start	end	text
0	4240	Thanks for joining the session today. Today we are going to talk about Zero Trust. Zero
4240	12160	Trust has become one of the security or cybersecurity latest buzzword. So it's imperative to understand
12160	18160	what Zero Trust is and what Zero Trust isn't. So without further delay, let me share my
18160	23700	screen and start talking about what Zero Trust, especially in the cloud, when we are all talking
23700	29280	about moving to the cloud. So before we deep dive into the topic, let
29280	34700	me brief about myself. I am Vandana Verma Sehgal. My day job is with one of the multinational
34700	42360	companies as a product security architect. And apart from that, I root for Pro Bono Work.
42360	46820	I am one of the global board of directors for OWASP. OWASP is Open Web Application Security
46820	52780	Project. Apart from that, I also root for Diversity Initiatives, wherein I've trained
52780	61280	over 4,000 women around the world on cybersecurity. And I run an organization called InfoSec Girls.
61280	66220	I'm the president for InfoSec Girls. I also work with multiple other communities to bring
67040	73160	diversity in cybersecurity. This is what we call it as a traditional security model.
73160	79960	We assume all the good guys, all the good people are inside the castle and all the bad people are
79960	86920	outside. It's like a castle, wherein castle is protected by a lot of people outside and everything
86920	95260	inside is all good. This approach lacked depth and breadth, which we needed, especially in the
95260	102820	dynamic digital world we are in. So the castle and moth model ensures cyber defenses against
102820	108780	external threats, but no defense against the insider threats. The castle and moth model
108780	114500	ensures cyber defense against the external threats, but there is no defense against
114500	122680	the insider threats. Those who have the access to the organization or internal network or have
122680	127950	gained the privileges or internal access can actually steal the credentials.
129080	137060	And how about if there is an admin whose credentials gets lost? What will happen?
137060	142420	So anyone who's inside the network can move around in the internal network
142420	148600	or in the organization network and can perform any task.
149640	156280	This might look similar to you, especially when we all have worked on creating all these
156280	162900	network diagrams, understanding the architecture, all the segregation between the firewalls.
162900	168720	So under this particular trust model, it is assumed that a user's identity is never compromised
169590	176380	and that we all are trusted or supposed to act responsibly. But can we do that? Can we trust
176380	182800	everyone or anyone? So traditional network security model, it was all segregated by the
182800	190220	different firewalls. There were different zones, especially contained by one or more firewalls.
190220	197100	Every zone was like one or more firewalls. Each zone is granted some level of access,
197100	202320	but that determines the network resources, access, or permissions. So through this model,
202320	208860	protection is given by building multiple lines of defenses where an attacker must go past,
208860	215540	especially before getting into the network, while possible insider threats are not taken
215540	221940	into the consideration. So this trust model continued to be abused. The traditional castle
221940	228460	and moth model of cybersecurity is no more the combat to modern cyber threats that we are dealing
228460	236840	with all the APDs and whatnot we are dealing with nowadays. So the question arises, trust insiders,
237080	243340	what about the threats which are caused by the insiders?
243960	248890	Only one door, because we have, let's say if someone loses the credentials,
249680	256980	anyone can come and access it. Is it practical? I don't think so. We should protect everything
256980	261950	from outsider, but how about the cost of protecting non-critical information?
262560	270200	It's a huge amount of money. So the current landscape has also changed. In the old model,
270200	274560	network packet firewalls were there to protect and tightly control the network.
274680	280740	All traffic could be traced back and can be marked as insider or outside traffic.
281060	286760	But this has changed over the years, and especially when the workforce has changed,
286760	292380	move outside. Right now, we are all working from home. It's been so many months we're all
292380	297540	working from home. And we're all connecting to the network from outside. We're all dependent
297540	305140	on some other technology which can connect us to the office network. So especially when we talk
305140	313920	about business trips, we are all remote, like we are right now. So how can actually internal network
313920	319280	can be protected? Or how can organization be protected? And especially when we say,
319280	326300	as today's network is different. Privileged access not only covers the infrastructure,
326300	332820	databases, and network devices, but is extended to cloud environments as well. We're all talking
332820	341680	about hybrid environments, multi-cloud environments, some sort of managing SaaS environments. So how
341680	349800	should we handle all of those things? It also includes big data projects. It must be automated
349800	356400	for DevOps. And it now needs to cover hundreds of containers or microservices to represent
356400	363660	what used to be a single server. So you can see that everything has modified. Everything has
363660	370300	changed. And as I said, on top of this, we now live in a world of advanced persistent threats
370300	376860	or APDs that create a growing and changing risk to the organizations, financial assets,
376860	385220	intellectual property, and reputation, the most of all. Expanding access and obtaining credentials,
385220	393900	it's an essential part of most APDs. Talk about 80% of the thefts happen or data breach happens
393900	404000	because of privileged access abuse or credentials abuse. So access has become a kind of a crown
404000	410940	jewel for any organization over the years. Let's talk about some breach statistics. And when we are
410940	418100	spending so much money on the security products each year or creating or setting up the security
418100	426060	team in our organization, but we're still actually less secure. Zero Trust provides a better framework
426060	433980	to look at the cybersecurity and rethink the way we are doing security. As for cybersecurity,
433980	446720	the cybersecurity cost, which was $3 trillion that was in 2015, will now be $6 trillion in 2021
446720	456200	or 2021 or maybe more. Average cost of a data breach would be $3.62 million.
456760	461580	That's a huge number. And that's quoted by Ponemon Research Institute.
462080	469380	And there's a new research that has come up recently. Now, as I said, there's another research
469380	474720	by Forrester, which estimates that 80% of the data breaches which happen because of privileged
474720	482160	access abuse. That's a good number. That's a huge, huge number. So these figures come despite of
482160	490040	organizations spending a lot on the cybersecurity. And there are more and more efforts that are going
490040	498620	in the cybersecurity or securing the organization. But the worrisome picture comes is when we talk
498620	503760	about that there is an organization which has breached once, but then that happens not just
503760	511760	once, but multiple times. We are spending more money, but we are becoming less secure. How come
511760	519120	that's happening? We're spending money on tools, people and whatnot. But the point comes is,
519120	524040	are we spending the money on the right things? Or the right kind of a framework?
524880	531200	Because I wouldn't say that what we were doing earlier was wrong or right. But I will say I'm
531200	539880	just my point is that every year, there's something new that is coming up. Not just every year,
539880	545960	every month, every day is something new that is coming up. We have to tackle that. And we have to
545960	553020	make sure our organization is secure. No organization is ever 100% secure, but we can take baby steps
553020	562260	towards it. So I have some questions for you. When we talk about client, do we say that client is
562260	571900	secure? The people, the users are secure? No, they're not. We've seen that. How about a server?
571900	580940	Can we say that the server is secure? No. How about the whole network? Can we just depend on that?
581740	589640	What do you say? We're all working remote. So are we dependent on network and can we just trust it?
589640	599540	No. So if we don't do that, so simply don't trust and what shall we do? So if we have to trust,
599540	608250	what should we verify? It's like trust but verify. But is it safe to say that trust but verify?
609460	616940	So here, if zero trust sounds similar to you or familiar to you, it's because zero trust has
616940	622700	been around for a while. But it's really hitting the nail right now, or hitting the rhythm right
622700	630740	now. The old model was, oh, you are in the network, we're going to trust you. The new model says,
630740	640760	never trust and always verify. So this actually flips the mantra from trust but verify to never
640760	649880	trust and always verify. It says, trust no one, not even the users behind the firewall.
650140	656580	While we are talking about zero trust, let's learn about how it all came into picture.
656780	663780	So over the years, security models have matured or have transitioned. Many of us have first seen
663780	670700	access control list. Then came role-based access control, which still exists in some form. And
670700	677600	then came principles of least privilege, and especially it was at all rates. But the problem
677600	683740	with R-backwards or role-based access control, and even subsequently with least privilege as well,
683740	690680	was actually, it just allowed all the subjects to be assigned multiple roles and multiple
690680	696600	commissions, which eventually loosened to a point wherein it defeated the purpose it was meant for,
696600	704440	or intended the control it was meant for. And when we talk about introduction to cloud
704440	711700	and diverse SaaS offerings, especially for our core applications, how are we going to implement
711700	720060	and manage this effectively? If as an admin, I lead the organization today, how soon are we
720060	726520	removing the accesses? Or let's say if I move from one team to another, how soon are we managing those
726520	734260	accesses? It's really, really hard. So those things are really important to be managed. And security
734260	739840	parameter has become a thing of the past, whatever we say. Especially with the cloud adoption and
739840	746940	advancement in technologies, enterprise must assume that the environment is hostile. And that's how
746940	752140	when we go to the public cloud, we have something in mind that we are putting our data into the
752140	758920	public cloud. And we have to take some ownership. We have to talk about the shared responsibility
758920	764300	model, that what's the cloud provider's responsibility, what's our responsibility.
764360	770400	And that's the core tenet of Zero Trust. And it provides a better framework to look at
770400	777760	cybersecurity and rethink the way we are working towards cybersecurity. It's essentially
778400	785780	established a model of trust, verification, and continuous evaluation of trust for further access
785780	795120	and later moment. Now, when we say Zero Trust, how's the architecture? If you can see in the
795120	801680	picture, the whole system or the supporting system in the whole architecture is called a
801680	807760	control plane. And every component is referred to as a data plane, which is being coordinated
807760	814360	and configured by the control plane. In Zero Trust, we first identify a protect surface.
814360	821140	Now, what is a protect surface? It's made up of the organization's or network's most critical
821140	832500	and valuable data, assets, applications, services. So once we identify, now why we need to identify
832500	839660	because it's unique to every organization. No two organizations can have the same crown jewels.
839660	846860	So we need to first identify those unique critical infrastructure. When we have identified that,
846860	851380	we can identify how the traffic moves around the organization,
851380	855300	understanding who the users are, which applications they're trying to access,
855300	862360	and how they are connecting to the network, and enforcing the policies based on that.
863320	869440	Once we have the basic understanding of interdependencies between data, application,
869440	878860	users, services, we can put controls, especially when we say that these protect surfaces
878860	884860	need the control as soon as possible, creating a micro perimeter around it.
884860	889020	And we can create a micro perimeter by deploying a segmentation gateway,
889460	895420	more commonly known as a next generation firewall, especially to ensure only known
895420	899780	allowed traffic or legitimate applications have access to the product surface.
900160	906120	The segmentation gateway can actually provide us granular visibility into the traffic,
906120	910160	and enforce additional layer of security, especially layer 7 security that we've been
910160	918040	talking about. And people always talk about network segmentation, but application segmentation
918040	924580	is also equally important. So we need to have application segmentation, application gateway
924580	931100	segmentation, or network segmentation in place. We continue to monitor and maintain in real time.
931740	939180	Still, we are actually lacking a lot of things. First, we identify one perimeter,
939180	945960	secure that. Move ahead. We need to go phase by phase. We cannot say that we are going to do
945960	951860	everything at once. That's not quite humanly possible, or even with machines possible.
951860	956780	Everything takes time. We need to understand the environment. We need to start understanding
956780	961880	what's happening in the organization. What assets do we have? What network do we have?
962200	969240	So at the same time, implementing zero trust in an enterprise network is predicted on the
969240	976420	organization's network itself. It establishes where boundaries can be placed, and enforcing
976420	982200	access controls to shield the specific applications, sensitive applications,
982200	989780	such as which are on-premise applications, data centers, safeguarding it from unauthorized access,
989780	994900	and lateral movements that I mentioned. Most companies have applications and data spread
994900	1002000	across the multiple locations, and don't have insight on who's accessing their application,
1002000	1008860	how data is being stored. So to address all these things, companies have often accessed
1009600	1016420	multiple resources, use multiple technologies around. And when cloud came into picture,
1016420	1026520	everybody needed, like, we need information stored secretly, safeguardly, on the on-premise servers.
1026520	1032320	And when we are moving to the cloud, a public cloud, private cloud, SaaS applications,
1032320	1038480	we have started using. So how shall we leverage all those things? We started talking about CASB.
1038640	1045740	We started talking about inbound proxy, virtualized firewall, software-defined perimeter.
1045920	1052540	So this is a mix of technology, which actually creates a segmented security architecture,
1053390	1061200	where we can actually, which might be difficult to be sure what policies are in place, or how
1061200	1069140	data can be secured. So to succeed, we all need to have a single unified security architecture.
1069140	1076080	This is our network, where the users are accessing these applications. This is how data is flowing
1076080	1081880	across the public cloud. These are my SaaS applications, and this is how they are interacting.
1082540	1090240	This is my private cloud, and this is my data center. There are controls and limits who has
1090240	1096760	access to what information, what assets, how they can use it. If we are dealing with any
1097940	1103760	third-party vendor, how much access they will have, whether they will have read-only access,
1103760	1108840	they'll have write access, inspect the traffic, and enforce security policies.
1110120	1116520	The first thing, we should categorize the data. Ultimately, security teams are focused on
1116520	1123660	protecting the data, whatever we say. Where possible, data should be safe, even when it
1123660	1131320	leaves the organization, leave the device, app, infrastructure, network. The controls that we have
1131320	1140080	in place, data should be classified, labeled, encrypted, and access restrict based on all of
1140080	1147600	these things. So, what should we do in that case? We should first understand the current setup.
1148180	1155400	Take a detailed look at what current data we have, what locations we have, do we have any
1155400	1163740	regulations in place? And data classification also is important because it allows organizations
1163740	1172480	to manage the data more effectively and accurately. The organizations might be facing issues, okay,
1172480	1178700	my assets are lying all over there. But if you think about, there's a crown jewel, and we have
1178700	1183840	not marked it as a crown jewel. There's a low-hanging fruit, and we don't know whether it's
1183840	1191880	or that might be a critical device for some of the teams. So, it's very important to label it,
1191880	1199100	whether it's restricted, internal, external, confidential, private, or what kind of data it is.
1199840	1205560	Principles of least privilege. And you must be hearing it from like,
1205560	1211740	ages back, okay, we should have principles of least privilege. Did we implement it?
1211740	1217700	Least privilege access rights is a fundamental principle of zero-trust security. Overly
1217700	1224580	excessive access is one of the key issues causing the insider threat to become insider incidents.
1224580	1231520	Zero-trust networks only allow access rights as and when necessary. Covering the access is
1231520	1239300	no longer appropriate. So, authenticating and verifying on all access is important.
1239300	1243300	User access to cloud resources must be first authenticated.
1244420	1250660	Certificate-only based authentication is a weak solution. As a certificate can be stolen. If I
1250660	1255840	have your certificate, I can log into the environment. Another insecure approach would be
1255840	1263640	insecure access method to jump host or bastion host. So, what we can do is we can have
1263640	1269660	multi-factor authentication which can be integrated with LDAP or any other solution
1269660	1276240	which can be there. And we can have single sign-on which can improve the authentication strength.
1276540	1286700	However, authentication itself or alone is not sufficient. Users accessing the cloud resources
1286700	1294980	must be authorized once we have authenticated. So, the fine-grained control can be applied.
1294980	1302360	And less lateral movements of a user can make it even if someone try and access the network,
1302360	1306500	we have fine-grained access, the access can be stopped then and there.
1307620	1314960	User account with least privileges. Especially if an employee leaves an organization.
1315900	1322400	How about removing their access? It becomes very important to remove their access.
1322540	1329200	With the principles of least privilege, an employee whose job is to enter the data center,
1330100	1335960	the person can actually add or modify the records. If the person's laptop is infected
1335960	1343600	with a malware, what could go wrong? The system can actually install a malware on other systems,
1343600	1350820	infect the database. If the person has root credentials, the infection can actually spread
1350820	1355880	the system-wise and spread in the network. I'll give you an example which happened with me,
1355880	1361380	wherein a person was working with me. The person was a network person who was handling the
1361380	1368400	firewalls. His job was to monitor and work on the firewall rules. So, the person can monitor and
1368400	1374180	make changes to the firewall or ACS. But suddenly, the person moves to security team.
1375000	1383740	Now, the person's job is to manage the firewall logs, which is like a quite different thing.
1384660	1390300	Now, the person who's managing the firewall logs suddenly gets a request,
1390300	1395720	that can you please modify this access for me in the firewall? And the person does it.
1396660	1402560	Practically, the person should have access to the network or network firewall? No,
1402560	1409000	the person should not be even having access to it. Lead the modifying part.
1409520	1416500	So, it becomes important to have all those rights checked at the regular intervals. We can have
1416500	1422960	just-in-time privilege. If a user who really needs access to the root credentials, reducing
1422960	1430500	privileges, especially when they don't need it. We can use disposable credentials. We can enable
1431300	1436800	a function. Okay, these are the six hours or six days a person needs access to this environment.
1436800	1443620	And after six days, let's remove the access. So, all of these things can be done. And we can
1443620	1448840	actually stop the lateral movement of all those attacks that are happening, might be spreading
1448840	1457580	across the network. And this is one of the things that the primary thing that a pen tester can
1457580	1464840	leverage. If all those privileges and rights are not there, that can be exploited. And as a security
1464840	1473120	researcher, if these things are not there, I am going to target that. If we zone off what the team
1473120	1477420	or what the malicious actors might get access to,
1477980	1485240	we can stop the attack because they will be only able to infect a certain zone, not the whole area.
1486320	1496380	So, if the public cloud we are using, we have to have principles of least privilege.
1496380	1503320	We have to have a principle to build the cloud network, which can result in an isolated island
1503320	1511440	of a lot of different networks. If one network is breached, we have other networks which can
1511440	1518600	be safeguarded, because it's impossible to gain access to those networks, which can actually
1518600	1526920	reduce the attack surface. Now, tell me one thing, how many of you have multiple accounts,
1526920	1532880	multiple passwords? I have. I have like tons and tons of username passwords, tons and tons
1532880	1542700	of accounts on multiple websites. So, what could go wrong? Earlier, the identities were not defined.
1542700	1550700	There were all internal applications. There were many passwords. Then, in mid-90s, identities, we started
1550700	1558860	defining. We started uniquely identifying who has access to what. We started talking about single
1558860	1564940	sign-on, password policies, role-based access controls. Then came an era where we started
1564940	1572680	talking about how about having a multi-factor authentication, because we saw so many breaches.
1572700	1577160	With banks, with financial institutions and whatnot, healthcare industry.
1578440	1584620	We made sure that we have to have something in place which can reduce the privileges. So, we
1584620	1591040	came up with principles of least privilege. Then came a point that that's not necessary. How about
1592060	1598740	understanding what could be the risk score? How are we handling the risk of an application?
1598740	1606460	How are we handling the risk scores? Adaptive access, context-aware access, authorization,
1607700	1614100	application-only access. And now, we're talking about, let's go password-less.
1614400	1623820	We're talking about QR code scans and whatnot, FIDO2. So, all of those things are actually
1623820	1631940	contributed towards maturing the organization IAM strategy. Now, what is context-aware security?
1631940	1640160	And why are we even talking about it? So, if we look at 10 years back, MFO was just a pain.
1640220	1645660	People would cringe and say that, I don't want to use multi-factor authentication.
1645840	1652320	We will all stick to the old world. Today, with all the modern solutions that we have,
1652320	1658080	especially with cloud, can we just have a username and password? I have, on one of the projects,
1658080	1664580	wherein the organization was using six-digit characters. Should we use that small character
1664580	1671420	password? No. When you talk about moving to cloud, we have to be sure that we are using a strong
1671420	1677620	password. We have to have a strong password policy. We have to have multi-factor authentication to
1677620	1687740	verify during login or password checkout, especially at the time of privilege elevation.
1688960	1695180	Multi-factor authentication is a must-have. We cannot counter that with anything.
1695300	1702060	Passwords are not good enough. Let's face it, whatever we say. And even if we talk about the
1702060	1709540	listening to this talk, we can say that half of our passwords are the dictionary passwords.
1709540	1717580	The passwords of somebody who we know, on months, with ad123, ad06, or whatever.
1718200	1724980	All of that is there. So the good news is, multi-factor authentication is an easy way.
1725020	1731220	We have, as I said, FIDO2. We have Google Authenticator.
1731220	1735880	And many authenticators are available, which can actually help us in securing our applications,
1736420	1744260	securing our data. With context-aware access, we can figure out where we are trying to access,
1744260	1750860	which device we are using. If we're using a device for so long, there is a context that
1750860	1756040	has been built for the device. And suddenly we change the device. The application should
1756040	1763040	ask us for blocking or for asking for a step of authentication and saying that, okay, let's
1763040	1773680	re-authenticate you. If I am in India right now, if I'm in Bangalore, suddenly I log in from US,
1773680	1780800	UK, or any other location. Am I supposed to log in? No, I'm not. Practically, it's not possible.
1780800	1787800	So what shall we do? Block the access. And adaptive access can be on applications and
1787800	1794680	services. At the same time, when we have adaptive access, how about monitoring that,
1794680	1802140	which means enabling the right users or right user to have the right access to the right data
1803040	1810740	for the right reason from the right location. So what I said, enabling the right users to
1810740	1817080	have the right access to the right data for the right reason for the right location, which includes
1817080	1825800	device, network, workload, and application, all at the same time. Now, when we say monitoring and
1825800	1833040	logging, we can build identity-based network context, like creating micro-parameters that
1833040	1839320	are based on identifying the users. This is also known as zoning, where we can automatically
1839320	1843840	continuously monitor and manage the data between the zones.
1844620	1851200	Authentication and authorization can actually give us a good view of both these zones.
1851980	1858380	Besides users and accounts, every device owned by the organization should be uniquely identifiable
1859100	1864140	in a single device directory, wherein we can say, okay, these are the devices which are in use. If
1864140	1870380	there is a phishy device, let's remove it from the network. And whosoever is trying to access it
1870380	1876760	from a malicious device, let's block their access. And let's face it that hacking is inevitable.
1876840	1883280	Attack will happen. The systems will get compromised. But we should have an idea
1883280	1891360	what's our blast radius. What's our network? Then, if we find that there's something malicious going
1891360	1898540	on, we can stop it or prevent it to happen. Are the alerts being managed? How much automation
1898540	1905340	we have in place to detect the incidents? We're talking about orchestration, creating the playbooks
1905340	1910840	relevant to our organization. So it becomes important to monitor and lock all the
1911360	1920340	data which is going on in the network. Then comes, how about we architect our own zero trust
1920340	1927300	architecture, micro parameters. Once we know our data, our flow, what's happening in the network,
1927300	1934560	we can create the optimal micro networks around each of them. Separate production data from dev
1934560	1941900	and test can really, really help us in segmenting the whole network. We can have
1941900	1947940	separate cloud accounts, which can be a best practice for having isolation.
1949060	1956280	What can we do? We can define the micro parameter zones and segmentation, especially around
1956280	1962780	sensitive data. We can enforce segmentation using physical and virtual security controls.
1962780	1968660	Establish access based on these controls and micro parameter designs. We can encrypt
1968660	1976640	all the network traffic regardless of origin. But it has to be checked what is relevant.
1976640	1983140	Now, another important aspect is policies and procedures. Identity governance and policies are
1983140	1990180	very important, but must be comprehended across the applications. We also have to take into the
1990180	1995140	account the legacy applications or legacy applications that we have. Do we have support
1995140	2000500	from them? How are we going to handle them when we talk about cloud or the advanced or latest
2000500	2006900	technologies that we have? Legacy apps can be run in virtualized environments or containers
2006900	2015460	or can be segmented from the rest of the network so that if something happens, if they are compromised,
2016540	2022640	the malicious users cannot pivot and move laterally to compromise the rest of the systems
2022640	2029480	or infrastructure. So what we can do as part of implementing, starting with
2029480	2037340	categorizing data with least privilege, network management, segmentation, policies and procedures,
2037340	2045140	all of this that's there. But how should we take a step forward? Especially when we have
2045140	2052980	remote access, we have a BYOD, we have default deny or so many other policies. How are we going
2052980	2059460	to handle that? We can implement it wherein we identify what type of applications are there.
2059480	2065380	And that's the fundamental step. If we know our infrastructure, we have categorized it,
2065380	2072440	we know what's public, what's internal, what's confidential. We can define the zones, we can have
2072440	2079280	micro-parameters come in and help us. We can suggest that, okay, let's create a chunk of data
2079280	2086700	that represents that own micro-parameter. Then we can map the flows of the sensitive data.
2087440	2092500	We can have, okay, this is the segment which can be multi-directional,
2092500	2097740	which can be bidirectional, or it should be accessible to the rest of the world,
2097740	2104600	which can actually optimize our data flows. Then how about creating the boundaries?
2105200	2114000	Once we all know this all micro-network, we can design them. We can say, okay, this is what fits
2114000	2121360	for the security. And this also take into consideration that, okay,
2121960	2127960	we have a nice posture in our organization. We have a mature posture in our organization.
2127960	2137420	We can continuously monitor and log the traffic. It can actually provide us the data analytics
2138480	2145400	for malicious activities across the entire micro-parameter ecosystem. We can embrace
2145400	2150400	automation, which might not be really possible because we don't know our network.
2150600	2155400	So we can have a lot of automation orchestration policies, procedures in place.
2156840	2165080	So as I said, should we trust or don't trust? Zero trust is more of a perspective than a product.
2165080	2172340	Someone says it's a product, sorry, that's not the case. And technology moves very fast.
2172420	2177580	We can never think that we've just gotten to where we know everything about our organization.
2178140	2185160	There has to be something which might be failing. So no single technology which is associated
2185160	2192920	with zero trust architecture. There are multiple technologies, multiple processes which are there.
2192920	2196260	It also defines the maturity of our organization.
2197520	2204000	It's a holistic approach to cybersecurity, which contains multiple principles and technologies.
2204840	2213240	So can we say that identity is a security perimeter or a new security perimeter?
2213980	2222860	Can we see that now? So there are things that we've been doing. There are things that we can do.
2222920	2228300	But we can take the baby steps. We can take the steps towards the zero trust journey.
2229360	2235800	And the first step comes in when we start thinking about it, that what are things we can do? We can
2235800	2242100	talk about verifying the users. We can have single sign-on, multi-factor authentication everywhere.
2242100	2247400	We can have user behavior analysis. We can have risk scoring for accesses. We can validate the
2247400	2254180	devices. It could be device and app management, device context. We can have endpoint privilege
2254180	2261720	management properly. Then principles of least privilege, which we can never remove. We can have
2261720	2270360	granular role-based access, which can actually limit literal moments. Then how about learning
2270360	2276840	from the architecture that we have and adapting to the new architecture using machine learning,
2276840	2285300	AI. These are some of the references that I have looked through and researched of
2285300	2293640	some amazing corporations. You can reach me on Twitter, LinkedIn. That's my email address. I'm
2293640	2298140	very much reachable on all the platforms if you have feedback, if you want to have a discussion.
2298640	2306820	And then we're all good. Thank you so much. This is Namaste from India. Thank you.