Simplifying Zero Trust for User-Based Security

Hello everyone, and welcome to the

Security Speakeasy Show,

where we talk about network security.

And today, we're going
to cover a topic that's of

interest to a lot of security
professionals around the world.

We will talk about zero trust,

and what PaloAlto Networks offers to

address zero trust for identity.

And we have the right person
to talk about on this topic.

[Music]

My name is Neha Kumar, and I'm
the Senior Product Marketing Manager

at PaloAlto Networks.
And joining me today is Brian Levin,

who's a product line manager for

identity and access, and is responsible

for cloud identity
products and initiatives.

Brian, welcome to the show. Now, everyone

in the industry and the media has been

talking about zero trust.

Can you tell us what exactly is zero

trust, and why are
companies talking about it?

[BRIAN]: Thank you for having
me on the show today.

Zero trust is a very
hot topic within the industry,

and specifically because
the industry's changed,

and there's a lot more
remote work going on.

So, zero trust is a policy where it's

important to give least
privileged access to

all users. So that means that you must

verify users, applications,
and devices on your network

before allowing them to access any assets.

This is becoming increasingly
important because, of course,

network boundaries have changed,

and people are working from everywhere.

Users and applications are spanning

multiple products and services

across multiple different locations, and

it just makes it more and more important

to really focus on zero trust and having

zero trust policy in place.

There's...it's been a huge focus

recently, because in the recent White

House press announcement,

they've recommended zero trust as a way

to secure your networks,
and NIST and the U.S. government

have both come out with standards
on how to implement zero trust.

It's a focus here at PaloAlto networks

because we take a very holistic approach

at the way we implement zero trust. A lot

of other companies are looking at ZTNA,

or remote access of users
as being zero trust,

but we're focused on the end-to-end

strategy of zero trust,
which spans campus branch,

remote users, of course, data centers,

public, private, cloud,
and SAS applications.

[NEMA]: Thank you, Brian. You know,
you mentioned that one of the

cornerstones of zero trust

is to give your users access to all the

applications they need

with zero trust in mind.

Can you elaborate on that,

and how does that affect today's reality

when we all are working
from different locations?

For example, right now,
I'm working from home,

and then very soon, we're gonna go

to the office two days in a week and

then a few days, we'll work from home,

and we're moving to this
hybrid work environment scenario.

So what exactly is changing with the way

networks are being deployed

as the world is moving towards this

distributed network system?

[BRIAN]: Yeah, if we go back, like, five

years, or maybe even two years, or

a year and a half, everyone was sitting

in a office, and in that
office, there'll be a

single point of egress for internet,

and that will have a
single security stack.

So, the network was very simple.

You would have a single source, or single

active directory that will provide

identity of all of your users. You would

have all the data going
through a single point,

and things were simple at that time.

Today, it's much different.

People are working from home, sometimes

the office, sometimes branches,

sometimes a coffee shop, and

with that kind of
distributing the workforce,

applications are spanning

all of this, all the time. And so, it just

becomes more and more important

to have that
consistent security experience,

regardless of what applications you're

using and what location.

[NEMA]: Absolutely.
So, at PaloAlto Networks,

especially, your team works mainly on

identity-based capabilities

and we've been offering
user-based security for over a decade.

How did this affect, in particular,

identity, example, implementing and

maintaining user-based
security and authentication?

[BRIAN]: Yeah, that's a great point.
And if we can go back to

the previous example about...in the last,

or two years ago, everyone
was in a single location.

Now it's that distribution,
and with that distribution,

that single Microsoft AD server that

90% of enterprises across the world

we're using, is no longer applicable,
because we have...

...we have applications that are on-prem.

We have cloud applications,
we have users everywhere,

and so there's a couple trends that are

really influencing identity and

authentication throughout the network.

One is, of course, on-prem,
and that's your on-prem AD

server that is in your network.

Second is something
called hybrid identity,

where you have your on-prem AD, but then

you also have a cloud service
that synchronizes with it.

So, all of your on-prem applications

would connect to your on-prem server,

and all of your cloud applications would

connect to the cloud instance of it,

and that's called hybrid identity.

And then there's multi-cloud identity,

which is where you have multiple

different cloud-based identity services.

In typical enterprises today, those are

all mixed, so think about having

not just one, but
two, three, four, possibly

even ten sources of identity

in a single network.

[NEMA]: Absolutely, and I can
see why that's a challenge.

So, as customers are trying to implement

user-based security and
implementing authentication,

whether it's single sign-on
or multi-factor authentication,

using these multiple sources of identity

information that you just mentioned,

whether it's on-prem
or cloud ID providers,

what are some of the key challenges that

you're seeing that organizations and

security teams are facing today?

[BRIAN]: Yeah, so, the two key
pinpoints that we're seeing

security teams and identity teams
really face as they

deploy network security today

is, one is making sure that the right

resource has that consistent experience

when they come from
many different locations.

So I expect it...access apps

the exact same way if I'm at

home, or if I'm in the office,

or if I'm on my mobile phone in the

coffee shop. And so that consistency

through identity is key. The second is

just maintaining authentication.

And so with so many different locations,

and authentication sources,

it's how do I make sure I've accessed

the right assets at any given time?

And those are the key problems we see.

[NEMA]: Absolutely. So,
you know, at PaloAlto

Networks, our goal is to simplify

security for our customers.

What's PaloAlto Networks doing about

this problem, and how are we addressing

the problem of simplifying
user-based security

and addressing zero trust
for our customers?

[BRIAN]: Yeah, here at PaloAlto Networks,

holistic zero trust approach

is top of mind with us.
We have recently introduced

a cloud identity engine, which is a

brand new cloud service

focused on solving this problem for

the industry, and for our customers.

We focus on two elements:
identity and simple authentication.

From the identity point of view,

what we do is we connect to both

on-prem and cloud directory sources.

We are able to pull
all of the data attributes

together in a single source, and
then serve that to all PaloAlto products,

whether it's our firewalls, Prisma Access,
XDR, our management systems.

And then with all that in a single place,

we're able to ensure that

our consistent security policy is issued.

And so now, I have that
exact same experience

if I'm at home, if I'm in the office,

or anywhere else in the world.

I am Brian and I have access to my apps,

and that is what's key here.

In addition to just the identification,

we've solved the authentication
problem, too,

where there's many
different IDPs out there,

and those IDPs need to be configured as

an SP for each of my
different firewalls and

cloud services. And so that means that it

can take a network administrator

or an admin almost a month,

to possibly even a year, to configure a

single IDP on their network.

That's very painful and time-consuming.

We've reduced that

into allowing you to bring a single IDP

on within 10 minutes.

And so these are the two ways that we

just make the network a lot easier for

customers as they migrate to zero trust.

[NEMA]: Yeah, Brian, that's really
fascinating, and

I hope our listeners are excited to hear

how we're simplifying

implementation of identity-based

security with Cloud Identity Engine.

And by the way, did
I just hear 10 minutes?

[BRIAN]: Yes, 10 minutes
from a single IDP.

[NEMA]: That's very impressive.
If you would like

to know more about

Cloud Identity Engine, check out the

demos and the technical
content that we have.

You can either Google it, or use the

links in the description below.

If you have liked the show, hit the

Subscribe button,

leave a comment, and visit

paloaltonetworks.com.

Thank you.