John Kindervag: How Zero Trust Was Born

Libby Botsford: Welcome to In Progress, because nothing worth building is ever finished. I'm Doug Merritt, and today I'm super excited about this conversation. I'm joined by someone whose work has shaped how the entire world thinks about cybersecurity, John Kinderbogg. John created the zero trust model of Forester Research, a concept that went from a provocative paper to the foundation of federal security mandates and enterprise strategy everywhere. He's currently a chief evangelist at Illumio, an advisor to the Cloud Security Alliance. And was a primary author of the NS Tax Zero Trust Report delivered to the president. John, welcome. Hey, Doug. Great to be on here. Thank you. Very excited to have you and for this conversation. It's very rare that ⁓ the world gets to talk to someone that has been in and around the foundations of cybersecurity and so first principles and and foundationally driven like you are. Can you take us back? I I I was gonna jump right into let's talk about the Zero Trust initiative and how you crafted that, but but you got there through chopping wood and carrying water and and you know, ten thousand hours at this thing. And can you set the foundation a little bit for how your crew led you to networking and led you to cybersecurity that that made you so fundamentally grounded on what is what led to zero trust and and what we're all wrestling? Yeah, so I started off my career as a broadcast engineer and in the television business and ⁓ and then I I kind of fell in love with computer animation. I got to do a computer animation project on a Cray ⁓ P in L A, the one that did the same computer that did the last Starfighter, if you remember that show. Yes. That movie, the first one that had a whole lot of computer graphics in it. And ⁓ I wanted to continue on, but you know what? I couldn't afford a Cray X MP. I just, you know, d I I I dug in my pockets, not enough. And I learned how to build animation computers and then ⁓ a ⁓ a video game came out called Doom. And you remember Doom, right? Yes. I mean it was all the rage and w everybody was having land parties and so I convinced my boss since we had these very high end ⁓ animation computers that would render Doom amazingly well, I convinced him that we needed a network so that we could ⁓ play online Doom. And ⁓ I didn't tell him that was the reason. I told him that we needed it for a business purpose, but the business purpose was a little bit farther off than the immediate per need, which was playing online Doom after work, or ⁓ not online, but mul multiplayer Doom. And ⁓ that taught me the basics of networking. And ⁓ you know, it was a huge thing. I mean Doom, you know, so much of video games, I mean, ⁓ really drove the future, you know. Doom is the only video game with an assigned port number. Guess what port number? Which port number? What you for Doom. What's Doom's port number? That's a little little tricky. Yeah. No idea. Six six six six. Yeah, that goes to the perfect. Yeah. And so ⁓ learned to do networking from there and then met somebody who said, Hey, I need somebody who knows how to do networking and well, yeah, I know how to do it. And then he said, It pays this much and I said, Wow, I gotta get out of the the television business and and ended up in networking and and doing basic router switch stuff and and then they said, Hey, nobody wants to do f ⁓ do security. Would you install firewalls and do penet learn to do to penetration testing and and learn to do IDS and all that stuff. And ⁓ sure, why not? And Because I'm always up for a new challenge, and that turned out to be the right the right choice. And and so zero trust came out of you know being in those cold data centers with your with your computer plugged with a console cable and a and a crossover cable into it and and typing you know command line commands to try to get something operational. And when I was installing firewalls, ⁓ firewalls had a trust model associated with. the interfaces. So the internal interface going to the internal network had a trust level of z about 100, the highest trust level. And the external network had a trust level of zero, low the lowest trust level. And then every d every other interface that you might need had a trust level between one and and ninety nine. And by rule, by policy, by algorithm, you didn't need a policy to send traffic from a high trust level to a low trust level. And I said, this is silly, because if somebody gets in, they're going to be s able to steal all the data. And I started putting outbound rules on the firewalls. But because that wasn't the approved way to do it from the vendor, ⁓ I got in a lot of trouble and and and ⁓ I because I said, Well, this is stupid. Th there should be the all these interfaces should have the same trust level, and that trust level should be zero. So Ultimately I got fired from that job. Really? ⁓ for pointing outbound rules on firewalls. Yeah. ⁓ it made it made the vendor mad, it made the client mad 'cause, you know, ⁓ that's not how you're supposed to do it. And I'm like, but if you get in, well nobody can get on. I got I was the pen tester for this. I got in, you know? And ⁓ people will get in. People will get in. So you want to make it hard? Why were they so concerned or worried about you trying to create a more secure landscape. Like what what was what was the the root of their fear of you putting additional filters on where something could go once it got past that. It was really just because that's not how the vendor had documented it and that's not how the algorithm made it. And we won't we won't say the name of the the company who came up with that idea. ⁓ but ⁓ you know it was just like i because it was it was throwing it into their face that this idea that you didn't need to have outbound rules was wrong and the the vendor didn't want to hear that, right? So ⁓ so so ⁓ that led me to being introduced to f to Forrester where they wanted to have people with technical competency on the security and risk team, not just it prior to that it was mostly governance and compliance. And so they wanted as George ⁓ Colony said we want to put the S back into security and risk management. And so I was hired to to kind of do that. And I was there for eight and a half years and and I took that all those experiences that I'd had building systems and freezing in data centers and and kind of combined them into what became the the the zero trust model. And your predecessor over at at your company now, Steve Mullaney, who I know you know. was the first person when he was the ch CMO over at Palo Alto Networks that I ultimately ended up joining ⁓ years later, was the first person who said, Man, this thing has legs, come and talk to us about it, how we can be involved and he started sending me around the world on speaking tours and helping me promote it and and he was a a ⁓ key ⁓ you know, ⁓ that was a key turning point in everything was when Steve really ⁓ figured it out and and and convinced, you know, other people that This was the way to go. So I have I owe a great debt of gratitude to Steve, even though I haven't talked to him for a couple of years. But I'm sure he would love to hear from you. Yeah. And then he went to NYSERA, the first one of software defined networking ⁓ plays, and that became I I did work with him there too. And I did because that we were we were aligned. ⁓ NYCERA VMware NSX, we were exactly aligned in in how networks needed to be designed and built. And so I did a lot of work with Steve and and Martin Casado ⁓ then too. So and it's great to be continuing on the legacy here with you ⁓ and and what you're doing. And ⁓ Yeah, I mean you guys over Lumio and us and only a handful of others are the ⁓ the brave souls that are still jumping up and down saying, Hey guys, this this really matters. I I I know that you really don't want to do it, but but you gotta pay attention to the fundamentals. Right. I mean it's just and and it's like it's not everybody has this perception it's hard. It's not that it's hard. That's the excuse. The reality is everybody's protecting their own downside, right? Because if you try to do something that's innovative in your organization doesn't work, then you're gonna get blamed. If it works, nobody's gonna notice, right? So nobody's gonna go, Great job, great, great job. ⁓ Boy, Doug, you did a heck of a job on that project that we didn't ask you to do. But if you try to do something innovative and it doesn't work, well, you're in trouble. We're gonna point the finger at you. So there's a set of perverse incentives. So we're not doing things that are designed to make the environment better. And and people are incentivized to just not do anything because if something bad happens, I didn't do that. I did absolutely nothing. I mean, that's what they're doing there. thing that I fight against is people doing absolutely nothing. Not that they're doing something wrong. They're just doing nothing. I think I think that's one of the shared perspectives that you guys have and we have and and others when you get in and look, ⁓ certainly in the cloud even even more than on prem, it's it it's mind boggling to me how open those environments are. It really is do nothing. It is. And I and I It's all about speed, right? Because I I understand the the concerns. Yeah, they're trying to go fast. And yeah, having a constant verification framework anywhere, network, compute, identity, definitely adds friction. ⁓ but but it's pretty foundational if you want to have yeah, ⁓ a foundation that works and an architecture that works ⁓ in especially in today's environment. I mean the friction is so small in comparison to the benefit, right? So in general, like in a zero trust environment, no one knows that they're on a zero trust environment unless they're trying to do something bad. I mean, the worst case is I'm trying to get to this resource and I think I should have access for it to do my job. So I have to go to my manager and ⁓ request permission to do that. And people think that's friction. But you know, in in in the physical world, there's doors that are locked that we're not allowed to go into. And if we think we should go in there, we get a we have to get permission to get our key card changed so that we can go into that door because we need something in that closet or in that room and we don't consider that to be friction. But people think anything that's that's done to keep them from ⁓ accessing whatever they want. So, you know, the reality is the only people like Ed Snowden, if there would have been a zero trust environment in in Hawaii there And if if they cut off his access, he's not gonna call up the help desk and go, Hey, I was in the middle of setting up these SSH tunnels to these secure servers so that I could download information and send it to WikiLeaks. You think he's gonna make that phone call? No. Right? So you're just keeping bad people from doing bad things, because the good people are generally gonna be allowed to do the good things that they're supposed to do. And there's so many times in history, I mean, I have so many stories about this of people who end up accidentally doing bad things out of curiosity, right? Like when like in 2008, you remember ⁓ there was a bunch of State Deploy Department employees who got ⁓ in trouble. They got prosecuted and fired and ⁓ for looking at the the passport records of the political candidates. I don't know if you remember that. No well in their trials they all said their their defense was we were curious. Right? And my point is Why not just not let ⁓ have access to if they're not supposed to have access to it, if the law says don't let ⁓ have access to it, then just don't let ⁓ have access to it at the technological level. And then, you know, because otherwise they're just like a cat, right? I mean, curiosity is the major cause of death to all cats, and it's what gets people in trouble. They start poking around for fun and they end up doing something really bad, you know? Right. Yep. So we'll we'll s definitely spend a lot more time on How this can be practical and why it's so urgent. But if we go back up a level, zero trust has definitely, you know, through your work, has become a really important and constantly talked about term across the industry. ⁓ you described it, I think, really effectively as this isn't, it's not a product. It's it's a strategy, it's an approach. Yeah, it's it's an architecture. Walk us through. what you mean by that, because the number of companies now that have products labeled zero trust kind of goes against, I think, some of the the architectural tenants that you were are advocating and have been advocating so strongly for so many years. Yeah, I mean, originally it was designed to destroy this broken trust model, you know, of the firewalls. ⁓ that was the original intent that trust was a human emotion that had no business being on on networks and trust is I have a saying trust is a vulnerability because you know it leads to a lot of these ⁓ malicious incidents because suddenly you're on a network and then you can go anywhere on the network. And so the core concepts are what are you trying to protect? You know, why are you trying to protect it? Who should have access ⁓ to the thing you're trying to protect, you know, a and and why are you doing it? And so I started looking instead of looking at trying to protect everything, the perimeter and and and all of the assets, I tried to figure out what are the things that that are key to protect and then segment those away from everything else. And so a lot of that I was a QSA ⁓ you know in a former life. I say I'm a recovering QSA because of course PCI is a twelve step program, so you're always in recovery. But one of the key concepts was segment ⁓ your cardholder data environment away from everything else to descope it, right? And even the NSA came out with an with a ⁓ with guidance on on building networks for zero trust. And they they talked about the 2013 ⁓ data breach at Target, which people try to blame on a HVAC contractor, which yes, the HVAC contractor was compromised. That's true, but the HVAC contractor was on the cardholder data environment, which is a violation of the PCI DSS. And so it was like, you know, Target was trying to point blame at, ⁓ well, we didn't do it. It was this other person. That's what everybody does. Instead of fixing the dang problem, we just try to figure out who we can point the finger at. Right. And that's I mean, something that, you know, you and I and some of the people have been harping on is we get over rotated on entry. And entry is interesting. But The kill chain, like that the first piece is you just need to get access. Right. And then the bad stuff starts to happen. So whether they got in through a compromised or socially engineered HVAC person, it does it doesn't matter. Like they're if if you assume that they're gonna get access one way or another, then the foundational principles are so what happens then? which again, most cyber teams I talk to understand that. Yeah. Any any any good person that's been around cyber understands systems, understands defense in depth, understands skill chain. ⁓ but but walk us through ⁓ so zero trust was really an architecture and a strategy, and it was meant to apply across the system. There's many different areas of zero trust. How how have you seen it evolve? Because my readings from your perspective, especially with where you came from, and obviously I attach deeply to that, is the network is the foundational item, right? Nothing in our world works on that. Yeah, there are very few use cases that are isolated without connectivity being ⁓ the critical part of that use case. ⁓ and the one pervasive element in that architecture from a cyber perspective is network. And and you spend a a lot of time on these concepts of yep, you shouldn't have this huge trust framework once you get past the perimeter. ⁓ you should at least do this macro segmentation work, but like how do you start to create boundaries? But it's been implemented and talked about, I think, very differently since then. Like that piece seems to have been almost overlooked while people focus on other elements of zero trust. Well, you know, everybody tries to pro productize it and put Zero Trust in front of everything, right? I mean, literally at at at ⁓ Black Hat, I did a minute of stand up at the Zero Trust comedy show. Like I I couldn't saw that on your LinkedIn. I d I couldn't see the segment though. I wanted to see I yeah, I I I it it was my first time doing comedy and I just I'm kinda hoping that that just stays in the trash bin of history. But ⁓ I d I I'm not sure I did great. But ⁓ you know the the thing about it is is that people miss the key point, right? They they ⁓ they miss the the the the plot. The plot is about what are you protecting. And so the the fundamental concept is called now called a protect surface, right? I mean I had some other terms for it because it's it's it's like it's a bit like a DMZ, but it's a DMZ for why you're doing it. And you're right. Everything has a network. People try to tell me I had a conversation with a a guy. I d I'm the cloud guy. I don't care about networking. And I said, Well, there's networks in the cloud. What? How did you think it worked? I mean, I didn't say it like that, but ⁓ yeah, there's networks in the cloud. Everything nothing connects without a network. Connect I mean, it just doesn't. That's just how packets move. The fact that you have to ⁓ that those conversations as well. The fact that we have to have those conversations, it it it mystifies me sometimes. But This person actually said, No, I I can't believe that. Because there's not even servers in the cloud. I said, There's not servers in the cloud? And they said, Haven't you heard of serverless? And the way the way they said it was so derisive. It's like, yeah, I have ser heard about servers serverless. I said, Where do you think they store the data? And here's the actual answer I got back. It's stored in DNA. Wha what? I mean, it was just like, okay, well we we we this conversation yeah. Well, it's so good to meet you. I hope we can have a you know, we'll run into each other somewhere else. I mean, literally, this is a VP at at a major organization and they're so abstracted from the reality of what's going on, and this is the problem that you and I have talked about, is the abstraction means you don't actually know what's happening. And so if you don't know what to protect, how can you defend it? Yes. So I often use an example of how the Secret Service protects the President of the United States. And and and and and it works well, right? I mean, even in this thing at the Washington Hilton, where the guy ran through with the shotgun, he he breached the outer perimeter, right? But he that's it was ⁓ that was it. That's all the farther he got. He didn't get anywhere near the president because the president and his family and those people were i were the protect service. So you shrink the attack surface down orders of magnitude to something that is very, very small and easily known. So generally, in a presidential detail, it's the president and his wife and his family, right? That's who are in the protect surface. And if if those people are left alive at the end of the day, the Secret Service has done their job. They're not there to protect everybody in in the entire city. They weren't there to protect everybody in the Hilton ballroom. in i in Washington, DC. They were there to protect the president. And then there's a separate detail for the vice president. Those are separate details. And and the president and the vice president and whoever else was there that they pulled out. I can't remember if the Secretary of State was there or not. But those are set would be separate protect services, right? That have separate separate security controls, separate policies. And so all of it worked perfectly. And that's a great example of what we need to do in cybersecurity because we need to look at our credit card database and and everything surrounding the reported sales system as one system that we need to protect, a protect surface. And then maybe ⁓ if you're in the banking world, your Swift stuff, that's pretty important. You probably want to protect that. But there's some other things that you probably haven't thought about. Your Active Directory, ⁓ how how much are you protecting that? How about your network time protocol servers? Have you thought about protecting that? Because if if I'm a if I'm a malicious attacker, if I take down your NTP ⁓ nothing's gonna work. I'm sorry. Right. Just if you don't have synchronization, it it's all over with, right? And so there's so many so you you you break it down into these subsets and then so this way zero trust when I build it out becomes incremental. We're doing it one protect surface at a time, it becomes iterative one after another, and it becomes non disruptive. You don't have to be afraid of it because the most you can screw up is one. Right? So it's easy to recover. And when people fail, they try to do it all at once for everything, right? So there's a famous maxim attributed to Frederick the Great. He who tries to defend everything defends nothing. And that's true in in in in our in cybersecurity. Try to defend everything, you defend nothing. And that's what a lot of people do. Right. ⁓ all right. So Your view of the state of the world today. Like You've been advocating this on a public stage for what is that sixteen sixteen years now? Yeah. ⁓ before that. Where where do you see the the average environment today? ⁓ and and and if we think about the elements that people still can touch and control, their branches, their colos or data centers, and then the stuff that has been much more abstract at the cloud. If you could give a give give your view of What kind of ⁓ thought process and ⁓ and efficacy are you seeing across these different landscapes right now? It's so different across different organizations based upon the leadership that's in the organization and how thoughtful and innovative that that leadership is willing to be. That's really what it comes down to. There's no technological limits or leaps that we have to make to do this. it's leadership, it's will to get it done, it's incentives. And so in in well run organizations that have strong leadership that want to drive cybersecurity initiatives, I see ⁓ really really good adoption. I mean there's some really ⁓ really well done zero trust environments that are really difficult to break into. I mean there was one done by the government They called me up afterwards and, you know, we sent every red team in the United States government against it and and and not the you know, zip. ⁓ like we were stunned. And so so we know it works and and and and I've built and or been involved in the building of hundreds of them and so I know that they work. It's just getting people to have the will to want to to to be to get started in doing the process, right? Yeah, there's no a and what's the defining factor that's moving the needle that's becoming the forcing function of zero trust adoption is ⁓ you know, this post-Smith O'Sage we're in. AI is finding all these vulnerabilities when and people are lighting their hair on fire, they're finding so many new vulnerabilities, there's gonna be so many attacks. But there's no reason that the vulnerability and the attack ha ever have to meet. They don't ever have to exchange information because you can put a control in there that stops that. But if you don't, that's your problem. So I have a saying all bad things happen inside of an allow, right? If a bad thing happens inside your organization, you have a rule in place that allows it to happen. And that's because of a lot of bad policy. So I'm trying to get people to quit focusing on products and focus on policy. Figure out what policy you need for that protect surface, and that will tell you. what products are the best for that protect surface. And and and so instead of trying to build buy technology first and then figure out what to do with it, figure out what you need to protect, how it needs to be protected, and that'll tell you what technology you will be good for this particular environment because there's things that work well in say an O T environment that don't work in the cloud. Right? And so you wouldn't you you just can't have one there's no, you know, silver bullet or or or easy button in this. Yeah. Yeah, which again, human behavior. Like humans are the interesting piece, this whole equation. ⁓ because there's so many people I've talked to. It's like I want, I want one. It's like, but I understand the desire. But like what do you what what are you trying to get done? Because that OT landscape is radically different, different vendors, different architectures than your data center that you control, which is radically different than the cloud that you control. And if you that you you know that you're trying to control. ⁓ and and I it'd be great to have one tool, but how do you have a tool that is able to go deep and like the the architectures are all so different and and the methods are the same, but the implementation is so different across those? And I think what the the one that people should want is one policy. So the same essentially the same type of policy. We call it a Kipling method policy and zero trust. Who what when where why and how? Who should have access via what application? ⁓ when is that should that ⁓ be allowed, right? It shouldn't be twenty-four by seven, right? Because that's when the the hackers come in when we go to bed. And then ⁓ where is the protect surface located? Why are we doing it and and how are we validating it? You can have that same policy construct across everything, right? It's just it's gonna be instantiated in different technologies. And that and that's why I'm trying to get people to move from product think focus to policy focus. Because everything comes down to policy, doesn't it? Yes. Yeah. And it's I think there's a whole orientation on on your governance philosophy that then drives the policies that are the articulation of that philosophy. That then eventually lands in execution. I was like, right. So how you going to implement these? What what policy language based on the tool and the environment? ⁓ but I I think your methodology is so sound. ⁓ yeah, and and the other part of that is that the governance side of it has to understand how policies are created in the real world so they they they don't just become dusty old doc well, I mean, they when I started they were physically printed in binders, right? And they c had dust on them, literally. But now they're they're they're documented, they're electronic documents, but they often can't be implemented because the people who are creating those kinds of governance things in the GRC world don't understand how the technology works. So they're, you know you just you know, if if you're gonna write a document on how to build a car, you have to have built a car first before you write the you have to know how cars are built. Right. Right. Right. Yeah. There's a whole separate segment could do on on policy. Yeah. And and how do you create ⁓ readable and intent based policy that actually can be portable and effective and ⁓ but yeah, that it's ⁓ all right, so ⁓ When you brought up Mythos, like when you think about the environment that we're dealing with today, ⁓ it feels like there are two factors that are really problematic. ⁓ the not enough teams. I read a stat from actually across Gardner, Forester, and Cisco, the general stat on who is which how many what percentage of organizations have effectively implemented a zero trust framework and strategy. And all of them circle in the high single digits to low double digits, like nine to thirteen percent, which is which I I can validate from the companies I work with. Like there's a lot of them that are pretty far away from a zero trust ⁓ architecture and framework and and and culture and thinking. And then we've got all the new craziness that AI is bringing. where where do you think? What what do you think is going to happen here? What what I'm seeing is this crazy gerbil wheel rotation around Mythos. And it's not mythos, it's capabilities of agents and frontier models overall. ⁓ that it it it feels like we might meant we might not be going the right direction. Like the the response has been going back to your White House, ⁓ the Hilden example. The interesting th thing about these ⁓ advancing AI is, yeah, they're gonna find a bunch more ways into that hotel. ⁓ and many that you've never even contemplated before. You've never been able to see those seams in the walls or those cracks in those windows. But but that isn't the game. The game is how do you protect the president and how you protect the secretary of state and we protect ⁓ but but people I see everyone rotating on, let me go find all the cracks and let me go seal all those cracks. I there we're so rotated the all the metrics are about prevention. ⁓ and about activities and transactions. And yet what you've been advocating is more foundational and philosophical. I mean, even that orientation of, hey, the guy got in, but he didn't achieve his objective, therefore we won. Those are hard things to report. But I think it's our reality. It's like getting in is just a portion of the kill chain, and you're just trying to understand their intent and objective and make sure they don't achieve the objective. And if you stop them from achieving the objective, you've actually won, even if they were able to get in and do and and be in certain portions of your system. How do you see that playing out? Like what what are we gonna have to do over the next two years so that we survive what we what what's coming up? Well one of the things is like in zero trust adoption, we need to measure it differently. Because these are when you when people are measuring like has the whole company is a are they fully zero trustee? No, the answer is how how many people have at least one protect surface that they've built and that's functional and that the th that's operational and it's doing its job. Right? Because we have to think of this in in in incremental steps. ⁓ and and and if we don't if we don't, you just I mean it's just like ⁓ you know, I just moved into a a house a a year ago and it it had been a foreclosure by a bank and and it'd been rented out over the years and it w needed some repairs. Well, guess what? I don't have six hundred friends who can come over and fix it all up in in one weekend like they do on the television shows. You know, we're doing it one room at a time. And you start with what's most important, right? So I don't know about you when you have to do a remodel, but in in my house, ⁓ the bathroom is the most important thing where my wife, you know, wants we call we call ours the spa, right? So that was the first thing that got remodeled was We turned the old ugly bathroom into a lovely spa. And so, you know, and now, you know, w you th other things get remodeled and and and you do it one room at a time, don't you? And that's how you should build these kinds of environments is one room at a time. Yeah. Yeah. I mean I think collaborating, you know, with you and others on how do we get the right measurements and metrics, period. ⁓ Because there's almost again, ⁓ other than the highly regulated entities where they either agencies or, you know, key financial services organizations, there's a handful where they're willing to introduce whatever friction is necessary because they understand how catastrophic the breach would be. There are very few that even are measuring things like reachability and blast radius and the highest highest value assets. that's why why I'm sorry. ⁓ That's why PCI was such to be able to be a PCI QSA was so important to me because all we were caring about was one thing, what what one one what what I now call protect service. So you you and PCI was such a brilliant thing. Most people don't understand it because I hear people still complain about it. Look, can you watch this just the audience that isn't in financial services or financial transactions? This is PCI is it's for credit card security. Right. So all the credit card companies came up with a a ⁓ a a a a compliance model. And the brilliant thing about it is if they wouldn't have done it, you'd have to do a ⁓ a s a separate credit card security audit for every state in the union, every country in the world. I mean, they kept the governments out of this because it just was so solid. And we need to adopt some models similar to that where we're focusing on What is the effic efficacy of your credit card security? What's the efficacy of your, you know, intellectual property security? Those kinds of things. Those are the that's the way we're gonna answer it. Yeah, we can go again, massive protect surface ahead of time and and the fundamentals will be very, very consistent. But yeah, now you're what are you protecting and how do you report on it? They'd be it'd be good for all of you out there and maybe for us to brainstorm on how how do we begin to change the because what you know I was in the BI and E ETL and data warehousing segment for a long time because I saw early in my career what gets measured gets focused. And yeah, that metrics are so darn important. And right now, I think as a world, we need to augment the key metrics that people, that the the general cyber team is being held to with the four a few more of the fundamental elements that really going to enable them to do their job effectively. Because it it takes a brave CISO to stand up in front of the board ⁓ and say, you know, my job is to make sure that when things go wrong, they don't go too wrong. So yeah, you you can't hit me over the head if some things go wrong. You gotta reward me if they don't achieve their objective, which is where it should be. But I don't think most of the controlling entities would appreciate that. It's like, no, no, your job is to protect the surface and yeah. Close every C V E and patch your systems faster. It's like, yeah, I mean that that's a portion of my job. And I think, you know, a as a CEO, you know this. If you're not giving the right incentives to that, the CISO generally doesn't have the authority to actually get stuff done. Right. Right. Right. And so they're they're just they're just there to throw under the bus when things go bad. It's a horrible job. I I I wouldn't take that job for anything. And ⁓ until we get CEOs and boards that say, Here is here is the the objective, right? What in the military they call commander's intent, go get it done, and then you can't get in trouble for well, it didn't go right because I'm I'm I'm aligned with the intent that you gave me, right? And there is a whole lot of variables that can get in the way of achieving success. And one of those is adversaries. Right, because we're in an adversarial business. There's five domains of warfare air, sa, land, space, and cyber. And so for the first time in history, companies, pri public and private companies are fighting against nation states. That has never happened before, right? But it happens all the time. And ⁓ it's just it it it it's it's des it it leads to some big disasters and it's put some companies out of business, you know? Yeah. No, it's ⁓ I've been saying for a couple of months, the physics of cyber have changed and it's it's the whole thing. Like entry is very very different, speed of attack is very, very different, sophistication's different, and you're fighting adversaries that you never had to fight before. So like what is your what's your adaptive strategy? Like if it's if it's fundamentally changed, how are you thinking about your landscape differently? Yeah, the the Marines have that concept of adapt and overcome and The idea is you're in the middle of of the fight. ⁓ you know, you shouldn't have to call back and get permission. Right? I mean, this is the lesson of World War Two. Why did the Germans lose? 'Cause every time there was a change ⁓ i in the fog of war, ⁓ they had to call back to to to Berlin and so, you know, Robel couldn't move his panzers on D Day because Hitler was taking a nap. Right? Yeah. Where in the American army, ⁓ a commander gets killed or can't be reached, you just do what what your objective is and just achieve that objective at any cost. And and that should be the way we go about cybersecurity. We should be taking cybersecurity ⁓ and fighting it the same way we fight a war. Yes, it i it is a war. It is a war. So with all that discussion, like you have been involved with ⁓ presidential candidates and and and presidents in multiple different occasions. ⁓ Including the the latest recommendation, the NC Attack Zero Trust Report. How did that happen? Like how did how did you get involved with Ross Pro? And then how did that translate into the the other interactions you've been able to have for the years? Well, I mean, I was I was Ross Pro's broadcast engineer for his nineteen ninety six political campaign, right? And that's when I learned that I didn't want to be involved in politics ever, ever again 'cause it was just a a dirty, nasty little business. But ⁓ I got involved the you know, the O if you remember the OPM data breach happened, the Office of Personnel Management and Congress wrote a report where they recommended to they asked the that that ⁓ that O and B ⁓ get all government agencies to adopt a zero trust environment. And that's where it all started. So I went to Washington D C. I met with the the staff from Oversight and Government Reform Committee of the House who wrote that report. I met with Will Hurd, who was a congressman who was the number two on that committee. And then I started to, you know, get involved with people and and then ultimately I got invited to the NSTAC committee ⁓ because ⁓ you know I knew several of the people who were who were running that committee and they wanted to do a zero trust thing and and finally they said, well we can't do a zero trust subcommittee without the guy who created it. Even though there've been lots of other things where People wanted to keep me out because i you know this, pastry, right? ⁓ you all have lobbyists, all the vendors have lobbyists, and they don't want somebody who's gonna come in and push back against what they're trying to achieve to force somebody to buy their product, which was some of the early zero trust recommendations from the federal government. And so we stepped back and took a more objective view of it in in in the NSTAC national. Security Telecommunications Advisory Committee is what that is. And it's been around for decades and decades and decades. So by ⁓ mandate, every federal agency has to have a zero trust program management office. It has to have a zero trust program manager, somebody dedicated to that process, and it gets allocated a zero trust budget. And those three things are three things that ⁓ commercial entities would do well to adopt. Have a program management office, have a program manager, and dedicate a budget to it, because really, you know, it's just coming out of the grocery budget. Right? Yeah. Yeah. ⁓ w and so people are trying, well, we don't have budget for this. Well, you know, you actually do. Everybody has budget for the things that they need. Yes. But if if they're not if they don't feel the urgency, then they say they don't have budget. But I've been starting to get calls from CFOs who say, I'm underfunding, cybersecurity, help me work through this because you know, we look at it as overhead, as a cost center, when it's actually, you know, our life. our existence, right? Yeah, it's a foundation for all of us it it literally is tied to business continuity and and overall business resilience. Yeah. At this because I I don't know many organizations that are able to do their work day in and day out unless their online environment is healthy. Yeah. And so so I I companies have I think that that we have to have this this you know we have to have leadership drive these things, right? I mean people like you who are C CEOs ⁓ have to have to do this. And ⁓ if it doesn't come from the top, ⁓ you know, it's it's gonna be hard to ⁓ to make it happen. You have to have the right incentives. And and if you if if you don't do it, if y you know, I I mean what you can do, you know, the former CEO of Splunk, amazing company, you know, ⁓ did a you know, I was at the first Splunk dot conf, right? I you don't th I don't think you were even there yet. No, I was right there. That was the year before I got there. Yeah. So ⁓ you know, I amazing company. I mean, you and all your CEO friends have to get together and say, We as CEOs need to to change the way we incentivize cybersecurity. If the if I would have one ask of you as a person, not just running the company you're running now, but just within the context of what you've done in your career, unless you people come together and create a Manhattan project and say we as CEOs are going to incentivize doing security in the right way, it's never going to get done, you know, because everybody's afraid to do it. You know, the the people at the who are actually going to be on hands on keyboards are afraid to do it. Because there's no they don't get any extra kudos When it goes well 'cause it's transparent. But if something goes wrong, then then they're in trouble. And you don't want to get in trouble, you know? And that's that definitely the biggest friction I've found. And again, you've been at this way longer than I have. ⁓ is that yeah, the fear if everything's connected, then stopping a packet from moving could be a system downtime incident. And I think that is like everything that I that I've seen with with all the several teams I've interacted with is how willing are you to take that risk? Right? Are you more afraid of potentially getting it wrong and causing a system downtime or having your entire estate breached? ⁓ and it's it it takes it does take a lot of without the right top-down confidence, I I appreciate the lot, yeah, the the challenge that these guys have. It takes a lot of courage to to to do the right thing if it if the consequences could be fairly large if if you don't do it properly. Right. And so, ⁓ but you know, all we c right now all we care about is confidentiality, you know, I mean is availability in the CIA triangle. And nobody cares about confidentiality. Nobody even knows what integrity means anymore. So ⁓ if all you care about is uptime, then you're gonna get hacked because you're there's no w when is there gonna be a time for somebody to come in and fix it? Right. Target was a great example ⁓ of this where where a lot of the people who could have fixed it were on vacation because they were in a ⁓ freeze because it was Black Friday. Well, ⁓ gee, I wonder why the attackers chose to attack on Black Friday. Hmm. The most credit card transactions and nobody is gonna be able to actually defend. Right? Imagine imagine being told in a military base Well, if there's an attack today, we can't defend ourselves because ⁓ you know, ⁓ it's ⁓ flag day or whatever. Yeah, you know. Yeah. It would never happen, right? So you have to have a rules of engagement where if they're firing at us, we gotta we gotta defend ourselves. We gotta you know, we have to do that under all circumstances, no matter what else is happening. Yes. Great conversation. I could I could talk to you for and ⁓ we will follow up. I could talk to you for hours and hours. ⁓ but good Quick speed round of a couple of quick questions. ⁓ just ⁓ biggest myth in cybersecurity today. Biggest myth, that more products will fix it. Buy more stuff. I would agree with that one. I ⁓ a friend of mine calls it expense in depth. Yep. All right. Then the more fun one for for me and probably for the audience. If you were not, if you hadn't wandered in and found your way from networking to cyber to the advocacy you're doing, what would you be doing instead? Boy, I don't know. I mean, there you know I probably would have just stayed in the television business. But th that that had become you know, like I covered the Oklahoma City bombing. ⁓ there were just a lot of things that are just it's a hard business to be in for for a long time. Nobody makes you know, y at some point you have to get out of it because of the stuff that you see. So I don't know what I would have done. I I I mean luckily I didn't have to make that decision, you know? And I'm thankful for that. I could maybe I would have gone back to the farm. I would have listened to my old man and gone back to the farm as Elton John sings, you know? We we're very grateful that you actually chose Cyber and that that you're out there every single day ⁓ helping us. ⁓ all right. Love the loved the chance to meet. ⁓ for people that want to follow your work and and and stay close to you, what's the best avenue for them to to do that? Well, LinkedIn, of course, and then at Illumio we have the Zero Trust Hub. So Lumio dot com and then ⁓ you'll find the Zero Trust Hub there and and a lot of information about Zero Trust there. ⁓ that you can do that. And then also I'm deeply involved in the Cloud Security Alliance Zero Trust Working Group. And so those are the the three main avenues that that I kind of communicate through. Awesome. Awesome. All right. Well looking forward to a lot more time with you in the future. ⁓ that's a wrap for this episode of In Progress. Thank you so much for joining us and everyone else out there, thank you for listening. And I'll see you on the on the next episode. Thank you.