Zero Trust or Zero Chance?

i think really where we're getting to is now technology is good enough in the security space that we don't have to kind of beat users up on being internet savvy and internet smart i honestly am not a huge fan at all of phishing training i think in general it doesn't really make much change statistics kind of prove that and where we are now is really what you should be looking at is how can i make the experience for the user as frictionless as possible but still have the right security controls that need to be there and It is a common ZT thing for people that are in the sort of practicum is figure out how you can remove people from being the avenue of compromise.

And you do that by putting controls in front of them, not by training them not to click a link.

Like that's me.

That was one of the most ridiculous things we ever came up with.

Let's put everybody on a system that requires you to interact with content and then say, oh, never mind.

Don't interact with that content.

We have had, as a guest on this show in previous years, a well-known security specialist who goes by the name of FC.

He is the type of red teamer who gets paid to break into hospitals and other institutions and companies, not just to break into their networks, but into the secure building itself.

Fascinating guy.

And he said the same kind of thing.

He said, we've trained people to work with a mouse and to click on links.

And it is unfair now to say you're wrong in doing that.

So now what can we look at to start to solve such a dilemma?

I mean, I think big broad strokes, like I just think what makes a difference, right? I'm a huge fan of browser isolation technology because that's how we interact with content and the browser is a great control plane to put controls in.

Does it mean it's bulletproof? No.

But is it a solid one? Yes.

Multi-factor authentication massively reduces the avenue for compromise because it is an out-of-band additional factor.

And then also having a really good segmentation isolation control policy as well as good rule management of inbound and outbound.

It's funny because all of the basic things that we've talked about for 30 years are basically what makes the most difference.

And yes, AI might help you do that at a policy level quicker, better, faster.

But.

We haven't re-engineered how the internet works.

We have not changed up how the OSI model functions.

None of this is totally new.

It is just that we've continued to kind of follow along with chasing market trends rather than actually going like, well, wait a minute, what stands the test of time and what must be present for a bad guy to win?