads me to my

next point or next question.

And you know this really

well based on, what you

guys are doing at Plurilock

Identity Access Management is

obviously very, a very strong

or familiar place for you.

How does Zero Trust factor in

into identity access management?

Yeah, I, identity is

core to security, right?

It's probably the single most

thing that you care about in

security is are these my users?

Their identity links to everything

that they do in your systems.

And so that's also

core to zero trust.

If you go and if you go and

look through DODs reference

architecture for it their zt first

couple of required capabilities

in that focus on identity.

They focus on continuous

authentication and

things like that.

And we find that there's

a lot of companies go, oh,

we protect our identities.

We'll put MFA in front of them.

That's not zero trust.

It's a good thing.

I'm absolutely not saying don't

put MFA in front of a login.

But that's not enough, right?

You are checking someone again

at the door at that perimeter and

you're not checking them again.

So you need to think about

how can we remove trust from.

Identity as well.

Because it's relatively easy.

I say relatively it, there are

tools to do it in different areas,

for machine trust and applications

and APIs and things like that.

But as soon as you introduce a

person makes it more difficult.

Because you are a human being.

You're not a, you're not a

thing that is, that has some

specific, certificate stamped on

your forehead that you can use.

Yeah.

Yeah, so there's a lot of elements

that the human individual,

obviously the human element

brings to the table there which

augment the risk there is and.

You also need to make sure that

it doesn't impact user experience.

MFA typically is a, certainly

with most MFA implementations

is a thing that user has to do.

So they, they press a button

on their phone or put in a

code or something like that.

And you can't keep

making users do that.

So you need to try and look

at tools that allow you to

do that in a way that is

unintrusive to the user.

But still gives you that

continuous ability to make sure

that it is, that user there, that

it is the person behind that,

that digital credential, right?

That certificate, that

login, that MFA step up,

whatever it happens to be.

Making sure it's them all the

time doing things in your system

because you don't want to be

saying an hour after they've

logged in, it's still them.

Based on something that's

nothing to do with that person.

For me, this is the fascinating

point about identity access

management and I'd like to,

if you can double click a

little bit on this continuous

auth authentication piece.

Just to help under understand,

cuz mfa, I think for the most

part now MFA is everywhere, right?

You will log into your bank,

you log into your insurance, you

log into any web portal online.

Yeah.

Chances are you're getting some

MFA prompt, but if you don't

mind, Paul, and I know you guys

do this, at Plurilock, so if you

can double click on the continuous

authentication for, cuz I think

it's important for the audience to

understand what that means per se.

Yeah.

So so MFA is great, right?

At the point that, that user

logs in and does something, you

can get a really strong signal

that it is that user, right?

It can be.

Spread across multiple devices,

you can use biometric factors to

ensure the human being, et cetera.

So you have this really good

signal at that point in time.

But the problem you have is that

from that time onwards, you've just

become this sign in thing, right?

You've become a certificate

or a machine or a location

or something like that.

And assuming that a user is still

that same user after they've

logged in is introducing trust.

So if we think about, for

example, work from home, I can

come and log in my home office.

I've got my multifactor.

I'm on my corporate managed

devices with my TPM chips Inside

it, I'm in a known location.

I'm on a known network.

I'm using applications that I

normally use, but if I go up

and get a coffee and my wife or

my kids come in and start using

my computer, there's nothing

that you can see contextually

around that's different.

Except the person

behind that has changed.

So how do you continuously make

sure, you need to make sure that

it's the right person presenting

those credentials and using those

credentials through the session.

And so continuous authentication

is a way of doing that.

There's a few different ways

that you can do it at plural up.

We do it through looking

at how the user physically

touches their workstation.

So we measure the way

that you type and the way

that you move your mouse.

And then when you're working,

we can measure how you are

working and use that to

make sure it's you doing it.

So there's a, yeah, you

could do it with cameras, you

could do all kinds of things.

But the key is that you are

continuously looking at the user

and saying, is this still you?

Is this still you?

Is this still you're not assuming

it's me because nothing around

the context of me has changed

because I can change, right?

If I'm in Starbucks and I need to

use the washroom in a hurry, what

if I forget to lock my machine?

Yeah.

I'm in my hotel and I've left

my laptop in my hotel while

I n out to get some food.

And, housekeeping, you're in there.

How do you know?

So it's that concept of never

assuming that it's the user because

you checked them at the door.

Walk around behind them, make

sure it's them there the whole

time that they're operating

your systems, because that's

when the bad stuff happens.

Bad stuff doesn't happen

at the point you log in, it

happens after you've logged in.

Exactly.

And it doesn't really.

So this continuous authentication

notion doesn't really impede

user experience or productivity.

Cuz really it's not being,

it's not being, there's

no interaction required.

Yeah.

If it's done properly.

Absolutely right.

It should be completely

invisible to the user.

You don't want to be impacting the

user's ability to do things right?

So you can't use

manual steps, right?

You can't use entering a

code or putting a finger on a

reader or something like that

because the user is gonna be

doing that continuously, right?

And every time they're trying

to do something new oh, I'm

gonna open a new application,

or open a new file, or visit a

new part of the network, right?

You can't make them re-authenticate

every single time because they're

gonna spend all day authenticating

and not actually doing anything.

Anything productive.

Interesting.

So yeah, so you've gotta do it in a

way that doesn't impact the user's

ability to get on and do their job.

So I will push back and I

know you can answer this, so

that's why I'm pushing back

a little bit here because I

wanna make sure it's clear.

Now, when you're monitor,

I gotta be careful with

the words I use here.

So if you're doing continuous

authentication, We're talking a lot

about privacy, now we're talking

about, user, individual rights.

So how do I make my end user base

within my organization, 500, 4,000,

5,000 individuals feel safe that

this continuous authentication

is doing what it needs to do and

not doing other stuff, if yeah.

So certainly at Plurilock, we

look at the how, not the what.

So we don't, we are not looking at.

Keywords, right?

We don't know what you're typing.

We don't know what websites you're

visiting or what buttons you're

clicking on or what documents

you're working on, and that's

the way it should be, frankly.

Yeah.

We don't, that's

nothing to do with us.

That's not authenticating

you as a human being.

We just look at the physical way

that you are touching your device.

Okay.

If if you are a a reasonably

side organization, for example,

you probably have a proxy in

place for your web connections.

We are orders of magnitude

more privacy friendly

than a proxy, right?

If you think about what a proxy

does, it's looking at every

single thing that you, that is

leaving your machine so it knows

every page, every application,

every day, piece of data access.

It knows exactly what you're doing.

If you look at some of

these full session recording

tools, Again, yeah.

Privacy.

That's why I wanted

to bring that up.

Exactly.

If you, if it's a big topic now.

Exactly.

And if you look at ones ba, things

like cameras, hey let's just

switch the camera on and watch

the user doing their things Again.

Massive privacy problems.

There's other people in the room

potentially, which is, might be

what you care about of course, but,

it's it's some big issues there.

So yeah we are very privacy

friendly in that respect.

Fantastic.

Okay, a couple more questions

before I let you go.

Cause I know your time's

very valuable and we wanna

make sure that we make

the best use of our time.

How does organization measure

the effectiveness of their

zero trust implementation?

That's not an easy one, right?

How do you know if it's working?

There's really no, how

do you quantify it?

It's a, yeah, it's

a great question.

You can take practical

steps, right?

Penetration testing, red teaming,

security exercises and so on.

And if you have a baseline before

you start implementing these

things, because you should, right?

That should be start part of your

process of understanding what you

need to protect is knowing what's

wrong with what you've got now.

So if you do that before and

after, you should see a measurable

change in those baselines.

But I think really it's.

Like most security things

the proof is in the pudding.

It's an unfortunate reality that,

that you have probably already been

breached and you don't know it.

And if you do know it, you should

be looking at ways to stop that.

Yeah.

And you understand the impact

and the damage that it can cause.

And I think, the effectiveness

is hey, we haven't been hit by

a massive ransomware attack.

That's not because you got lucky.

That's because you put good

tools in place to prevent

those kinds of things.

Yeah, that's, that makes sense.

And that's definitely an

effective way to measure, right?

Reducing the risk is def

definitely hard to quantify, but

not being attacked over X amount

of months or x amount of years.

I think that's a

pretty good measure.

Yeah.

You you're gonna be attacked.

I apologize.

Yes, you're right.

It's how successful

are they, right?

It's how successful are they?

Yeah.

The attack is gonna happen.

It's how you've been, how you

were able to either recover

or not be impacted by it.

Yeah.

Got absolutely.

Got it.

One question, and then

this might be a tricky one.

Not sure, if it's something

we, we can definitely

answer for the audience.

But when it comes to regulatory

compliance compliance requirements

in general, when it comes to your

particular specific industry,

how does Zero Trust impact

or affect an organization?

Is that something you've

seen where it actually helps

even cyber insurance, let's

say for example, right?

Cyber insurance will sometimes

ask for certain requirements.

What have you seen?

Have you seen Zero Trust

Positively Infa Impact that?

Yeah, I mean in terms of

compliance requirements and

regulatory adherence, things

like that, it's certainly

not gonna make it any worse.

A hundred percent.

Realistically outside of federal

government today there's very

little actual compliance or

regulatory pressure to, to

adopt these kinds of approaches.

I think that's gonna

change because it has to.

Whether that's driven by

regulators or the insurance

companies or someone else, I

don't really know right now.

In general, I think we see that

things mandated by government,

for government start to flow down

into the commercial space, right?

So things like the government start

to mandate the, if you want to

work with the government, you have

to adopt these same approaches.

We've certainly seen that in the

States with things like C M C.

If you wanna be a supplier to the

federal government, now you have

to go through the cmmc process.

So I think we will see

more of that happening.

But in general it's just good

security practice, right?

It's make, it's making you think

about what you are protecting,

about the impact your business

of that thing being, being

breached, broken, lost, stolen,

whatever it happens to be.

And by doing that, you are

just massively reducing

your risk exposure.

You're making things harder, you're

reducing risk, and that can only be

good for you and your organization.

Yeah.

And you touched on my, one of

my last questions here was,

the long-term benefits, right?

Of zero trust, right?

I, and you can add onto this, but

I think what we're looking for,

if you're gonna implement zero

trust principles or fundamentals,

you're looking for what?

Improve security, reduce your

risk heightened awareness, right?

All, all of those and really,

It come, it comes down to

limiting the damage that could

be done to your organization

when that breach occurs.

Attacks are not going away.

And at some point, it doesn't

matter what you put in place, a

bad guy's gonna get in, right?

We've seen that with these, with

from the simplest of attacks

where, it's been a post-it

note on a team viewer session.

Spamming people with MFA

requests, all these really

supply chain type attacks

that are frankly terrifying.

At some point, the bad guys

either get in and you need to take

steps to limit the damage that

they can cause, and regardless

of anything else around,

around risk, around insurance,

around compliance, that's

what it comes down to, right?

When it hits the fan.

How can we stop that?

How can we reduce it?

We've had an endpoint infected

with malware because the user

clicked on a link and they

downloaded it and it was a

unknown thing, and the virus

scan, it's gonna happen, right?

But if you can limit because you've

implemented all these micros,

segmentation, all these other

great tools, if you can limit

damage that one machine, right?

That's virtually zero

impact on your business.

If you haven't put those kinds

of controls in place, you are

very quickly in a bad place.

Agreed.

Agreed.

And like we said, like zero trust

is a principle fundamental set.

Always verify, never trust.

Those are the four big

words we've learned today.

Yeah.

And frankly, organizations can

get started pretty quickly.

With some basic steps.

With basic steps.

Absolutely.

Like I say just even

thinking about what do we

really care about, right?

What is, what's core

to our business?

What can we absolutely not risk?

And focus on protecting

that the best that you can.

And that's gonna put

you in a good set.

Start with that, right?

What really matters to your

business, and every business has

something really important to them.

Absolutely.

Absolutely.

Very good.

Paul.

Again I really appreciate

the time we spent today.

Do you have any questions for me?

Any extra thoughts or additional

thoughts before we we go here?

No.

It's always a pleasure

to talk to you, Luigi.

How can anybody get

in touch with you?

Obviously they can, you can you

can get in touch with me through

LinkedIn through Luigi, or you

can hit me up at plurilock.com.

I'm sure you'll find

me there somewhere.

Fantastic.

Paul, thank you very much.

I know you're helping the community

raise the awareness, and I know

you're fighting the bad guys every

day, so really appreciate talking

to you anytime of the day, man.

Oh, you're welcome.

Great stories again.

Lose you.

Thanks.

Take care.

All right.

Thank you, Paul.

Thanks.

Have a good one.

Bye-Bye.