Enterprise Security Leadership: Designing Enterprise for Multi-Cloud

Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with
or

Already have an account? Sign In »

Time
46 minutes
Difficulty
Advanced
CEU/CPE
1
Video Transcription
00:00
This course is powered by Sai Buri for teams. Security leaders encounter new workforce challenges daily cyber for teams helps organizations build a cybersecurity enabled workforce to tackle new challenges, handles security incidents and prevent data breaches. If you'd like to learn more and see how other security leaders like yourself
00:18
are utilizing Sai Buri for teams,
00:20
you can schedule a free demo at the link below or search teams in the navigation bar.
00:26
I wanna welcome everybody e appreciate you all
00:30
you know being with us for these sessions. Uh,
00:34
this session is kind of by popular demand. A lot of you wrote
00:39
saying you wanted to go through in more detail the cloud stuff that we've done in the previous course.
00:45
Um, even a number of you asking if we could just reprise that. So we thought, Let's let's do that. Now, If you've sat through kind of my pitch on how the perimeter morphs into a distributed virtualized enterprise,
00:59
I sit through it again. It's something that you should absorb, and I'd like you to be able to explain this to your senior leadership team. Remember, this is a course in leadership, so not necessarily here to convey
01:11
a design opinion,
01:14
but to help you see how these opinions air Best explained.
01:19
So this has sort of the dual purpose here this next hour or so
01:25
of not just showing you, you know, the cloud issue, which of course, is important. It's from my whole life doing this,
01:33
but also
01:34
to give you a feel for how I think these types of things should be explained and convey. Let's just
01:41
you come up with your own style, but you should have a style and it shouldn't be bullet points on view graphs
01:48
and it shouldn't be excel spreadsheets. It should be that you develop a way to tell a story.
01:55
So so again, sort of.
01:57
This is a reprise of some material that we've we've done before, not in this session, but you know, the last course that we thought.
02:06
But I'm going to go through something. It's a super set
02:09
of what we did before, But I think if you haven't seen, I think you're gonna enjoy it, because this is a very different way of looking
02:15
and how the perimeter dissolved and what
02:19
you really should be building towards when people say what should the enterprise look like this is my answer. So this is an old A T and T building one of my favorite pictures here. That's right. Right after
02:30
the, uh, Pearl Harbor,
02:32
you can see they're deciding That's the way they want to protect the bank. All these little sandbags air, like all
02:39
individual cybersecurity vendors at RSA, I think.
02:44
And this guy is standing here in the That's port 80 just kind of walk right in the building and
02:50
see how easy to scare, right?
02:52
I think e They're trying to protect the glass here from bombs, but it's a beautiful metaphor for how companies protect themselves. A zillion point solutions piled up in front of the building, and that just doesn't work anymore. So I think this question of what happened to the perimeter,
03:08
we all know it went away. But how do you explain it like it's a good way to explain the way I usually do it. Just start by
03:15
explaining that we all said there was a perimeter and, you know, little electrons try to bounce off the perimeter.
03:23
Um,
03:23
this would be the cover of most audits
03:27
that you turned in over the last 20 years where if it was inside the firewall Oh, thank God. It on it. The report it
03:32
if it happens outside Oh, that's bad. That could be reportable. And know your stuff that happens inside the company Looks like this. You trusted access is inside the perimeter. And again the
03:46
filled in circle has disallowed. Uh, now we all know the preposterous and and go back and look at some of the things that you share both with your team, with customers with regulators, auditors.
03:59
And if you have a chart like this is preposterous, it doesn't make any sense. We all know that the inside has to communicate with the outside. Does utterly,
04:08
logically, just just ridiculous here. So let's kind of let let's fix the chart here. Let's let's make it more accurate. So this is what you got inside? The first thing we know is you got email. So this idea that you know, back here on the email, but it doesn't give me the kid outside ridiculous.
04:27
Well, that's what it really works, that there are
04:30
ways to connect out and whether they're just, you know, naked connections or whether use Demark
04:36
to try to be careful about what goes in and goes out, and and the fact that, you know, tryingto make sure nobody spoofing your domain or whether you
04:45
have a very special arrange of remain, I don't know.
04:47
But I guarantee you're connecting outside, right? Your and even if its office 3 65 which we'll get to in a bit,
04:54
um,
04:55
you know, there's probably going to be some sort of
04:59
internal,
05:00
so that's the first thing. Second, I bet everybody's outsourced stuff,
05:04
and it's always, ah, wonder to May when someone tells me where we outsource. But no, we don't let them in. We authenticate hm
05:14
and I say where and they say in our data center,
05:16
you left man.
05:19
It's
05:20
It's like letting somebody into your kitchen to decide if they should be allowed in your house,
05:28
right? I have a desk in my kitchen and I said, All right, I'll term if you should be in my house. Step right in. You come in through the front door, you walk through my living room into my kitchen.
05:35
Andi, have a table. Aaron, I said, should be allowed in my house. I authenticate you. I mean, that's essentially what we dio
05:43
with internally hosted gateways that authenticate outside entities. It's okay. I mean, you can say, Well, I've got a trusted path there and I monitor all right, But I'm just saying you're open, you let them in. And if you say well, I don't do it in the perimeter. Well, that's exactly the point. That's where we're going. In this presentation,
06:00
I mentioned office 3 65. That's outside your perimeter.
06:03
If you're doing outsourced gateways outside in the cloud that said, you get the point like either you're in or you're out. Which is it?
06:09
If you're in, then the packets come in even if you're authenticating. You know, ditto partners, like, if you've got Tier four support for all your switches and networks or whatever the vendor can get in or you've got third parties that you work with,
06:28
they're your law firm. Or maybe I don't know,
06:31
partners come into also probably through a gateway did literally. Same thing is the outsourcing. In both cases, you might be doing some weird *** like source I p authentication. You know, it might be shutting based on source. I p. I don't know,
06:46
but the point is that
06:47
um, you're certainly letting with packets in
06:50
remote access, right? Everybody wanted wants toe work from home.
06:55
So
06:57
you let him work from home.
06:58
What are they doing? They're hitting a gateway. Where is that gateway? If it's inside your perimeter, then accesses starting on the outside and hitting a resource on the inside, period. That's just
07:09
fact.
07:11
Um,
07:12
and with cove it
07:13
we're all at 110% working from home. I say 100 and 10 because nobody knows exactly.
07:19
They there
07:21
it was coming in and out.
07:27
Um, I could remember 20 years ago worrying about having 15% of the company able to
07:32
work remotely like for a snowstorm or weekends.
07:36
Now, that sounds ridiculous. It's Hateley absurd to say 15% got 100.
07:41
So again, you're coming from the outside in
07:43
If you're a non trivial company, got a bunch about no gateways and don't think you don't even if you're running scans and building maps
07:50
trying to do discovery. Um,
07:54
if you do that properly and I'm an example of somebody who does that,
07:58
you're always finding stuff that someone set up. It's usually not something blatant and stupid. Once in a while it is.
08:05
But see something subtle. Um, that gets set up and you find out about these gateways to the outside from a research lab or
08:13
who knows what you find these
08:16
I and your web. If your webs Yeah, again, I totally get that. You probably host somewhere else, but I'm making a point here that
08:24
you're either inside your perimeter, you're out,
08:26
your your resource is or either inside your firewall or they're out, and I get the whole thing around ragged edge perimeters and so on. I'll have some more to say about that
08:35
towards the end. I've got a little joke that I'm going to share with you. That I think is quite funny. Particularly nowadays, with all the politics going on.
08:43
Um, so this is more along the lines of what you got. And when you have this kind of arrangement,
08:50
um, you know, with all these different things. Look, look, look. What can happen, Aiken, tie a path here
08:56
from this dot to that dot I can come in through the outsourcing gateway, and we would call that lateral traverse ALS,
09:03
like some of you might refer. That is East, west.
09:07
If I crossed the boundary. We call that north, south,
09:09
south, north
09:11
on the east, west being the designation.
09:15
So you can explain that sort of thing pretty comfortably to finance Team Thio
09:20
executive
09:22
even to the biggest Luddite on the planet. Concede these little bubbles and get a general sense of what this means.
09:28
You know, this is in essence, explains what happened. And you can explain a p t in this context that when these lines happen slowly and when I dwell once I land somewhere maybe for days, months dare I say even years where p the persistent means you dwell.
09:46
Then you know I couldn't go through this very slowly and you may not notice I tiptoe in and out
09:54
the way of explaining it because when they ask you well, how does it happen? You can show Well, maybe somebody got I don't do DIY, Mark or I don't properly authenticate email and then some jerk clicks on a fish and you know, it's traversed across the records. And maybe I'm not doing the reverse proxy or something where I've got
10:13
your elf filtering or
10:13
categorizing Internet sites,
10:16
you know, for outbound egress type access.
10:20
If you're just doing these things wrong, then a PT will absolutely happen to you. It's not even a matter of whether it's just a matter of how intensely. Okay,
10:31
so what's the result of this? That's your perimeter. All the little cuts in it.
10:35
Okay, so when you're talking to,
10:39
I don't care who
10:41
Executive
10:41
regulator,
10:43
your own team.
10:45
And they say, What's all this stuff I hear about the perimeter and firewall and so on? This is how I explain it. I think I just did that in 10 minutes.
10:54
It's about 12 minutes after Ah, yeah, you act for two minutes
10:58
and 10 minutes. Boom. There is
11:01
That's what happened. That's why the perimeter is not really ah, perimeter.
11:07
So make sense again. I'm not saying that you have to follow how I do it here,
11:13
just saying you should have your own way of doing it, and you should be able to explain a topic like this in 10 minutes
11:20
with visuals that would be just a Z interesting to somebody who's got a
11:24
background in cybersecurity or networking, as it would be for the chairman of your your corporate board, who
11:31
can't even turn a lot uh, iPad on
11:35
all the same, should be able to communicate with all of them appropriately.
11:39
So let's go on. All right, there's the problem. I get there is a problem. So now there's this thing everybody is running around saying zero trust, right?
11:48
Forrester coined the term some number of years ago.
11:52
I've been given talks on this
11:54
for a long time. If you go back and look on YouTube or something, you can see me up in front of a big
12:01
bunch of people
12:03
describing something I was calling it. The time rings around things that was You're saying you put things at all of us. So, like workloads, you put rings around. It's like micro segmenting. We didn't have the terminology, but that's what I was describing.
12:20
And a lot of people much smarter than me back in the back of 18 t where I was thinking these problems through,
12:26
um really zero trust
12:28
eso Now the question is Well, how do you explain zero trust? What is that? The first off zero. Trust is a condition.
12:35
It is not this thing you choose. It's the result of this thing I showed you like when you have this. What that means is that if there's two entities in here, like if I go back and we just picked two entities marketing and records,
12:52
well, should they trust each other? No, they shouldn't
12:56
because they're both exposed. I don't mean exposed to the outside. I'm exposed everything. There's insiders in here. It's not just out is bad and is good. We've all learned that's just utterly ridiculous. You know this idea that all the insiders could be trusted. If only it's such a 1975 you
13:16
of the way and enterprise would operate
13:18
and it was wrong. Then there were insiders that shouldn't be trusted then.
13:22
So we shouldn't just inherit trust based on
13:26
the fact that we sit on the same local area network, that that's a condition. And when we say zero trust, we mean the condition is when you're communicating, you shouldn't inherit
13:37
trust
13:39
based on locality
13:41
or based on some sort of common hosting
13:46
on ah, on a network or local area network or inside a perimeter. However, um incorrectly that perimeters viewed is providing protection. So zero trust is this condition, and I have to do a Charlie C so cartoon, so I wrote this one, Rich Drew. It is one of my favorites.
14:03
It's Charlie. There's a hero talking to his manager,
14:05
he says. We've implemented zero trust, the manager says. I don't believe you. And Charlie says exactly So that in essence,
14:15
is it in a nutshell. This idea that zero trust is the way that we
14:22
you know, the remote work and work from home. And by the way, I my shameless plug here I hope you'll by Rich and I did a cartoon boat that I think is
14:33
better than download it to your Kindle for five bucks. But here's the idea.
14:41
Zero Trust means
14:43
you must self protect.
14:46
And I always think of
14:48
astronauts,
14:50
you know, talking across some tether here.
14:52
The astronaut has to be a self contained, self protected entity. The astronauts, not he or she is not in the space station
15:01
and similar this other restaurants, not in the space station. They have to self protect their floating out, like on the Internet or wherever, even if they were inside the space station.
15:13
If you believe that the space station is, say,
15:16
vulnerable to space dust or junk floating, that might remember that movie gravity where if you were inside the space station boom that blows up, you die.
15:26
Well, if you're wearing your spacesuit, in theory, you wouldn't die
15:31
because you can exist on the inside or outside.
15:35
So I sort of like that image of you wear your spacesuit. You're all jacked up. You've got oxygen, you could exist in or out. If you're inside and something happens to the space station, you don't die. If you take your space suit off and you're wearing the NASA shirt in the
15:54
and you're eating an apple or something,
15:56
boom, you die immediately.
15:58
It's a way of thinking about your trust and kind of a completely non technical
16:03
of you. But here's maybe something a little bit more gearhead
16:07
that you can use. So entities
16:10
inherit or rely on trust when the firewall perimeter really does work.
16:15
When you really do believe
16:17
that the space station is not going to be leaking and there's not going to be something flying through that will kill you,
16:23
then we can take off. Our protective rappers and two entities contrast each other, communicate without having to self protect
16:32
so you could see share freely but similarly, in our world malware controversies that well, what is zero trust? Zero. Trust is where I don't trust. I have to. Self protect
16:44
makes it more difficult from now. Where to traverse. That's it. In a nutshell, it really is not that much more complicated than that.
16:51
Now a million things pop up as consequences of this.
16:56
You go. Wow. Um,
16:59
it was easier
17:02
to
17:03
not self protect like this was more convenient. I applications could just
17:11
connect to each other. I could have a front end and back end.
17:15
I could be dealing with some database. Um,
17:18
my users can connect to me the server or the reverse
17:23
servers to users
17:26
I don't have to worry about, you know, multi factor authentication or any of that stuff. Maybe a little bit, but probably not.
17:32
That's spectacularly convenient. Just like it's convenient to take your space suit off
17:37
in the space station. I get that,
17:41
but this fourth condition here,
17:45
it's just gotten too crazy. So when you're talking to an executive to say, this is the way it used to be, Number four used to not be a big deal, so we put up with it.
17:55
But now it's a gigantic problem, and we have ran somewhere and all these things that are just terrible.
18:00
And
18:03
it's caused an inflection point to be passed
18:06
so that it's just the convenience here no longer
18:11
justifies
18:12
running in that mode.
18:15
So we run in this mode and also recognizes that
18:18
the perimeter is breaking even mawr. It's not even a little leak. It's just a jailbreak because I showed you
18:23
so That's kind of a nice way. And these are all the components in a lot of different pieces. In order to implement that, devices have to traverse networks increasingly five g
18:33
to hit some sort of cloud, which might be your legacy enterprise. It's cool to think of Legacy Enterprises, the cloud, What's the difference?
18:41
If you're running a legacy enterprise and you've got third parties using things that you provide to them saying a portal,
18:48
then don't you just look like a cloud service to them?
18:52
What's the difference?
18:53
So everything becomes device network cloud nap, and then a cottage industry emerges around protecting these entities like, you know, malware security. Yeah, you still need that.
19:04
I wanna make sure I have some anti malware on the end point that's why endpoint security so important? But it also be ableto would like to make sure there's malware avoidance, say, at the workload level or container level. That's why people talk about,
19:19
you know, different techniques for protecting individual containers or community clusters. Things like that
19:26
on DSO on. You see all the different
19:29
functional requirements that emerge
19:32
when it behoove is you
19:34
to build out a way to do zero trust. For all the reasons that we just said
19:41
now, one person's asking here, what's a micro segment?
19:45
Here's the idea that this is Elaine. Let me share with you my view of how you describe micro segment.
19:52
So
19:52
imagine you're a bank
19:56
and you have a big network
19:56
and you have firewalls that delimit the inside of the bank network from the outside your traditional perimeter business
20:06
and someone comes along and says, You know,
20:11
when we have breaches
20:14
on this side of the bank, let's say it's a commercial banking
20:18
Well, it's possible with this lateral traverse ALS thing that Ed was showing us
20:23
that over in our consumer banking area
20:26
that the threat could East West itself traversed laterally
20:33
from
20:33
a breach and commercial into infrastructure supporting
20:37
the consumer.
20:41
So how about
20:42
if we take a piece of duct tape
20:45
and just duct tape right down the middle of our network and say we have a left half
20:52
and a right half of our network and that duct tape will be like by a bunch of Fortinet firewalls or Palo Alto networks?
21:00
Um, firewalls, next generation firewalls, and we mediate. Traffic is if they're different companies
21:07
and everybody was Yeah, I think that makes sense.
21:14
Figure out what the traffic would be beheaded, um, emailing. But whatever, you you split the place in two.
21:21
If we refer to each of those pieces as a segment,
21:25
what I've done is I've taken a network and enterprise monolithic enterprise into two segments.
21:32
Now, let's say that works out well. And you think, Well, if I did it once
21:37
over my
21:38
commercial banking I Assad wealth management,
21:41
could we break that off? So now you think the duct tape with Palo Alto or Fortinet or somebody and you
21:48
segment off wealth management. Now you got three segments
21:52
and you're falling in love with this. This is great. You're stopping the a p T lateral traverse ALS
21:59
when you can take that to its logical extremes. The segments get smaller
22:03
and we refer to them as micro segments. Now, would you do that in a legacy enterprise? Probably not.
22:10
You pick these things up and throw them, scatter the men's cloud workloads, and that's micro segmentation. And I'm going to show you how to do that. That's a good segue to exactly where we're going with this presentation. So, Lane, thanks for the
22:22
that very nice question. Um,
22:26
now s So this is a
22:29
what do you dio? So this is where I left you. E left you with this. These are the problems. All these
22:37
little cuts that were there, and I showed you You got these? Email, Web unknown gateways, outsource partner. Remote access. Right. There's no
22:47
mystery here. These air the gateways through which you have to allow traffic and through which,
22:52
um, access is granted and through which malware confined its way into your enterprise. So let's put some stuff in there. I'm being generic now, saying for assets,
23:03
just sticking them inside. And it's like the astronaut inside the space station
23:10
where the space station is leaky and you can't trust that there's oxygen.
23:15
So you have to keep your spacesuit on. That's what we're gonna assume in this case. They don't have their space suit on and they die. So something's wrong. I'm just gonna give myself a little scratch space here thio
23:26
toe work so that we can explain this
23:30
design method.
23:32
So first thing I'm going to do is let's let's we talked about outsourcing.
23:36
Let's say it's a portal
23:37
where all of your outsource vendors go to submit
23:42
their invoices to collect purchase orders
23:47
to get paid
23:48
to ask questions, tohave
23:53
Chen communication
23:56
to them from
23:56
procurement. Anybody who does this in support of another business sing portal.
24:04
You know, that's set up. Um,
24:07
And
24:10
yes, there may be other
24:12
it
24:14
and based beer call center work. Say there's some workload
24:19
Women in the cloud like Look, I'm be
24:25
mhm.
24:30
Find it is Look at this little thing here. So you were the arrows touching.
24:37
That is a firewall rule
24:40
that has to allow for bidirectional traffic from Yeah,
24:45
that's for sure.
24:48
I want to move it. Watch what happens to this little cut.
24:52
See, that closes. You see this line here closes.
24:56
That means that the firewall the perimeter for your enterprise
25:00
can be simplified because they don't need to allow this traffic.
25:04
This thing is a point of vulnerability from which lateral traverse, aeltus A, B or D could occur when I move it.
25:12
That goes away to some degree.
25:17
I understand that if there is still communication through this cloud of virtual data center back through some opening here,
25:23
that, yeah, there's still some risk. But clearly
25:26
this is a reduced
25:29
lateral traverse. ALS risk
25:30
the East West Traverse Aly here will be dramatically reduced.
25:34
And the only things that you'd allow into and out of this outsourcing workload would be things that air just clearly designed as interactions with your outsourcing vendors. They open the portal, they do something, they go away.
25:48
I'm not gonna allow, you know, any type of it's not email or web or what? It's gonna be just a access or very, very specific about what it is that I'm supporting. And yeah, maybe there's a rest a p I and I'm coming through that I don't know what it would be,
26:07
but it would be small. And yes, I have
26:08
to micro segment
26:10
so in the cloud I have to have some sort of utility.
26:14
Whether I'm working with VM ware and using their tools or from using open source cloud software or I'm working with Amazon or Microsoft, all of them
26:25
have a compendium
26:27
of different security solutions that you can use to protect. Ah, workload in cloud. My Gaza is but must be three or 400 companies right now
26:38
that sell solutions to protect
26:41
your work clothes.
26:44
So just do it. So I know that this is you. Go gosh is making it so simple.
26:49
But it kind of is
26:51
Andi. This is what you would show an executive. You'd say we went from being inside to being outside on. We're protecting it locally. I'm not relying on this perimeter anymore. And, yes, there is an opening. You can see that,
27:04
but it's a small one.
27:07
It's a micro segment, has a very well defined
27:11
and minimized interaction with the outside. Let's pick another one email.
27:15
Pick the thing up and move it to Microsoft. Their use office 3 65.
27:18
Guess what? I don't have to worry about
27:22
patching exchange servers anymore.
27:25
I don't have to worry about scanning of the lands that were supporting my email service.
27:30
Um
27:30
I still have to do stuff. Maybe you have tow engage with mine. Castor Proofpoint to do.
27:37
You know, filtering on the content. Still stuff you dio.
27:41
But I don't have the perimeter risk anymore
27:45
of dealing with the service hosting the computers, the
27:51
infrastructure, the assets that were sitting inside my perimeter before.
27:55
I just have to learn to interact with that workload. As all of you have learned, say, with Gmail or office 3 65. Let's pick another one, partner Gateway
28:03
Boom, boom! Move it out. Their micro segment. The thing I noticed when I say cloud BDC the word public didn't show up here once, did it?
28:11
I'm not saying this has to be a public cloud. If you're Verizon or if you're a Bank of America or you're the U. S. Department of Defense or something, you could afford to do this right.
28:25
You can You can build your own private cloud. I don't care. And you can do it in virtual data centers. I'm just saying
28:32
you can't rely on the perimeter to do the protection. This whole thing could be wrapped inside your perimeter and you just make believe it doesn't work.
28:41
It doesn't matter how you do it. You just can't. You have talked about zero trust here,
28:45
having this workload down here no longer trust this workload, they have to communicate through their respective
28:53
exported and imported interface services and through the cloud front, front of the front door.
29:02
Email one stucked outsourcing. You do it the way everybody else does it. I don't mutually trust you the way
29:07
here.
29:10
I was mutually trusting this thing. An email. There was mutual trust was inside here,
29:15
no more mutual trust. And there did same thing for partner.
29:18
They really follow.
29:21
Now let's clean this up. I'm going to do just some basic clean up on the diagram. You know, nothing
29:26
that z meaningful in terms of the functionality. Let's do this first.
29:32
I'm just taking this and redrawing it,
29:34
and I'm going to refer to a legacy enterprise. Almost. It's like another cloud, right? It's got It's got all these firewall rules and notice. When I moved this thing when I went partner to cloud, you see, this rule goes away like I cleaned up some of these rules by just going and moving things out to the cloud.
29:55
So now I'm going to draw it this way.
29:56
I'm going to get rid of like this. Just some space junk around here. I can draw it this way.
30:00
And why not? Just,
30:03
you know, we'll we'll get to fix things. What I want to do first is to show you how we manage each of these little cuts. We're gonna take a detour. We're gonna do policy quickly.
30:15
If you say, Well, who's managing all this stuff where you're gonna have to have some workload
30:18
that can manage the policy, You're gonna have to have some security function
30:23
and you're going to sit it in a virtual data center. And again, there's a dozen products that do that.
30:29
You know, it could be some sore thing, or it could be a policy manager. Could be an SDP policy controller, like from a VM ware, for example, does things like R V armor does something like that? VM Where does well so So you get this kind of arrangement where a managing the policy
30:48
again. Let's clean that up again. I have to show the cloud there.
30:52
I could just call them all assets,
30:55
clean that up to look like the other stuff and make them look like nodes. Now let's go back. I did a lot of clicks there.
31:02
You also where we got to that right? I just moved that over.
31:06
I got rid of that picture. I added a policy controller,
31:10
got rid of that ugliness and then just kind of cleaned up the dots so that I say command and control and a bunch of nodes. You know what I mean by a node Now, and note is a workload.
31:21
Ah, commanding control is something that, in essence, is there too.
31:26
What's
31:29
to manage policy and to manage what? The security function. So
31:34
here we say, node command and control. And now
31:37
you would all say, My gosh, if I draw, you know, take a gun and shoot this thing out, I have a mess. Well, I could do something like fast flux. DNS Does,
31:47
um, you know, with a baht net
31:48
where if the nodes can all become controllers or if I have multiple controllers, I could make this thing more robust. Right? You don't want a single point of failure here, So you're gonna want multiple C and C notes. That's how we'll draw it. But for now I'll just draw it this way. You get the idea.
32:07
So now again, let's just clean up the diagram a little bit.
32:09
Get rid of those lines. I don't need that.
32:13
Put it somewhere, but put it in good. Put them in good places, connect them up. And that's what I think every
32:20
enterprise on planet Earth should look like today. This is what your network should look like.
32:28
Now Notice the's dots. Here are not servers inside a perimeter.
32:34
This is not a perimeter network. These air like I showed you, I got there these air, all assets that are micro segmented workloads and your whole company becomes just a bunch of workloads
32:45
with controllers, workloads and controllers. That's
32:49
that's the architecture. Ah, blob of work like here in Toronto, a whole bunch of work
32:53
and out here in Australia, a whole bunch of work that za workload.
32:59
It could be an application. It could be a set of applications. You define it,
33:02
but it's self contained, self protected, and it has no mutual trust with anything. And these red dots are the administrators.
33:13
That's where we do command and control.
33:15
This is what it looked. Whether I'm talking Thio my graduate students or I'm in Washington talking to a bunch of senators.
33:22
This this is what I say. They say, Jesus, your I've been doing this so long
33:27
we hear that we shouldn't be doing the architecturally we do it now. What should be I do this picture. I still click through all these dots.
33:34
I've done this for senators and I've done it for PhD students. And I don't change the words at all. What I've said to you,
33:40
I think
33:42
is I've used no
33:45
crazy acronyms.
33:47
I said command and control, but you get what that is. I snuck in fast flux there. Sorry, I probably shouldn't have
33:54
because that that is such a logical connection there.
33:59
But I'm just saying a letter. I could understand what I just went there. You don't have to be like some
34:04
crazy computer scientists. Now there's more to it here.
34:07
Um,
34:07
let's let's have some fun. It's election time. So
34:12
why Why couldn't the Russians find the deleted Clinton emails? Look, this is this is probably gonna make fun of the Democrats a little bit here.
34:20
Eso Some of you think that I'm doing this toe make fun of you know who I'm not. This is This is more
34:28
poking fun at the in a sense, that
34:31
Clinton. So here's what I mean by this.
34:36
A global perimeter is different,
34:39
then that that's a distributed enterprise. That's a global perimeter meaning. If these air just nodes and this thing in Toronto trust the thing down here in Australia,
34:49
then that's exactly what that circle was. This is just different shape than a circle. It's a funny blob,
34:55
but it's wrapped geographically and you know that's a that's a global perimeter, not secure. There's lateral traverse, a LRIs cure, a p T.
35:05
So if somebody hacks Toronto, then Australia is vulnerable. If somebody hacks of Australia, Toronto's vulnerable. So let's say Toronto peoples in my God, I I wanna fix this. I want a micro segment. I just showed you micro segment means moving it away, right?
35:23
Isn't that what we just said?
35:24
You take that, you move it away, take that and move it away,
35:29
right?
35:30
That's what it means.
35:30
Well, let's look at the US Department of State.
35:35
The the US Department of State
35:37
has about 350 embassies, consulates all around the world
35:43
and I would argue that they're not the best managed
35:46
from a security perspective,
35:50
their ambassadors, they're wonderful people. They're capable
35:53
there for the most part, when it's not too political,
35:58
they're assigned because they have some facility in the region, interest in the region and they usually real dedicated. People are smart,
36:05
but they don't wanna listen. Toe Washington the foggy bottom, telling them to pick good passwords and
36:12
follow good security. Most of the time they don't
36:15
have much,
36:16
I would say respect for the cyber security teams.
36:21
So what tends to happen
36:22
on networks such as the U. S State Department
36:27
is
36:29
each embassy make security decisions
36:32
that are often quite somewhat dubious in in their origin. My favorite story, which I think I shared with you guys. Also tell it again, because I love the story so much. Barbara Bush, who was the wife of the first George Bush president, was going to some embassy to dio like a talk or something,
36:52
and she died a. She had, like this, uh,
36:57
charity or something that she was doing work with. And I think they made a YouTube video
37:01
and the embassy was going to show the YouTube video when she came for the visit.
37:07
That's how the story was described to may,
37:08
and you can imagine the scene flat screen. Everybody comes in Nice party. Everybody step
37:15
being wine or whatever. You having a party like that. She comes in. She's nice, Ladies comes in,
37:21
explains what she's doing,
37:22
and they show the video that shows her work with, You know, this charity and everybody clapping loudly. Everyone who's listening to me has been to 1000 of those s O just before the event.
37:38
At this embassy, the Internet goes down,
37:43
and
37:44
the team is terrified
37:46
that they're not gonna be able to show the video
37:50
so they freak out.
37:52
And just before the event, a new WiFi network becomes visible
37:59
inside the enterprise and they realize they can connect to it
38:02
and actually get out to the Internet, where their ISP or whatever I had broken,
38:07
so they made the decision. Well, let's connect to that. It's fine. We get to the Internet, get to the end. It's connect so low and be able to connect the embassy to that network.
38:16
They show the video, everything goes great, she leaves and then magically, that WiFi network disappears and their Internet service is restored. And I think everybody on the call here knows exactly what probably happens, right. They
38:30
that that network was put there,
38:34
you know, so that they would connect to it.
38:36
And that node was then infected with malware,
38:40
you know, Might have been Australia. I don't know. That could be whatever. So if it did happen in Australia,
38:47
then up here in Toronto or whatever, whatever is up here Calgary, Toronto
38:53
um,
38:54
you'd be
38:55
vulnerable.
38:57
So
39:00
Hillary Clinton, back when she was running a mail server,
39:04
the argument was that it was less secure for her to move it out into a separate mail server, and I give them zero credit for doing it to be more secure, moving it out.
39:15
This is what she did. She isolated it, which makes it where the Russians couldn't find it. But But the point is,
39:25
if she had left it there, if she'd been using the State Department's network,
39:30
we all know that the nation states have each other's networks.
39:36
It's if you go Google
39:37
Russian attacks on U. S. State Department,
39:40
you'll see that the Russians have owned the U. S. State Department network for years.
39:45
It's like Child's play to break into this network. I just gave you an example of how you might do it.
39:51
So
39:52
So if she had left everything on the mail server in the official network, those you supposed Thio
39:59
she had gotten hacked.
40:00
But by moving it like into some basement in New Jersey or whatever the heck that server waas
40:06
I have this image of this nation states saying, Darn it, I can't find it. It's It's just often some crazy place.
40:13
We can't get it.
40:15
And the message there for you is not a political one.
40:19
It,
40:20
I mean that that explains why you know you haven't seen those emails. Not again. I may. I couldn't care less. That's ancient history.
40:27
Think Trump has been talking about it again recently? The emails.
40:30
But that's why they're not there because they weren't on the official network. What does that mean? For you? Means perimeters air bad, and it's a good way of showing that this idea of the officially sanctioned safe enterprise wide perimeter is a bunch of rubbish sense of a nonsense that's the worst place to bay.
40:49
If you want to be insecure
40:52
then go inside the perimeter and just rely on the fact that you live in a gated community. You don't have to lock the doors. You can leave the keys in your car.
41:01
It's everything's fine because, gosh, that I live in a community that's gated. And you'd say, Well, what about people who live inside? You go. Yeah, I guess that's a problem. What about people know the code? Oh, yeah, that's problem. What about when the gates left open? Oh, yeah, that's problem. How about when there's a party and I let a bunch of people and oh, yeah, it's from suddenly that gated community doesn't seem so good anymore.
41:21
And that's the perimeter.
41:22
So look, here's what I've done today.
41:25
I've used 45 minutes
41:29
to show you how I think you explain this stuff
41:30
right? There's no equations here doing math. There's no code.
41:36
I also don't think I have any bullet lists. Did you see any bullet lists here anywhere?
41:39
Bullet lists of the most evil way
41:43
to do a presentation. I guess that counts is sort of a bullet list. Uh, not really.
41:47
But look, this is Look, I'll flip through the presentation here
41:52
I showed this way. The perimeter degrades all these holes in it. A P. T s. There's the real perimeter. Then we had a little side dish on zero Trust. Then I said, Well, now we're gonna move this stuff around. We outsource with workloads out here, workloads out there
42:13
connect to command and control the make of nodes stickum on a geography. And there's the architecture er,
42:20
like I love that the flip sort of chart nature of that. The flowing nature of showing a visual on a set of visuals. I think that's the way you should be communicating. So this maybe is much about cybersecurity today, as it is about just the topic of communication
42:37
now, as we did last year earlier in the year with all of you.
42:42
Um, I do want to pause here and just give you a little bit of a pep talk to the end of our six weeks session. I want to take a few minutes. Maybe some of you have some final questions you might wanna ask.
42:54
Um,
42:57
I think the discipline that we are all part off
43:01
really will benefit from all of you
43:06
learning to be better executives better leaders. This is a leadership course. It's been a leadership course
43:13
where we've downplayed the tech part. We've said
43:16
there are these soft skills that air perhaps Justus, important as understanding the technology and coming from a computer. Scientists that are not an easy thing for me to admit,
43:28
but these executive skills or things that I hope you'll work on hope. Youll get sort of addicted to reading
43:32
leadership books find examples that air inspiring. I think during our last session we read Martin Luther King's
43:40
amazing speeches and tried to understand why was he such a leader? And it was because he believed in something when he said, I believe I believe said that over and over again. That's why people followed him,
43:53
because a lot of his speeches I I've gone through and he's one of my favorite people ever lived. Found some of his speech is a little dry, but when he talks about what he believes they come toe life will remember. We quoted, you know, 60 years later, so do the same thing like believe in something and and I have your communication,
44:10
be part of who you are. That's what ah good leader always.
44:15
You know it's sincere and believes in something, and people will follow you if you show them the future will follow. And in cybersecurity we've done a very poor job of that. Think about it. There's a jailbreak in terms of the offense beating the defense. All of you are defenders on. We've not done a good job. We've not distinguished ourselves at all.
44:34
We don't like to do
44:36
elections because we think they could get hacked.
44:38
An election is X equals X plus one,
44:42
right. We talk about
44:44
controlling power plants
44:46
and we sort of allow that. But then in election, which we sort of understand, we don't understand power plants,
44:52
we say, Oh my God, no. Think all these problems on election is X equals X plus one, and we don't think we can keep that secure.
45:00
So what are we even doing here? You can't secure that. What can you secure the answers? You probably can't secure anything, Which is the whole point.
45:07
This is why we need to become better at what we do. And you become better leaders, feel better teams advance our discipline and hopefully let the defense start to catch up. with the offense. It's just been a terrible embarrassment.
45:21
I think for all of us we should be deeply ashamed of what we've allowed toe happen, you know, with all these packs and all these problems
45:30
that come through. So that's kind of my closing statement. Is a couple of little questions here that maybe I'll get Thio. Let's see what the State Department was compromised but set up a honey trap
45:40
that the Russian government could look. Yeah, I'm all in favor of deception and traps that might help.
45:46
That's certainly something that could work.
45:49
Um, it would work better in the context of a micro segmented infrastructure,
45:53
but I do think I am a very big fan of deception. Kartik. So I I do agree with that.
46:00
Um, there's another one thanking for examples. Another session? Yeah, we'll see how the sessions go. I'm glad you
46:07
enjoyed it.
46:07
Any additional questions or comments before? Maybe I turn it back to the nice Sai Buri team for any closing comments they might have.
46:19
All right. Well, good. Well, listen, I've enjoyed having you guys in class for six weeks and
46:23
and I'll turn it back at the library team has any closing remarks or any administrative points you'd like to make. Now would be a wonderful time for you to go ahead and jump in and and share. So again, Thank you all.