Simplifying Zero Trust for User-Based Security

Hello everyone, and welcome to the

Security Speakeasy Show,

where we talk about network security.

And today, we're going
to cover a topic that's of

interest to a lot of security
professionals around the world.

We will talk about zero trust,

and what PaloAlto Networks offers to

address zero trust for identity.

And we have the right person
to talk about on this topic.

[Music]

My name is Neha Kumar, and I'm
the Senior Product Marketing Manager

at PaloAlto Networks.
And joining me today is Brian Levin,

who's a product line manager for

identity and access, and is responsible

for cloud identity
products and initiatives.

Brian, welcome to the show. Now, everyone

in the industry and the media has been

talking about zero trust.

Can you tell us what exactly is zero

trust, and why are
companies talking about it?

[BRIAN]: Thank you for having
me on the show today.

Zero trust is a very
hot topic within the industry,

and specifically because
the industry's changed,

and there's a lot more
remote work going on.

So, zero trust is a policy where it's

important to give least
privileged access to

all users. So that means that you must

verify users, applications,
and devices on your network

before allowing them to access any assets.

This is becoming increasingly
important because, of course,

network boundaries have changed,

and people are working from everywhere.

Users and applications are spanning

multiple products and services

across multiple different locations, and

it just makes it more and more important

to really focus on zero trust and having

zero trust policy in place.

There's...it's been a huge focus

recently, because in the recent White

House press announcement,

they've recommended zero trust as a way

to secure your networks,
and NIST and the U.S. government

have both come out with standards
on how to implement zero trust.

It's a focus here at PaloAlto networks

because we take a very holistic approach

at the way we implement zero trust. A lot

of other companies are looking at ZTNA,

or remote access of users
as being zero trust,

but we're focused on the end-to-end

strategy of zero trust,
which spans campus branch,

remote users, of course, data centers,

public, private, cloud,
and SAS applications.

[NEMA]: Thank you, Brian. You know,
you mentioned that one of the

cornerstones of zero trust

is to give your users access to all the

applications they need

with zero trust in mind.

Can you elaborate on that,

and how does that affect today's reality

when we all are working
from different locations?

For example, right now,
I'm working from home,

and then very soon, we're gonna go

to the office two days in a week and

then a few days, we'll work from home,

and we're moving to this
hybrid work environment scenario.

So what exactly is changing with the way

networks are being deployed

as the world is moving towards this

distributed network system?

[BRIAN]: Yeah, if we go back, like, five

years, or maybe even two years, or

a year and a half, everyone was sitting

in a office, and in that
office, there'll be a

single point of egress for internet,

and that will have a
single security stack.

So, the network was very simple.

You would have a single source, or single

active directory that will provide

identity of all of your users. You would

have all the data going
through a single point,

and things were simple at that time.

Today, it's much different.

People are working from home, sometimes

the office, sometimes branches,

sometimes a coffee shop, and

with that kind of
distributing the workforce,

applications are spanning

all of this, all the time. And so, it just

becomes more and more important

to have that
consistent security experience,

regardless of what applications you're

using and what location.

[NEMA]: Absolutely.
So, at PaloAlto Networks,

especially, your team works mainly on

identity-based capabilities

and we've been offering
user-based security for over a decade.

How did this affect, in particular,

identity, example, implementing and

maintaining user-based
security and authentication?

[BRIAN]: Yeah, that's a great point.
And if we can go back to

the previous example about...in the last,

or two years ago, everyone
was in a single location.

Now it's that distribution,
and with that distribution,

that single Microsoft AD server that

90% of enterprises across the world

we're using, is no longer applicable,
because we have...

...we have applications that are on-prem.

We have cloud applications,
we have users everywhere,

and so there's a couple trends that are

really influencing identity and

authentication throughout the network.

One is, of course, on-prem,
and that's your on-prem AD

server that is in your network.

Second is something
called hybrid identity,

where you have your on-prem AD, but then

you also have a cloud service
that synchronizes with it.

So, all of your on-prem applications

would connect to your on-prem server,

and all of your cloud applications would

connect to the cloud instance of it,

and that's called hybrid identity.

And then there's multi-cloud identity,

which is where you have multiple

different cloud-based identity services.

In typical enterprises today, those are

all mixed, so think about having

not just one, but
two, three, four, possibly

even ten sources of identity

in a single network.

[NEMA]: Absolutely, and I can
see why that's a challenge.

So, as customers are trying to implement

user-based security and
implementing authentication,

whether it's single sign-on
or multi-factor authentication,

using these multiple sources of identity

information that you just mentioned,

whether it's on-prem
or cloud ID providers,

what are some of the key challenges that

you're seeing that organizations and

security teams are facing today?

[BRIAN]: Yeah, so, the two key
pinpoints that we're seeing

security teams and identity teams
really face as they

deploy network security today

is, one is making sure that the right

resource has that consistent experience

when they come from many different

locations so i expect it

access apps the exact same way if i'm at

home or if i'm in the office

or if i'm on my mobile phone in the

coffee shop and so that consistency

through identity is key the second is

just maintaining authentication

and so with so many different locations

and authentication sources

it's how do i make sure i've accessed

the right assets at any given time

and those are the key problems we see

absolutely so you know at palo alto

networks our goal is to simplify

security for our customers

what's palo alto networks doing about

this problem and how are we addressing

the problem of simplifying user-based

security

and addressing zero trust for our

customers

yeah here at palo alto networks uh

holistic zero trust approach

is top of mind with us we have recently

introduced

uh cloud identity engine which is a

brand new cloud service

focused on solving this problem for for

the industry and for our customers

we focus on two elements identity and

simple authentication

from our identity point of view what we

do is we connect to both

on-prem and cloud directory sources we

are able to

to pull all of the data attributes

together in a single source

and then serve that to all palo alto

products

whether it's our firewalls prisma access

xdr our management systems

and then with all that in a single place

we're able to ensure that

our consistent security policy is issued

and so now i have that exact same

experience if i'm at home

if i'm in the office or anywhere else in

the world

i am brian and i have access to my apps

and that is what's key here

in addition to just the identification

we've solved the authentication problem

too

where there's many different idps out

there

and those idps need to be configured as

an sp for each of my different firewalls

and

cloud services and so that means that it

can take a network administrator

or an admin almost almost a month

to possibly even a year to configure a

single idp on their network

that's very painful and time consuming

we've reduced that

into allowing you to bring a single idp

on within 10 minutes

and so these are the two ways that we

just make the network a lot easier for

customers as they migrate to zero trust

yeah brian that's really fascinating and

i hope our listeners are excited to hear

how we're simplifying

implementation of identity based

security with cloud int engine

and by the way did i just hear 10

minutes yes 10 minutes from a single idp

that's very impressive if you would like

to know more about

cloud identity engine check out the

demos and the technical content that we

have

you can either google it or use the

links in the description below

if you have liked the show hit the

subscribe button

leave a comment and visit palo alto

networks dot com

thank you

you